BIP-361 Wants to Freeze Your Bitcoin. Here's Why That's a Bad Idea.
BIP-361, authored by Jameson Lopp and a group of researchers, was published yesterday. It proposes a three-phase "sunset" of Bitcoin's current ECDSA and Schnorr signatures in response to the theoretical threat of quantum computing. Phase A would block all sends to legacy (non-quantum-safe) addresses. Phase B, triggered five years after activation, would render ECDSA and Schnorr spends completely invalid, freezing every coin that hasn't migrated. Phase C is a placeholder for a potential seed-phrase-based recovery mechanism that doesn't exist yet.
The problem starts with what we'll call the "man in the coma." If you're incapacitated, in prison, lost at sea, or simply unaware of the deadline, your coins are gone. Not stolen. Not lost. Frozen by consensus. That's not a bug in the proposal. It's the design. And it's a terrible precedent for a protocol that was built to be permissionless and opt-in.
Proponents argue the freeze is necessary to prevent a quantum attacker from market-dumping millions of coins with exposed public keys. It's a fair concern. Over 34% of all bitcoin have revealed a public key on-chain. But consider the tradeoff: Bitcoin has survived 80%+ drawdowns before. If a quantum-enabled theft caused another, the network would recover. What it might not recover from is the precedent that consensus rules can be used to freeze coins based on the type of address they sit in. If you can invalidate addresses to protect against quantum theft, governments will point to that precedent to justify freezing "sanctioned" coins, or coins held by politically inconvenient people. The slippery slope is real.
There's also the question of whether this is premature. No cryptographically relevant quantum computer exists today. The hardware engineering challenges remain enormous. As Wicked Smart Bitcoin noted in his NACK, "Bitcoin has historically relied on voluntary adoption, wallet defaults, and fee incentives rather than protocol-level coercion. That approach should be exhausted first."
To be clear, the quantum threat deserves serious attention, and serious people are working on it. Presidio Bitcoin published a comprehensive "Quantum Readiness" report the same day BIP-361 dropped, and the numbers are worth understanding. If a cryptographically relevant quantum computer existed today, an estimated 6.5 million BTC (roughly one-third of total supply) would be immediately vulnerable to theft due to long-exposed public keys. But here's the critical detail: over two-thirds of that vulnerable supply, roughly 4.5 million BTC, is attributed to address reuse, with much of it concentrated in a small number of large custodians who reuse addresses for operational simplicity. That exposure is reducible right now, without any protocol change. Exchanges and custodians could dramatically shrink the attack surface simply by rotating keys and stopping address reuse. The remaining structurally exposed coins (early P2PK outputs, Taproot key-path spends) are a harder problem, but the Presidio report notes that if 25% of block space were dedicated to migration, 90% of bitcoin's value could move to quantum-safe addresses in roughly four days.
As we've covered previously, Bitcoin developers have been building quantum defenses for years. Post-quantum signature schemes like SHRINCS and SHRIMPS are technically feasible today, and the share of quantum-related discussion on the Bitcoin Development Mailing List has risen from 5% in 2024 to 50% in 2026. The work is happening. The right approach is new address types that people voluntarily migrate to, combined with industry best practices (no more address reuse), not a consensus-level freeze that punishes anyone who doesn't comply on schedule.
Bitcoin's core value proposition is that no one can freeze your money. BIP-361 proposes doing exactly that. Regardless of the justification, that's a line that should not be crossed.
|
