A researcher broke a 15-bit elliptic curve key on a real quantum computer in April 2026, winning Project Eleven's Q-Day Prize and 1 BTC for the largest public demonstration of the attack class that protects every Bitcoin wallet. The key was tiny, 256-bit ECDSA is not remotely close to falling, but the direction is clear. Roughly 6.9 million BTC sit in addresses with exposed public keys, including Satoshi's estimated 1 million coins, and every advance in quantum hardware shrinks the gap between "theoretical threat" and "practical timeline." Bitcoin developers have been watching this trajectory for years. BIP-360, published on February 11, 2026, and merged into Bitcoin's official BIP repository, is their answer. It proposes a new output type called Pay-to-Merkle-Root (P2MR) that works almost exactly like Taproot (P2TR) but removes the one piece that quantum computers could eventually exploit. BTQ Technologies deployed the first working implementation on Bitcoin Quantum testnet v0.3.0 in March 2026. Why Taproot Has a Quantum Problem To understand what BIP-360 fixes, you need to understand what Taproot exposes. When Bitcoin activated the Taproot upgrade in November 2021, it introduced P2TR (Pay-to-Taproot) outputs with two spending paths. The first is the keypath spend, where a single public key sits directly on the blockchain and the owner proves they hold the matching private key. The second is the scriptpath spend, where spending conditions are hidden inside a Merkle tree of scripts, and only the branch being used gets revealed at spend time. The keypath is fast, cheap, and private for normal use. But it puts the public key on-chain in plaintext. Today that is perfectly safe because no computer can reverse ECDSA from public key to private key. A sufficiently powerful quantum computer running Shor's algorithm could do exactly that. Google's April 2026 whitepaper estimated a full 256-bit