Could a Quantum Computer Break Bitcoin? What BIP 360 Says and What It Does Not

Bitcoin's rules protect your coins with a digital lock. A future quantum computer could, in theory, pick certain locks. Bitcoin developers have a draft plan for that, called BIP 360. This article explains the plan in plain terms, which coins carry the most risk and what it all means for you today.

The short answer

The BIP 360 text says it is unclear when, or if, quantum computers strong enough to break Bitcoin's signatures will exist. Bitcoin developer Pieter Wuille, quoted in a Human Rights Foundation report, called such machines "hypothetical." The same report says experts at a summit were split on whether the threat will ever become real. So the timing is uncertain, and no one can point to a date.

What the risk actually is

When you spend bitcoin, you sign the transaction with a private key. The network checks that signature with a matching public key. Normally the public key cannot be used to work out the private key. The BIP says a quantum computer running a method called Shor's algorithm could do exactly that, if it were powerful enough.

The key detail is when the public key is visible. The BIP describes two cases:

• Long exposure: the public key already sits on the blockchain for anyone to see. A future attacker could take their time.
• Short exposure: the public key appears only while your transaction waits to be confirmed. The window is short.

Which coins are exposed

The BIP includes a table of output types. In plain terms:

• Already exposed: very old coins stored in the early "P2PK" format, which includes coins from Bitcoin's earliest days such as Satoshi's coins. Taproot outputs (addresses starting with bc1p) are also listed as vulnerable. The BIP lists "reused outputs" too. Reuse matters when a public key has already been revealed, for example after coins were spent from an address and more coins were later sent to the same address.
• Hidden until you spend: older formats such as P2PKH, P2SH, and the common bc1q addresses (P2WPKH and P2WSH) keep the public key out of sight until a script reveals it. The BIP marks them "No*," and the asterisk means they become vulnerable once the public key is revealed.

The Human Rights Foundation report estimated that about 1.72 million BTC sits in very early address types it calls highly vulnerable. It estimated another 4.49 million BTC is vulnerable but could be protected by moving it. These are one group's estimates from October 2025.

What BIP 360 proposes

BIP 360 is titled Pay-to-Merkle-Root, or P2MR. It would add a new type of Bitcoin output that removes the "key-path spend" used by Taproot. That is the part that puts a public key in plain view on the blockchain. Removing it is meant to protect against long exposure, where a public key sits in public view for a long time. It does not hide every key. The BIP says most Bitcoin transactions still reveal a public key when coins are spent, and protection from that short window may need new post-quantum signatures.

The proposal's authors are Hunter Beast, Ethan Heilman and Isabel Foxen Duke. The BIP's status is "Draft" (version 0.12.1 when we checked), and it describes a soft fork, which is a type of rule change that must win broad support before it can switch on. If it were adopted, P2MR addresses would start with bc1z. Yahoo Finance and Forbes reported in February 2026 that it was added to the official BIP repository. Forbes also noted that the proposal "does not activate any changes."

What BIP 360 does not do

• It does not stop short-exposure attacks. Public keys are still revealed when coins are spent, and the BIP says wallet habits cannot prevent that. Protection may need new post-quantum signatures, which is separate work.
• It does not change coins already sitting in other address types. Owners would have to move them to a P2MR output, and P2MR is not active on the network.
• Wallets and nodes that are not updated will not understand P2MR outputs.
• It is not a fix for every exposed key. The BIP says its long-exposure protection depends on users not exposing public keys through address reuse or other unsafe practices.

Where NIST fits in

On Oct. 27, 2026, the U.S. National Institute of Standards and Technology announced a final report on moving to post-quantum cryptography. The report, NIST IR 8547, says NIST will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035. NIST's announcement says a national security memorandum set 2035 as the main target for federal systems. It also says Executive Order 14412 requires federal high-value assets and high-impact systems to migrate by 2030 for key establishment and 2031 for digital signatures.

This guidance is for federal agencies and technology providers. It does not set any rules for Bitcoin, and NIST's announcement does not mention Bitcoin. It does show that governments and standards groups are planning for the same long-term issue.

What this means for you

• Address reuse can matter. In some address types, spending from an address reveals its public key, so coins sent to that same address later sit behind a key that is already visible. The BIP's security section says long-exposure protection depends on users not exposing public keys through reuse or other unsafe practices. Your wallet's documentation explains how it handles addresses. Our guide on what a block explorer shows about a Bitcoin address explains how to see what an address reveals.
• BIP 360 imposes no current requirement. It is a draft proposal that is not active on the network, so it does not require anyone to move coins today. Neither BIP 360 nor the NIST report asks anyone to share a recovery phrase. Treat any message that says otherwise as a scam.
• Wallet and exchange support will decide what you can use. A new address type helps only if your wallet or exchange supports it.

What is still unknown

• Whether Bitcoin will ever adopt BIP 360 or a different design.
• How the community would handle very old coins that cannot be moved.
• When, or if, a quantum computer will be able to break Bitcoin's signatures.

Disclosure: BIP 360 is a draft proposal and may change or never activate. Quantum computing timelines are uncertain, and the coin counts above are estimates from one advocacy group. This article is about security concepts, not a recommendation to move or store coins in any way. The illustration is a computer-generated concept image. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.