Here is the error: a draft BIP with no activation timeline, no post-quantum signature, and no consensus among the cryptographers who drafted it is being absorbed by the market as a quantum fix. It is not.
BIP-360 introduces Pay-to-Merkle-Root — P2MR — a new output type for Bitcoin. In operational terms, it lets a coin commit to a script tree while leaving no visible public key in the output at rest. I spent a week last month re-reading the proposal against the Coinbase workshop record from September 9, and one line kept demanding attention: 6.04 million BTC sit in static public key exposure. That is 30.2% of circulating supply. Non-zero. Non-hypothetical. And the proposal everyone is celebrating does not touch the majority of it.
In the silence of the block, the exploit screams. But first, the mechanics.
Context
To understand what P2MR does, you have to understand what Taproot optimized for. BIP-341 gave Bitcoin a key-path spend: a single Schnorr signature that, when valid, reveals an x-only public key and nothing else. Cheap, private, elegant. It also meant that the moment you spend, your key is written to the chain. For an active user, that is tolerable. For a cold wallet holding 40,000 BTC for six years with one annual test transaction, it is a permanent cryptographic advertisement.
BIP-360 inverts the priority. P2MR reuses the Merkleized Abstract Syntax Tree idea — the same MAST architecture Taproot already carries — but it removes the key-path spend entirely. Funds commit to a script tree. The output reveals a root hash, not a key. No key path, no signature exposed at rest.
The trade-off is immediate and unresolved. Pure script-path spends require revealing the script and its witness data. That is typically larger than one Schnorr signature. Transaction size rises. Fees rise. The workshop did not reach consensus on transaction size, hardware performance, key management, or the adoption path. Those are not footnotes. Those four variables determine whether an output type is ever used by anyone with real money.
And here is the line the market keeps skipping: P2MR adds no post-quantum signature algorithm. Not one. It is an exposure-reduction tool, not a quantum-safe upgrade. The proposal itself states that the short-term window — the interval when a key enters the mempool and waits for confirmation — may require a separate post-quantum signature proposal. That gap is not closed. It is deferred.
Core
Let me break the exposure cleanly, because the aggregate number hides the structure.
Of the 6.04 million BTC with static public key exposure, roughly 1.92 million — about 9.6% — is structural. These are legacy P2PK outputs that expose the key by design. No behavior change helps. They must migrate. Many belong to early-era whales or are presumed lost. Migration willingness at that cohort is the lowest in the ecosystem, because the keys that would authorize migration are frequently the keys that no longer exist.
The other 4.12 million, roughly 20.6%, is operational. Address reuse. Change outputs sitting adjacent to revealed keys. This is behavior, and behavior can change. Within it, 1.63 to 1.66 million BTC — 8.1% to 8.3% — is exchange-related. Custodial. Controllable in principle by an entity with a treasury desk and a cold wallet policy.
Run the arithmetic before accepting any headline about exchanges solving this. If every exchange migrates 100% of attributable balances, you have moved 1.66 million out of 6.04 million. Roughly 27%. The structural layer stays. The operational remainder stays. Dormant coins stay.
Tracing the gas leak where logic bled into code: the workshop documentation is careful, and the caution is load-bearing. Glassnode labels the exposure set an attribution subset of on-chain balances — explicitly not exhaustive, and explicitly not a security, solvency, or immediate-risk ranking. Coinbase's attributed balance shows 5% exposure. Several peers show materially higher. Custody scale alone does not determine exposure. That means the headline number is a floor with soft edges, not a ceiling, and any model built on it inherits the same error bars.
Then there is the detail I keep returning to. The workflow table rates custodial deployment evidence at one MPC simulation showing bounded feasibility. One. A single simulation. The remaining work is validating production controls, backups, and interoperability. Read that literally. The evidence level for moving institutional custody into a post-quantum regime is a laboratory sample. Post-quantum signature schemes are large and computationally heavy. Bolting them onto MPC key management — threshold signing across geographically distributed shares, under low-latency access requirements — is an engineering chasm, not a parameter change. Based on my own audit work stress-testing validation logic in high-latency environments, that is where the timeline actually lives. Not in the cryptography. In the boundary device and the firmware.
Separating the two time windows matters here. Long-term, or static, exposure is a key sitting visible on-chain for years. Short-term exposure is the minutes between mempool entry and confirmation. P2MR precisely targets the first. It pushes the second to a future proposal. So even after activation, the optimal attacker strategy simply rotates to mempool sniping. The attack window compresses from years to minutes. It does not close.
Contrarian
Here is where the consensus narrative fractures.
The strategic value of BIP-360 may exceed its technical value, and it may be engineered that way. A post-quantum signature mandate would trigger the kind of civil war Taproot nearly did. Instead, P2MR downgrades the question — should Bitcoin adopt post-quantum signatures? — into an optional output type. No signature algorithm war. Partial security gain, unilaterally collectible without touching the consensus surface.
Governance is just code with a social layer. And Bitcoin has no chief executive. A soft fork's real security depends on hashrate majority and node upgrade rates, which converts the optional destination into a coordination game among wallets, custodians, and exchanges. Excellent code can still stall in deployment, because nothing here is mandatory.
Now the blind spot. The exchange-related tag almost certainly does not capture spot ETF and trust custody. If those balances sit outside the label, the genuinely manageable custodial exposure is far larger than 1.66 million BTC. The source material does not discuss this at all. It is a hole in the topology, not a rounding error.
The second blind spot is wrapped and bridged BTC. Bridged coins lock into a small number of custody contracts, concentrating static exposure at single addresses — precisely the profile P2MR cannot help, because the holder is not a signer. Nobody is modeling this layer yet.
The third is the sleeping giant no fork reaches. Keys that cannot sign cannot be migrated to a safer output type by any soft fork. This is arithmetic, not strategy. There is no complete quantum solution for Bitcoin. There is only partial mitigation — and the industry keeps selling the first as the second.
Takeaway
Watch the chain, not the price. When migration starts, it will be observable before it is announced: large UTXO movements, a shift in output-type distribution, fee spikes as 1.6 million BTC of custody rotates. That rotation is a measurable miner revenue event, and it is the earliest honest signal of industry readiness.
Optics are fragile; state transitions are absolute.
The real question is not whether BIP-360 is quantum-safe — it is not — but whether a coordination game with no referee, no deadline, and a lab-grade evidence base can move 6.04 million BTC before Shor's algorithm stops being theoretical. My audit experience says the answer depends less on cryptography than on who absorbs the migration cost first, and who is willing to say publicly that a draft BIP is a beginning, not a defense.