Bitcoin's response to the threat posed by quantum computers is gradually converging into a coherent strategy, according to Christine D. Kim, founder of Protocol Watch, who outlined how several independent proposals could combine into a layered defense for the network — spanning a new output type, a new signature scheme, and fallback plans for users who move too late.

Two complementary proposals form the core of what can be done before cryptographically relevant quantum computers (CRQCs) become a reality. The first, BIP-360 — still in draft status — introduces Pay-to-Merkle-Root (P2MR), a new output type that would be activated through a soft fork, Bitcoin's mechanism for backward-compatible upgrades that depends on broad network consensus. Its primary function is to conceal users' public keys until funds are spent, a critical safeguard because a sufficiently powerful quantum computer could otherwise derive a private key from an exposed public key. Under Bitcoin's current rules, spending a coin makes its public key visible on-chain, which is why the broader effort centers on migrating existing holdings before CRQCs can exploit such exposure. P2MR also supports multiple spending paths and is designed to be cryptography-agnostic, allowing it to accommodate future post-quantum signature schemes without further structural changes.

The second pillar is SHRINCS ("Shrunken SPHINCS"), a hash-based signature scheme developed by Blockstream Research. Notably, it relies exclusively on SHA-256 — the same hash function Bitcoin already uses for mining — thereby avoiding any new mathematical assumptions and anchoring post-quantum security to a primitive the network has relied on since its inception. According to its draft BIP, authored by Bitcoin Core contributor "conduition," SHRINCS public keys are just 48 bytes, with stateful signatures as small as 548 bytes, making the scheme roughly an order of magnitude compact than comparable post-quantum alternatives. Paired with P2MR and a dedicated verification opcode, SHRINCS would offer users an optional, backward-compatible path to quantum-resistant security well before CRQCs exist.

— Christine D. Kim (@christine_dkim) September 14, 2026

Rescue Protocols for Late Migrants

For users who fail to migrate in time, developers have proposed two rescue mechanisms: Lifeboat, presented by researcher Tadge Dryja, and Dropkick, authored by conduition. Both rely on commit-reveal schemes, enabling users to prove on-chain that they controlled an address before any attacker did, and thereby to move their coins safely even after quantum adversaries emerge. Lifeboat would activate automatically via a conditional soft fork triggered by on-chain evidence of a quantum attack.

Developers caution, however, that significant questions remain unresolved. SHRINCS lacks a formal security proof and independent peer review — a gap its draft BIP, published in late August, explicitly acknowledges, and one that carries particular weight in a protocol known for adopting cryptographic changes slowly. Signature size presents another concern: SHRINCS signatures remain roughly ten times larger than Bitcoin's current Schnorr signatures, raising questions about block space if the scheme were widely adopted, with aggregation research still ongoing. Finally, the fate of lost coins, whose owners cannot migrate them, remains an open and contentious question.

As Kim notes, the pieces are coming together — but Bitcoin's quantum problem is far from solved. How the remaining open questions progress — SHRINCS's path through independent review, BIP-360's advance beyond draft status, and how the lost-coin debate is settled — will help determine whether these proposals harden into Bitcoin's actual quantum defenses.