What happened
On 13 August 2026, Bitcoin Core merged pull request #35951, which adds a single paragraph to the notes for the next release. The note says that "Support for the legacy ElGamal (type 0) encryption type when creating I2P sessions is being sunset by the I2P network and will be removed from bitcoind on or before v34", and that nodes on I2P running Bitcoin Core older than v26.1 "will soon only be able to connect to other legacy ElGamal I2P peers and will be increasingly isolated from the rest of the network, with a reduced anonymity set."
What it changes
I2P is one of the networks a Bitcoin
node can be reachable over instead of the plain internet. A node
that uses it publishes a lease set: the record other routers read to work out how to reach
it. That record is encrypted, and both ends have to agree on the scheme. When Bitcoin Core
opens a session with the local I2P router it passes a preference list, i2cp.leaseSetEncType,
which in master today reads
4,0: prefer ECIES-X25519,
accept ElGamal, an early
public-key scheme dating from the 1980s.
Why the second entry is there was stated plainly when it was added, in #29200 in January 2024: "A Bitcoin Core node may only connect to a peer destination via I2P if both sides have sessions with the same encryption type." That makes the list a compatibility surface rather than a security setting: each entry kept is a population of peers still reachable, and each entry dropped is a population that is not.
The follow-up, #35696, proposes changing the
list to 6,4: ML-KEM-768 first, ECIES-X25519 second, ElGamal absent. An I2P maintainer notes
in that thread that "Java I2P and i2pd have supported type 6 since API 0.9.67 (Java I2P
2.10.0, i2pd 2.58.0, 2025-09)". The release note is the part that shipped first, deliberately:
the removal is announced well before the fallback actually goes.
What it does not change
None of this touches the cryptography protecting coins. A lease set is how a node is found, not how a signature is made. Adding a post-quantum key exchange to an I2P record does nothing for the keys that authorise a spend, and it is worth saying because "post-quantum" is the phrase this story will be filed under.
The code change is also not merged. Master still asks for 4,0. What landed on 13 August is
the sentence telling operators what is coming, which is the entire content of the news.
And the population affected is small. I2P is an option a node operator has to choose, and most do not. If you have never configured it, nothing here reaches you.
Context
The specific scheme is not the interesting part. The shape of the problem is: retiring a cryptographic primitive on a live network only works if the fallback outlives the transition, and the migration budget is exactly the gap between the date the new type became usable (September 2025, per the maintainer above) and the date the old one is removed (v34 or earlier). Announce it too late and the note strands people. Keep the fallback too long and everyone who kept it is still reachable at the weaker setting. Crypto-agility is the name for treating that gap as something to be planned rather than discovered. Bitcoin Core's version of it here is a release note and a deadline stated in versions, not dates.