BIP-361 ( in one sentence: it tackles the incentive problem of the Post-Quantum migration, how you actually get holders to move, without trying to settle the technical parameters of it (which signature scheme, which output type). Those are deferred to other BIPs. It defines three phases: - Phase A (~3 years after activation): new outputs to ECDSA/Schnorr addresses are forbidden. You can still spend from legacy, but only into post-quantum scripts. The vulnerable surface stops growing. - Phase B (2 years after Phase A): a flag-day that makes ECDSA/Schnorr spends invalid altogether. Unmigrated UTXOs are effectively frozen. - Phase C (TBD): a recovery path for legitimate owners of those frozen funds. The A → B logic is clean: cap the exposure, then sunset it. Phase C is where it gets interesting. In a post-quantum world, "knowing the private key" is no longer proof of ownership, a CRQC can derive it from the public key just as well as the legitimate owner. Recovery therefore needs a secret quantum computers cannot reach. The elegant idea hinted at in the BIP is a zero-knowledge proof of BIP-39 seed phrase ownership. The BIP-39 → BIP-32 derivation is a one-way hash chain, quantum-secure: a CRQC can invert ECDSA, but it cannot invert the seed derivation. The owner proves "I know the seed behind this UTXO" without revealing it; the chain verifies the proof and releases the funds. This ZK would have to be Quantum resistant to avoid arbirary proof forgery (STARK is our friend). This is doubly attractive: it solves recovery, and it forces Bitcoin to natively verify ZK proofs, unlocking a much broader design space (validity-rollup settlement, succinct proofs, privacy upgrades). There's a catch, though, that the BIP itself acknowledges. BIP-39 was only introduced in 2013, and BIP-32 in late 2012. UTXOs created before then, including most P2PK coins, whose public keys are already exposed on-chain, were generated from raw, individually managed private keys. There is no seed phrase to prove. For these coins, ZK recovery is structurally impossible, and the BIP-361 authors explicitly fall back on an Hourglass-style mechanism (rate-limited spending) to handle them. So BIP-361 is, in my view, the right scaffolding. But Phase C is where the real political and ethical questions of the migration actually live, and ZK-of-seed only solves the easier half.