Will Bitcoin Freeze Old Coins? BIP-361 Quantum Sunset Explained (2026)

You may have seen an alarming headline: "Bitcoin developers want to freeze old coins." It refers to BIP-361, a draft proposal that would, years after being switched on, stop coins in today's address types from being spent the normal way. So, will Bitcoin freeze old coins? Here is BIP-361 explained in plain language: what it says, who supports and opposes it, and what a beginner in Europe should actually do in 2026.

Short answer: nothing is frozen, nothing is scheduled, and BIP-361 cannot start until a separate post-quantum signature upgrade exists.

Why quantum computers lead to a "freeze" debate

Bitcoin signatures use elliptic curve cryptography (ECDSA and Schnorr). A large, error-corrected quantum computer running Shor's algorithm could, in theory, work out a private key from a public key. Our earlier guide Will quantum computers break Bitcoin? explains which coins have visible public keys and why no public machine is close to that scale today.

The hard question is what happens to coins that never move to safer addresses, for example because their keys are lost. A quantum attacker could take and sell millions of these "sleeping" coins. Jameson Lopp, one of the BIP-361 authors, estimates that at least 2.6 million BTC would stay vulnerable even if every active user upgraded, and notes that about 1.7 million BTC sit in early pay-to-public-key (P2PK) outputs. BIP-361 is one answer to that problem.

BIP-361 explained: what the proposal actually says

BIP-361 is titled "Post Quantum Migration and Legacy Signature Sunset." The key facts from the official text:

  • Status: Draft, assigned on 11 February 2026 and merged into the official Bitcoin BIPs repository on 14 April 2026. "Merged" means published for discussion, not accepted by the network.
  • Authors: Jameson Lopp and five co-authors.
  • Dependency: it requires a post-quantum signature BIP still marked "TBD". Without a quantum-safe address type, there is nothing to migrate to.
  • Mechanism: a series of soft forks, in two phases (below).

It is also not the same as BIP-360. BIP-360 (Pay-to-Merkle-Root) proposes a new, safer output type. BIP-361 is about the deadline: what happens to old outputs once safer ones exist.

The two phases: from "can't receive" to "frozen"

Here is the specification in simplified form:

StageWhen (per the draft)What changesCoins in today's address types
TodayNow (October 2026)Nothing. BIP-361 is a draft and not activated.Send and receive as normal
Phase A160,000 blocks (about 3 years) after activationNew payments may only go to post-quantum (PQ) address typesYou can still spend them, but only to a PQ address. A non-upgraded wallet can no longer receive.
Phase B2 years after Phase A (a "flag day" about 5 years after activation)ECDSA/Schnorr spends must also pass a quantum-safe "rescue protocol"A normal signature is no longer enough. Coins that cannot use a rescue route stay where they are, unspendable.

The draft covers every output spent with ECDSA or Schnorr today, including addresses starting with 1, 3, bc1q and bc1p. So even coins in "safe" hashed addresses would need to move in time.

Can frozen coins be rescued?

BIP-361 tries to separate the real owner from a quantum attacker through a "knowledge asymmetry": something the owner knows that cannot be derived from the public key. The draft's example is BIP-32: most wallets built since 2012 derive keys from a seed, and one using a hardened derivation step could prove knowledge of a parent key that an attacker would be very unlikely to know. Researchers are studying zero-knowledge proofs (ZK-STARKs) for this.

Three limits, from the authors themselves:

  • The draft says it "remains to be seen" how much of the supply rescue protocols could cover.
  • No rescue is known for P2PK coins, the format of many early mining rewards. The authors point to a separate "Hourglass" proposal, which Lopp describes as allowing one P2PK input and a net 1 BTC per block.
  • Lopp notes that one proof-of-concept recovery proof is around 200 KB, so rescuing small amounts could be expensive in fees.

If a rescue ever depends on proving knowledge of your seed, you need to still have that seed. Our Bitcoin wallet backup worksheet helps you check yours without exposing it.

The case for and against freezing

Supporters argue that "frozen is better than stolen". A quantum attacker is not the rightful owner, and a sweep of millions of dormant coins could hurt every holder. A public deadline also pushes exchanges, custodians and wallet makers to act.

Critics say freezing breaks Bitcoin's core promise that a valid coin stays spendable by its key holder. Lopp's own essay lists the objections: it cannot tell lost coins from those of patient savers or heirs, it sets a precedent, it could split the network, it may create legal risk, and the threat may arrive later than feared or never.

Even Lopp calls BIP-361 a contingency plan. In September 2026 he wrote that it cannot be activated until a post-quantum scheme is active, and that he does not expect anyone to seriously push for activation unless a cryptographically relevant quantum computer looks likely to be less than 10 years away.

Will Bitcoin freeze old coins? What it means for beginners in Europe

Realistically, no freeze can happen soon. Any deadline would need a finished post-quantum address type, wide review, broad agreement, activation, and then about three years before Phase A even starts. Meanwhile, sensible steps are good habits anyway:

  • Know who holds your keys. If your coins sit on an exchange, the exchange controls the keys, so any future migration would be its job. Trust announcements in your account, not social media DMs.
  • If you self-custody, keep your wallet updatable. Use a wallet or hardware device that is actively maintained. Our guide on how to move Bitcoin from an exchange to a hardware wallet covers choosing and verifying one.
  • Avoid address reuse and limit xpub sharing. Lopp lists both among the preparation steps for now.
  • Treat "quantum migration" messages as a scam alert. No real upgrade will ever need your seed phrase typed into a website or sent to support.
  • Do not move coins in a panic. There is no post-quantum Bitcoin address to move to yet.

FAQ

Is BIP-361 active or approved?
No. It is a draft published for discussion, with no activation date, and it depends on a post-quantum signature proposal that does not exist yet.

Will my coins on an exchange be frozen?
Not under any current rule. If a migration ever happens, the exchange holds the keys and would move customer coins itself; the draft argues exchanges have strong reasons to migrate early.

Are Satoshi's coins affected?
Early P2PK coins, including many attributed to Satoshi, are the most exposed. BIP-361 offers no rescue route for them and points to a separate "Hourglass" style proposal instead.

Important disclaimer

This article is general information about a technical proposal, not financial, investment or legal advice. BIP-361 is a draft and may change or be abandoned, and timelines for quantum computers are uncertain. Do your own research, and never share your seed phrase or private keys with anyone, including anyone offering to "quantum-proof" your wallet.

Bottom line

BIP-361 is a draft contingency plan that would, about five years after an activation that has not happened, make old-style signatures insufficient to move coins, with rescue routes for some wallets and none yet for early P2PK coins. It depends on a post-quantum upgrade that does not exist yet. For a beginner in Europe, the right response is calm preparation: a tested backup, a maintained wallet, no address reuse, and zero trust in anyone selling quantum fear. For the wider picture, see our guide to post-quantum cryptography in Europe.

Sources

Advice Me publishes general information only. We are not financial advisers. Always do your own research and check the latest rules in your country before buying, selling or storing crypto.

Comments

Post a Comment