Bitcoin’s response to future quantum computers is beginning to look less like one emergency upgrade and more like a sequence of protections. Two proposals illustrate that division of labor: Pay-to-Merkle-Root, described in draft BIP-360, would reduce long-term exposure of public keys; SHRINCS would introduce a hash-based signature option intended to resist quantum attacks.
P2MR limits one kind of exposure
BIP-360 proposes a new output type through a soft fork. It resembles Taproot’s script-tree design but removes the key-path spend. That change allows coins to sit behind a commitment to spending conditions without placing an elliptic-curve public key directly in the output.
The distinction matters because a sufficiently capable quantum computer could, in theory, derive a private key from an exposed elliptic-curve public key. Hiding that key until spending reduces the time available for an attacker. The draft explicitly describes this as resistance to “long exposure” attacks, not complete protection from every quantum scenario.
Once a conventional signature enters the mempool, its public key becomes visible before confirmation. An attacker able to solve the relevant cryptography quickly enough could attempt to race the intended transaction. BIP-360 does not claim to solve that short-exposure problem on its own.
SHRINCS targets the signature layer
Protocol Watch founder Christine D. Kim described SHRINCS as a SHA-256-based, post-quantum signature proposal being developed for Bitcoin. In the emerging roadmap, users could first move coins into an output structure such as P2MR and later use a quantum-resistant spending path once support exists.
Hash-based signatures replace reliance on the discrete-logarithm assumptions behind Bitcoin’s current elliptic-curve signatures. The trade-off is not trivial: post-quantum signatures and their verification rules can increase transaction size, validation cost and implementation complexity. A secure design also requires specialist review, test vectors and operational plans for wallets and hardware signers.
Draft status is the most important label
BIP-360 is marked Draft. That means it is a technical proposal, not an activated Bitcoin rule or a commitment by node operators. SHRINCS also remains research work. Neither gives current addresses automatic quantum resistance, and no migration deadline has been established.
Activation would require broad technical scrutiny and adoption across wallets, exchanges, custodians, miners and node software. Developers must also decide how to handle coins whose public keys are already visible, including reused addresses and old output types. Rules intended to protect dormant coins could create difficult questions about ownership and intervention.
What holders should take from the roadmap
The practical signal is preparation, not panic. Users should continue following established security practices, including avoiding address reuse where their wallet supports fresh addresses. Custodians should inventory signing systems and monitor standards work because a future migration could require coordinated software and hardware changes.
Bitcoin’s quantum work is becoming more concrete, but the open questions are central rather than cosmetic. P2MR and SHRINCS show how exposure control and signature replacement might complement each other; peer review and network consensus will determine whether that architecture becomes Bitcoin policy.
Sources & further reading
- Adapted from BTC-Pulse: Bitcoin’s Post-Quantum Roadmap Takes Shape Around P2MR and SHRINCS
- Upstream summary: Wu Blockchain
- Primary protocol update: Christine D. Kim on X
- Primary specification: Draft BIP-360