What happened
On 8 June 2024, Hunter Beast posted a draft to the Bitcoin development mailing list titled "Proposing a P2QRH BIP towards a quantum resistant soft fork". P2QRH stands for pay to quantum resistant hash. It is described as "the first in a series of BIPs regarding a hypothetical 'QuBit' soft fork", and the author is candid that it is "a rough draft and not the finished BIP".
The case for starting now is procedural rather than urgent: "Bitcoin development and activation is slow, so it's important that those with low time preference start discussing this as a serious possibility sooner rather than later."
What it changes
Nothing yet. What it identifies is a specific regression, and that part is worth following even if the draft goes nowhere.
A quantum computer running Shor's algorithm would derive a private key from a public key. So the question for any output is simple: is the public key visible before the coin moves?
For a pay to witness public key hash output, it is not. The chain holds a 20 byte hash. The key appears only in the witness of the spending transaction, and by then the coin has moved. The exposure lasts as long as the transaction is unconfirmed, and it closes on its own.
Taproot is different, and this is the point of the draft. BIP 341 defines a Taproot output as a 32 byte value that is not a hash: it is the output key itself, a point on the curve, formed by tweaking an internal key with the Merkle root of the script tree. A Taproot output published its public key the moment it was funded, and that key sits in the open for as long as the coin sits unspent. Anything protecting it is an assumption about how hard the discrete logarithm problem is, held over an unbounded period rather than a few minutes.
The proposal's response is to define an output that keeps the script tree but has no key path spend at all, so the thing committed on chain is a hash again.
What it does not change
It does not protect coins already sitting in exposed outputs. Very early coins were paid directly to public keys, with no hash anywhere, and reusing any address publishes its key on the first spend. Those are unaffected by a new output type, and the draft does not propose moving anyone's coins.
It does not defend the unconfirmed window either. Whatever the output type, spending reveals what is needed to verify it, and a fast enough attacker could act before confirmation.
Above all it does not make Bitcoin post-quantum. Removing an exposed key narrows the target; it does not replace the signature scheme. The author's own framing is that at some point "we will need to pick a signature algorithm, implement it, and have it ready", and that choice is not made here.
This is a mailing list post. There is no BIP number, no implementation, no activation mechanism and no consensus for one.
Context
Taproot activated in November 2021, and the exposure described here is a known consequence of how it works, accepted for benefits that had nothing to do with quantum computers: smaller cooperative spends, and spending arrangements that do not announce their shape.
The cryptography to replace what is at risk is not settled either. NIST published draft post-quantum signature standards in August 2023 and has not yet finalised them, which is part of why a proposal written now can name the problem more confidently than the fix.