There is no Bitcoin post-quantum migration deadline today. The commonly discussed timetable belongs to BIP-361, an informational draft proposal, and BIP-360, another proposal. Neither is an activated Bitcoin consensus rule, and no cited source identifies a currently available wallet that changes Bitcoin’s ECDSA or Schnorr spending to post-quantum signatures.
The practical risk is future compromise of Bitcoin’s public-key signature system. Coins whose public keys have already appeared on-chain are the clearest target described by the proposals; coins that still expose only a hashed public key have a different risk profile. If a migration is eventually activated, moving coins would normally mean sending them to a new output type and paying the ordinary Bitcoin fee market. No fixed migration charge has been published. Lost coins are an unresolved policy question, not a promised recovery opportunity.
As an Amazon Associate I earn from qualifying purchases.
What “post-quantum Bitcoin” means
Bitcoin currently relies on elliptic-curve signatures: ECDSA for some legacy spending paths and Schnorr signatures for Taproot-era spending. A sufficiently capable quantum computer could threaten the mathematical assumptions behind those signatures. The concern is not that every Bitcoin balance suddenly becomes readable. It is that an attacker could derive a private key from a revealed public key quickly enough to create a competing spend.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsBitcoin addresses commonly use a hash of a public key. Until the owner spends, that hash can conceal the public key itself. When a transaction spends an output, the spending data may reveal the public key and a valid signature. BIP-361’s discussion focuses on the distinction between outputs with revealed public keys and outputs whose keys remain hidden behind a hash.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
BIP-361 authors Jameson Lopp, Christian Papathanasiou, Ian Smith, Joe Ross, Steve Vaile and Pierre-Luc Dallaire state: “This proposal follows the implementation of any post-quantum (PQ) output type and introduces a pre-announced sunset of legacy ECDSA/Schnorr signatures.” That sentence describes a design sequence, not a live rule. A Bitcoin node, exchange or wallet does not become post-quantum merely because a proposal exists.
Are old Bitcoin coins already exposed?
Not all old coins have the same exposure. The most important distinction is whether the relevant public key has been revealed on-chain.
Coins with a revealed public key
Outputs that have exposed a public key give a future quantum attacker the information that the proposed countermeasures are intended to protect. Reused addresses and previously spent output types can leave public keys visible. BIP-361 says that, as of March 1, 2026, over 34% of all bitcoin had revealed a public key on-chain. That is a figure stated by the BIP-361 authors, not an independently audited measurement presented here.
Recommended Free Tools
Coins whose key is still hashed
For an output whose public key remains concealed by a hash, an attacker would generally need the owner to spend first, then attempt to act within the available transaction window. The exact safe boundary depends on the final output design, signature scheme and consensus rules. It is therefore too broad to call every existing coin “already exposed,” and too early to promise that hashed-key outputs are permanently safe.
What you should do with this distinction
- Do not assume age alone makes a coin vulnerable or safe.
- Avoid address reuse, because reuse can reveal a public key and links activity to the same key material.
- Do not move coins solely because an online service advertises a “quantum-safe” label; verify that a Bitcoin consensus upgrade and compatible output type actually exist.
When would a Bitcoin migration happen?
There is no cited, activated migration schedule. BIP-361’s timing begins only if the proposal, or a successor design, is adopted through Bitcoin’s consensus process and implemented by the network. Until then, dates and block heights in the document are illustrative parameters.
