Bitcoin’s Quantum Computing Risk: How Can BIP-360 Help?

Bitcoin has been designed to survive unfavorable economic, political and technical conditions, but today, the developers are already preparing to deal with a new threat: Quantum computing. On 17 March 2022, quantum resistance was introduced into the Bitcoin Improvement Proposal roadmap (BIP-360) as the first official addition to the list of long-term technical goals of Bitcoin. Some of the headlines paint the picture as a radical change, but the reality is much more than that. 

Today we discuss the implications of BIP-360 which proposes Pay-to-Merkle-Root (P2MR) as a way to reduce the quantum computing exposure on Bitcoin by eliminating the Taproot key path, explain what the proposal improves, what trade-offs it introduces and why it does not yet make Bitcoin fully post-quantum secure.

What threat does Quantum Computing have to Bitcoin?

To ensure security, Bitcoin relies on cryptography (mainly on the Elliptic Curve Digital Signature Algorithm (ECDSA) and Schnorr signatures proposed through Taproot). Computers of the normal kind can not possibly generate a private key out of a public key, but computers with significant quantum computing power are capable of running the Shor algorithm that might break the discrete algorithms of elliptic curves in a few seconds and reveal such keys. 

Quantum computing hits public-key cryptography hardest while leaving hashing relatively untouched, because Grover’s algorithm delivers only quadratic speedup rather than exponential advantage. Bitcoin’s SHA-256 therefore stays comparatively strong, which is why the community focuses on public key exposure on the blockchain as the primary risk vector that BIP-360 now targets.

What vulnerabilities does Quantum Computing reveal in Bitcoin?

In 2026, not every type of Bitcoin address is equally vulnerable to the challenge of quantum computing. The key vulnerabilities are as follows:

• Reused addresses: Spending reveals the public key on chain, leaving it exposed to a future cryptographically relevant quantum computer (CRQC).
• Public key (P2PK) outputs: Early Bitcoin transactions directly embedded public keys in transaction outputs.
• Taproot key path expenditures: Taproot (2021) provides two paths, a compact key path (which discloses a modified public key on expenditure) or a script path (which publicizes scripts through a Merkle proof). The key path is the main theoretical weak point under a quantum attack. BIP-360 directly targets that key path exposure.

How does BIP-360 leverage P2MR to mitigate Quantum Computing threats?

BIP-360 introduces a novel output type which is called Pay-to-Merkle-Root (P2MR) which is closely related to Taproot but with one significant difference: the key path spending option is completely eliminated. Instead of committing to an internal public key, P2MR commits solely to the Merkle root of a script tree, so every spend must reveal a script leaf and provide a Merkle proof showing it belongs to the committed root.

There isn’t any spending route based on any public-key, so no direct check of signatures takes place, and all spending routes are based on hash-based commitment. On a quantum attack, hash-based constructions are much more robust than elliptic curve assumptions, and therefore long-term elliptic curve public key exposure decreases exponentially and the overall area of attack decreases by orders of magnitude.

What capabilities does BIP-360 maintain despite Quantum Computing challenges?

The loss of the key path does not undermine smart contracts and scripting abilities in any respect. P2MR is completely compatible with multisig constructions, timelocks, conditional payments, inheritance constructions and complex custody features via Tapscript Merkle trees, preserving all the functionality that users have always had. 

Even Satoshi Nakamoto had briefly recognized the possibility of quantum computing in a brief exchange on his forums and hinted that Bitcoin could switch to more resistant signature schemes, in case necessary, which demonstrates that flexibility in upgrading the designs was always in the design philosophy.

What practical implications does BIP-360 bring for Quantum Computing preparedness?

When introduced into effect, BIP-360 will slowly alter the process by which new Bitcoin outputs are produced, spent and secured, particularly for those users who value long-term stability. Quantum-hardened wallets may also provide opt-in P2MR addresses, typically beginning with the “bc1z” prefix, as a fresh coin or cold storage hold. 

Transactions would be slightly larger because of extra witness data from script paths, potentially raising fees compared with today’s Taproot key path spends, yet this modest cost buys significantly better protection. This would take coordinated changes to both wallets and exchanges, as well as to custodians and hardware devices; the planning hopefully should start years beforehand to prevent the disruption of the last minute.

Conclusion

BIP-360 is the first actual move of Bitcoin towards minimizing its quantum sensitivity on the protocol level by redefining the way new outputs are generated and reducing public key leakage, preparing the long-run process of migration planning. It does not change existing coins automatically, keeps current signatures intact and underscores the need for a careful, coordinated ecosystem-wide effort. 

True quantum resistance will come from sustained engineering and phased adoption, not a single BIP, ensuring Bitcoin remains secure even as Quantum Computing matures.

Disclaimer: Crypto products and NFTs are unregulated and can be highly risky. There may be no regulatory recourse for any loss from such transactions. 

Frequently Asked Questions