Bitcoin developers are debating a proposal that would let the network freeze coins held in older address types if users do not migrate to quantum-resistant ones. That cuts into one of Bitcoin’s oldest assumptions: if you hold the private key, you control the coins. No one else can stop you.
BIP-361 puts post-quantum migration on the table
The proposal, BIP-361, was updated Tuesday in Bitcoin’s official repository under the title “Post Quantum Migration and Legacy Signature Sunset.” Jameson Loop and other cryptographers backing the idea argue that holders should move funds to new address formats built to resist future quantum attacks. If they do not, those coins could lose spendability under network rules.
The urgency comes from a recent Google report warning that a sufficiently powerful quantum machine may need less computational power to break Bitcoin’s security model than earlier estimates suggested. After that report, some observers pointed to 2029 as a possible deadline for Bitcoin to prepare.
Why exposed public keys matter
Bitcoin wallets today largely rely on ECDSA, the Elliptic Curve Digital Signature Algorithm. Each wallet uses a private key to prove control over coins and a public key to receive funds and validate signatures. The weak point is simple: once coins are spent, the public key becomes visible on-chain and stays visible.
Supporters of the proposal say that a strong enough quantum computer could use that public key to derive the private key and drain funds. According to the Google study cited in the article, about 6.7 million BTC were sitting in vulnerable addresses as of March.
Three phases would change what legacy addresses can do
BIP-361 builds on BIP-360, introduced in February, which proposed a soft fork to enable a new transaction type called pay-to-Merkle-root, or P2MR. The design borrows from Taproot’s P2TR structure but removes the key-based spending path that many researchers see as exposed in a quantum era.
Under BIP-361, Phase A would begin three years after activation. At that point, legacy quantum-vulnerable addresses could still spend existing coins, but they would no longer be able to receive new BTC. Phase B would start five years after activation. Old signature schemes, including ECDSA and Schnorr, would become invalid, and attempts to spend from those wallets would be rejected by the network. The coins would remain on-chain, but they would be frozen in practice.
Phase C is still being researched. The idea is to create a recovery path in which holders of frozen wallets could prove ownership with a zero-knowledge proof, showing knowledge of a secret without revealing it. If that approach works, coins frozen in Phase B might be recoverable.
The backlash targets Bitcoin’s core ownership model
Critics are pushing back because the proposal does more than add a technical defense. It introduces the idea that Bitcoin can override direct key-based control under exceptional conditions. For many in the community, that is the real fault line.
Bitcoin was built around permissionless ownership: whoever holds the private keys controls the funds. A mechanism that can freeze coins, even as a defense against a future quantum attack, suggests that this rule is not absolute. That is why the response has been so negative. The argument is no longer just about how serious the quantum threat is, but whether Bitcoin should trade part of its censorship resistance for a chance to reduce that threat.