Rank #2
- Seedless by design, nothing to steal: Your private key is generated inside the EAL6+ chip and never leaves it. No seed phrase is shown or typed at setup, so a tampered device, keylogger, or phishing site has nothing to capture. 9+ years, millions of card.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 16,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Backup without a seed phrase: Your wallet is copied to 2 backup cards with end-to-end encryption, so there are no words on paper to lose or leak. Keep them in separate places; if one card is lost, the others restore full access. Optional seed phrase for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
BIP-361’s illustrative phases
| Phase | What the proposal describes | Status and qualification |
|---|---|---|
| Phase A | Permitted sends move from legacy ECDSA/Schnorr scripts to post-quantum scripts over a horizon of 160,000 blocks, approximately three years. | Illustrative proposal parameter; it would start only after activation. |
| Phase B | Nodes tighten ECDSA/Schnorr verification at a predetermined height, described as two years after Phase A activation. | Also contingent on adoption, implementation and the final consensus rules. |
Those windows should not be converted into a calendar deadline. Block production rates vary, proposal text can change, and activation may never occur in the stated form. A genuine deadline would require an activated rule, a defined block height, release notes for widely used node and wallet software, and exchange and custody support.
What must be true before a deadline is real
- A Bitcoin consensus proposal must be accepted and activated, rather than remaining a draft or informational document.
- Implementations must support the new output and signature rules.
- Wallets, exchanges, custodians and hardware-signing devices must be able to create and spend the new outputs.
- The activation height, migration window and treatment of legacy outputs must be published in the final rules.
How a future migration would probably work
The exact user interface is unknown because no final output type or consumer migration product is established. The general operation described by the proposals is a transaction from an existing output to a post-quantum output.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Confirm the activated rule. Check the Bitcoin implementation release and consensus documentation, not only a wallet advertisement. Verify the activation height and the final output type.
- Install compatible wallet software. Use software that can generate, display and spend the activated post-quantum output. Confirm that the wallet has a recovery method and that you control the signing keys.
- Back up the new recovery material. Record the seed or other credentials using the wallet’s documented procedure. A backup of an old ECDSA/Schnorr seed does not automatically become a backup for a different signature system.
- Plan transactions by risk and fee conditions. Prioritize outputs with revealed public keys if the final rules identify them as urgent. Select a fee rate based on the live mempool and the wallet’s fee estimator.
- Send to the new output type. Broadcast a normal Bitcoin transaction from each relevant UTXO to a post-quantum destination. Wait for the confirmation policy specified by the wallet or service.
- Verify the result independently. Check the receiving address, transaction ID and output type in software that understands the new rules. Keep the old backup until every balance and recovery path has been verified.
This is a conceptual workflow, not a current instruction to move funds. Sending to an unsupported or fictitious address format can make coins unspendable.
Will migration require a fee?
If migration uses ordinary Bitcoin transactions, the cost would be the prevailing network fee for the transaction’s size and the congestion at the time of broadcast. There is no published fixed migration fee, percentage surcharge or guaranteed free allowance in the cited proposals.
Why the amount would vary
- Transaction weight: A transaction with more inputs, outputs or larger signatures occupies more block space.
- Signature design: Post-quantum signatures may be larger than current signatures, which could increase transaction weight, but BIP-360 and BIP-361 do not provide a final production fee schedule.
- Network demand: Fees rise when users compete for limited block space and fall when demand declines.
- UTXO structure: Many small inputs can cost more to consolidate than one large input because each input adds data.
Consequently, claims that migration will cost a specified percentage of every holding are unsupported by these proposals. A responsible wallet would show the transaction size, fee rate and total fee before signing. Users should leave enough balance to cover the fee and avoid setting a fee so low that a time-sensitive transaction remains unconfirmed.
Rank #3
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Can quantum computers steal lost Bitcoin?
A new wallet cannot spend a coin when the owner no longer has the private key or seed. A future quantum upgrade would change the rules for valid spending; it would not reconstruct a lost secret.
BIP-361 identifies lost vulnerable bitcoin as a redistribution dilemma and lists competing policy families:
| Policy family | Possible result | What is settled? |
|---|---|---|
| Permit anyone to steal vulnerable coins | An attacker or other participant could claim coins meeting the vulnerability condition. | Not adopted as a final rule. |
| Allow throttled recovery | A restricted recovery process could create fee competition and replacement conflicts. | Design and limits remain unresolved. |
| Allow no one to steal them | Coins without usable keys could remain permanently unspendable. | Also not selected as the final policy. |
These alternatives involve ownership, fairness and network-security trade-offs. The proposal does not promise that all lost coins will be recoverable, nor does it establish that a quantum attacker will be allowed to claim them. Until final consensus rules exist, treat a lost seed as lost.
