Chain profile
Two post-quantum BIPs reached Draft status in February 2026, but neither introduces a post-quantum signature, no activation path is agreed, and roughly a third of supply sits in addresses with exposed public keys.
No, and Bitcoin has the hardest position of any chain in this index. Bitcoin signs with ECDSA and Schnorr on the secp256k1 curve, both broken by Shor's algorithm. Two proposals reached Draft status in the BIPs repository on 11 February 2026: BIP-360, which defines Pay-to-Merkle-Root, a Taproot-like output type with the quantum-vulnerable key path removed, and BIP-361, which proposes sunsetting legacy signatures in two phases. Neither is activated, and BIP-360 explicitly states that it does not introduce post-quantum signature schemes. It removes exposed keys from new outputs rather than replacing the signature algorithm. The deeper problem is not cryptographic but political and historical: independent estimates put between 4 million and 7 million BTC in addresses whose public keys are already visible on-chain, and BIP-361's remedy for those coins is to stop them being spendable with classical signatures, which is a proposal to freeze other people's money and is contested accordingly.
Where we are making a judgement call Bitcoin's low Hardy Score reflects quantum readiness alone and should not be read as a statement about Bitcoin's security in any other respect, its monetary properties or its value. Bitcoin's conservatism is a deliberate design choice that has served it well elsewhere; on this specific measure it is the thing holding it back.
ECDSA and Schnorr on secp256k1
None selected. BIP-360 removes the quantum-vulnerable key path from new outputs without specifying a post-quantum signature scheme.
None adopted. ML-DSA and SLH-DSA are referenced in BIP-360 as examples only.
Tier 4: Debating. The threat is acknowledged and proposals exist, but there is no consensus and no published timeline.
| No. | Dimension | Score | Weight | Contribution |
|---|---|---|---|---|
| 1 | Signature scheme | 0 | 30% | 0.0 |
| 2 | Deployment stage | 2 | 25% | 5.0 |
| 3 | NIST alignment | 3 | 15% | 4.5 |
| 4 | Migration path | 2 | 15% | 3.0 |
| 5 | Exposure | 1 | 10% | 1.0 |
| 6 | Verification | 7 | 5% | 3.5 |
| Hardy Score | 17.0 | |||
Bitcoin mainnet uses ECDSA and Schnorr on secp256k1, both broken by Shor's algorithm. BIP-360 is a Draft and states it does not introduce post-quantum signature schemes; it mentions ML-DSA and SLH-DSA only as examples worth scrutinising. source
Tier 4: Debating. The threat is acknowledged and two proposals are formally documented, but both are Draft, neither is activated, and there is no consensus on an activation path or a timeline. source
No post-quantum scheme has been selected. BIP-360 references ML-DSA and SLH-DSA only as examples of quantum-resistant algorithms worth scrutinising, explicitly declining to propose them for integration. source
The hardest migration problem in the index. Bitcoin has no mechanism to move coins whose keys are already exposed without their owners acting, and BIP-361's answer is to make legacy signatures unspendable at a fixed block height: Phase A at roughly three years after activation, Phase B two years after that. Coins whose owners never migrate are lost by design. Activation itself requires soft-fork consensus that does not currently exist. source
The largest measured exposure in the index. Deloitte found roughly 4 million BTC in original P2PK addresses and reused P2PKH addresses with revealed keys, about a quarter of supply. Galaxy Digital estimated roughly 7 million BTC in exposed addresses in March 2026 and Glassnode put it at 6.04 million, or 30.2% of supply. source
Bitcoin's process is maximally open: the proposals are public documents in a public repository, subject to years of adversarial review, and a functional testnet implementation exists in BTQ Technologies' Bitcoin Quantum testnet v0.3.0 from March 2026. Openness is not the same as progress, but it is real verification. source
The deployment dimension is not a separate judgement. It is Tier 4 expressed as a number. See the tier mapping.
BIP-360 circulates as Pay-to-Quantum-Resistant-Hash (P2QRH), version 0.1. source
BIP-360 is merged into the Bitcoin BIPs repository with status Draft, renamed Pay-to-Merkle-Root (P2MR). Merging signals documentation quality, not endorsement or imminent activation. source
BIP-361, Post Quantum Migration and Legacy Signature Sunset, is documented with status Draft. source
BTQ Technologies releases Bitcoin Quantum testnet v0.3.0, the first functional validation of the P2MR design. source
BIP-361 Phase A would disallow sending funds to quantum-vulnerable addresses 160,000 blocks (about three years) after activation, with Phase B restricting ECDSA and Schnorr spends two years after that. Neither BIP has an agreed activation path. source
Exposure measures how much of the chain's value already sits behind a public key that an attacker can record today and break later. This is the part of the threat that a future upgrade cannot undo.
Bitcoin's exposure is the largest and best-measured in this index, and it is irreversible for the coins concerned. Public keys are revealed on-chain in two ways: original pay-to-public-key outputs from the earliest years publish the key directly, and address reuse publishes it as soon as an address spends and then receives again. Deloitte's analysis of the full chain found roughly 2 million BTC in P2PK addresses and 2.5 million in reused P2PKH addresses, about 25% of supply. Galaxy Digital put the figure at roughly 7 million BTC worth about $470 billion in March 2026, and Glassnode at 6.04 million, or 30.2% of supply. Estimates differ because they draw the line between exposed and unexposed differently, but all of them describe a share of supply measured in millions of coins that cannot be un-exposed.
What this rating means for you
Bitcoin has two draft proposals and no agreed post-quantum signature, and it carries the largest measured exposure in this index. Neither of those changes anything you need to do today.
Editorial guidance from the Hardy Index. Nothing on this profile is sponsored and nothing on it is an affiliate link. The guides carry disclosed affiliate links, which never affect a rating. How we make money.
No. Bitcoin uses ECDSA and Schnorr signatures on the secp256k1 curve, both of which are broken by Shor's algorithm on a sufficiently large quantum computer. No post-quantum signature scheme has been selected for Bitcoin, and the two relevant proposals, BIP-360 and BIP-361, are both Draft and unactivated.
BIP-360 defines Pay-to-Merkle-Root, a script tree output type similar to Pay-to-Taproot but with the quantum-vulnerable key path spend removed, so no public key appears on-chain when the output is created. It does not introduce a post-quantum signature scheme. The specification states this explicitly and mentions ML-DSA and SLH-DSA only as examples worth scrutinising.
Estimates range from about 4 million to about 7 million BTC. Deloitte found roughly 4 million BTC, around 25% of supply, across original P2PK addresses and reused P2PKH addresses. Galaxy Digital estimated roughly 7 million BTC worth about $470 billion in March 2026, and Glassnode put it at 6.04 million, or 30.2% of supply. The estimates differ on where to draw the line, not on the order of magnitude.
BIP-361 proposes sunsetting legacy signatures in two phases: Phase A would disallow sending funds to quantum-vulnerable addresses roughly three years after activation, and Phase B would restrict ECDSA and Schnorr spends two years later. It is controversial because coins whose owners never migrate, including lost coins and early P2PK holdings, would become unspendable. The choice it forces is between coins being frozen and coins being stolen.
Not on its own. Merging a BIP into the repository means the proposal meets the documentation standard for formal discussion. It is not an endorsement, not an activation, and not a commitment to a timeline. BIP-360's status field still reads Draft.
This is a security-readiness assessment, not investment advice.