P2MR: How the First Quantum-Resistant Bitcoin Address Works Technically

• P2MR eliminates the spending by Taproot key, the method that exposes the public key in each transaction.
• The new type of address uses the prefix bc1z and requires manual migration of funds.

The discussion about the potential quantum threat has already yielded a concrete result in the Bitcoin ecosystem: the improvement proposal BIP-360, still under review, which defines an address format called Payment to Merkle Root (P2MR). Its post-quantum goal is to close a gap in the current Bitcoin address formats regarding the visibility of the public key.

Today, Taproot is the only Bitcoin update that allows the construction of scripts trees, which are structures that organize different spending conditions for the same address, so that when spending the funds, it suffices to reveal the condition actually used and not the rest. This allows for the creation of more complex and customized spending conditions.

However, Taproot is also the only active format that, by using that scripts tree mechanism, reveals on-chain the public key of that address from the moment the funds are created. This exposure is the quantum attack vector: sufficiently powerful hardware could derive the private key from the exposed public key and take ownership of the funds.

Moreover, simpler and earlier formats, such as P2WPKH (payment to public key hash by witness) or P2SH (payment to script hash), already avoid that exposure while the funds are not spent, but do not offer the flexibility of a Taproot scripts tree.

Thus, P2MR seeks to combine both properties: keeping the public key hidden until the funds are spent while maintaining the flexibility offered by scripts trees, something that no native Bitcoin output format has allowed until now.

The Technical Construction of P2MR {#h-the-technical-construction-of-p2mr}

BIP-360 was based on the Taproot and Tapscript (BIP-342) code, the language used by Bitcoin to define spending conditions within Taproot scripts, but removed one of the two ways to spend the funds: the public key route. Therefore, P2MR can be understood as Taproot without spending by key.

The operation of P2MR is based on a structure known as a Merkle tree. Each script is first transformed into a 32-byte cryptographic value through a process called TapLeaf. Then, those values are combined in pairs using the TapBranch function, which unifies the hashes of the tree until a single result is obtained: the Merkle root. This root is the cryptographic commitment that identifies the set of spending conditions of the P2MR address: it suffices to know it to verify that a certain script was indeed part of the original tree, without needing to know the rest of the scripts that make it up.

P2MR thus retains the possibility of gathering different spending conditions in a scripts tree, but without compromising a public key in the address: it relies solely on the Merkle root. When the time comes to spend the funds, the user reveals only the script that contains the condition they are using (for example, a rule that allows an heir to recover the funds after a certain period) along with the TapBranch hash path that demonstrates that this script was part of the tree defined when the funds were created. The rest of the conditions remains hidden.

The absence of the public key modifies the structure that Bitcoin uses to identify funds. A P2MR output is formed by OP_2 followed by the 32-byte Merkle root, and its addresses use the bc1z prefix, according to the BIP-360 technical document. Unlike Taproot, P2MR does not combine that root with any internal key, and thus eliminates the spending path that could expose it and leave it vulnerable to a sufficiently powerful future quantum computer.
BIP-360 proposes a new address format in Bitcoin. Source: Github.

How is a P2MR output spent? {#h-how-is-a-p2mr-output-spent}

To unlock a P2MR output, the spender must complete the witness, the part of the transaction that, since the SegWit update, contains the necessary proofs to authorize the spending without adding weight to the main part of the transaction.

In P2MR, that witness consists of three parts:

• The stack elements needed by the script (the data, such as a signature, that are stacked and used as the script executes).

• The corresponding leaf script (TapLeaf, the specific leaf of the tree that is actually used for spending).

• A control block formed by a control byte and the Merkle authentication path to that leaf, the proof that this leaf belongs to the original tree.

The difference with Taproot is specific but central: the control block of P2MR does not include any internal public key, simply because that key does not exist in this type of output. This absence is directly reflected in the weight of the witness, and that weight is precisely what determines how much fee each spending pays: the fewer bytes it occupies, the lower the cost. A P2MR witness from a single-leaf tree weighs 103 bytes, according to the BIP-360 document:

• Compared to a key spending in Taproot (66 bytes), P2MR is 56% heavier.

• Compared to the average weight of a Bitcoin transaction signature from the ECDSA scheme, around 72 bytes, according to mainnet.observer, the P2MR witness is 43% heavier, although the comparison is not strictly equivalent, as the ECDSA data corresponds only to the signature, while the weight of P2MR also includes the script and the control block.

• Compared to a spending by script in Taproot with the same structure (135 bytes, the sum of the 103 bytes of P2MR plus the 32 bytes occupied by the internal key in the control block), on the other hand, P2MR weighs 24% less, because it does not need to include that key.

Average weight of ECDSA signatures in Bitcoin. Source: mainnet.observer.

Developer Anthony Towns calculated, in a discussion about P2MR on the Bitcoin developers' mailing list, that adding a post-quantum signature to an output of this type currently represents an additional cost of about 14% compared to a key spending in Taproot, but that number drops to 7% with schemes like SHRINCS and to just 1% with Winternitz-type schemes.

Additionally, P2MR is still signed today with the Schnorr scheme (BIP-340), not with ECDSA, and being a native Tapscript structure, it is compatible with Lightning Network (LN), BitVM, Ark, multi-signature setups, and time locks, and is designed so that in the future, any of the leaves of its tree can incorporate a post-quantum signature without needing to change the output type, as described by the specialized site Post Quantum.

What P2MR Does Not Resolve and the Technical Debate {#h-what-p2mr-does-not-resolve-and-the-technical-debate}

The BIP-360 document precisely delineates what P2MR resolves and what it does not:

• It protects against so-called prolonged exposure attacks, when a public key is exposed on the chain for an indefinite time, but not against short exposure attacks, which occur while a transaction is still unconfirmed and briefly remains in the mempool waiting for a quantum computer to attempt to break it before it is confirmed.

• It also does not introduce any post-quantum signature: it relies on the user not reusing addresses, because reusing the same address exposes the public key prematurely and reopens the same risk that P2MR seeks to avoid.

Finally, at the close of this article, BIP-360 is still in draft status within the official repository, where it was merged in February 2026. This status means that the proposal is not activated on the Bitcoin mainnet and that, so far, there is no scheduled activation timeline to incorporate it.

Did you find this content useful and relevant?YesNo
Send

This note helped you to *Understand what happenedAnalyze the contextMake an informed decisionEntertain yourselfUpdate youDid not help you
Send

What content are you looking for today on CriptoNoticias? *Quick newsReportsMarket analysisInterviewsOpinion articlesEducational material
Send

How valuable do you consider this note?012345
Send

Would you recommend this article to a friend or colleague?YesNo
Send

In what format would you like to complement this information? *Short videoAudio or podcastInfographicText is enough
Send

What action will you take after reading this note? *I will look for more on the topicI will adjust my investmentsI will continue reading other newsNothing in particularI will take new security measures
Send

How easy was it for you to understand this text? *I understood everything at firstI got it, but with some complex termsI had to look up what some words and ideas meantI got lost, it’s too complicated
Send

Would you like to see more content like this?YesNo
Send
Tags: Bitcoin (BTC)Quantum ComputingCryptocurrenciesLatest

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.