Where OP_VAULT fits
BIP-345, known as OP_VAULT, is relevant background for recovery design. It describes delayed spending and a pre-specified recovery path intended to mitigate the worst-case outcome of key compromise, including coin loss. It is not a post-quantum migration activation and cannot restore a seed that has already disappeared. Any recovery mechanism would require the credentials and conditions defined by its own rules.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is there a post-quantum hardware wallet to buy?
No cited source establishes an adopted, Bitcoin-compatible consumer hardware wallet that replaces ECDSA or Schnorr with post-quantum signatures. A hardware wallet can protect keys, isolate signing and provide backup workflows, but its physical form does not change the cryptography used by Bitcoin.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
Metal seed storage has the same limitation: it can improve durability against fire, water or physical damage, but it does not make an old signature scheme post-quantum. Before buying any device marketed with that claim, require evidence of:
- Support for an activated Bitcoin post-quantum output type.
- Compatibility with the final consensus and address rules.
- Audited firmware and a documented recovery procedure.
- Interoperability with the exchanges or custodians you actually use.
How general post-quantum standards relate to Bitcoin
The National Institute of Standards and Technology says it has released three post-quantum cryptography standards that can be implemented now to secure electronic information. Those standards provide general cryptographic building blocks. They do not certify a Bitcoin address format, wallet, hardware device or migration schedule.
Bitcoin developers still have to choose an output design, signature encoding, validation rules, resource limits and recovery policy that work within Bitcoin’s own consensus and fee model. A product that implements a NIST standard is therefore not automatically compatible with Bitcoin.
How to assess future migration options
When real alternatives appear, compare them on the dimensions that determine whether a migration is usable rather than relying on the phrase “quantum-safe.”
| Question | Evidence to require |
|---|---|
| Activation and support | Activated consensus rule, software versions, release notes and block-height deadlines. |
| Signature and address design | The exact output type, signing algorithm, encoding and verification rules. |
| Fee impact | Measured transaction weight, fee estimation behavior and whether larger signatures affect ordinary transfers. |
| Lost-coin treatment | The final rule for vulnerable, abandoned or unspendable outputs. |
| Interoperability | Wallet, exchange, custodian and explorer support, including deposit and withdrawal testing. |
| Security record | Independent audits, reproducible builds, disclosed vulnerabilities and a clear incident process. |
| Migration window | The exact start and end conditions, grace periods and what happens to remaining legacy outputs. |
What Bitcoin holders should do now
- Keep control of your keys. Maintain tested backups and document how heirs or a recovery partner would use them.
- Avoid address reuse. New receiving addresses reduce unnecessary public-key exposure and improve privacy.
- Track primary Bitcoin announcements. Look for activated consensus rules and compatible software, not speculative countdowns.
- Budget for ordinary fees. If migration is activated, move funds when fee conditions and the official migration window make sense; no fixed price is known today.
- Ignore urgency scams. No legitimate upgrade requires sending coins to a stranger’s “quantum recovery” address or sharing a seed phrase.
- Test recovery before moving substantial value. Confirm that the new wallet can restore from its backup and that the destination output is recognized by independent software.
Bottom line for the four common questions
You do not have a currently activated deadline to move Bitcoin to a quantum-safe wallet. A future migration would most likely use ordinary transactions, so fees would vary with transaction size and network congestion rather than follow a published flat charge. Coins with revealed public keys are the principal exposure discussed by BIP-361, but not every coin is already exposed in the same way. A lost seed remains lost unless final consensus rules create a specific recovery path, and no current product is established here as an adopted Bitcoin post-quantum wallet.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
