Post-quantum Bitcoin: why migration means more than changing signatures

Preparing Bitcoin for a possible quantum threat involves more than selecting a new algorithm. Users must be able to receive, safeguard and move funds with compatible software while preserving independent verification of the network. This analysis examines three distinct levels: cryptographic standards, proposed Bitcoin changes and needs expressed by a major custodian. None of these documents, on its own, constitutes a network decision.

Standards available for different uses

On 13 August 2024, NIST finalised its first three post-quantum standards. FIPS 203 concerns a mechanism for establishing a shared secret, whereas FIPS 204 and FIPS 205 define digital signatures. This difference is essential for blockchains: authorising a spend and establishing confidential communication are different operations. Using the word 'encryption' indiscriminately sometimes obscures the role of signatures in controlling a wallet.

A post-quantum signature must allow verification that a message was authorised even against the quantum capabilities targeted by its design. Standardisation nevertheless does not remove integration constraints. Signature size, verification speed and key management influence system costs. In Bitcoin, where each node must be able to check the rules, these properties have collective consequences. Any cryptographic choice must therefore be assessed within the execution environment in which it would actually be used.

Preparing a format without claiming to solve everything

BIP 360, entitled Pay-to-Merkle-Root, illustrates a gradual approach. Still presented as a draft in the document consulted, it proposes a new output type based on a script tree, without the key-spend path used in Taproot. Its authors seek, in particular, to limit prolonged exposure of public keys. This proposal means neither that it has been activated nor that every spend would automatically resist every quantum attack.

The text distinguishes long exposure, where an adversary has public data for an extended period, from short exposure while a transaction circulates before confirmation. These scenarios do not require the same attack speed. The authors specify that full protection against the latter may require post-quantum signatures. For users, this distinction avoids confusing a format preparing for future developments with a complete replacement of existing protections.

Migrating users and infrastructure

In a contribution published on 13 October 2026, Coinbase sets out its needs as a custodian. The company wants adaptable mechanisms, resource-controlled verification and compatibility with ordinary wallets as well as institutional custody. It also highlights the difficulty of handling funds that might not migrate in time. These are priorities expressed by a participant in the debate rather than instructions imposed on developers or holders.

For Nexorena, the operational work is as decisive as the mathematical choice. Software will need to recognise new formats; services will need to prepare procedures; users will need to understand the requested operations. Handling inaccessible funds raises governance questions that a technical standard does not answer. Work can progress without claiming to settle every question immediately. Preparing several verifiable stages therefore appears more concrete than announcing a single date when Bitcoin would suddenly become 'quantum' or 'protected'. Cryptographic standards, protocol proposals and the practical migration of existing holdings must remain distinct parts of that preparation.