Coinbase Urges Bitcoin to Prepare for Quantum Threats

Coinbase calls for early Bitcoin preparations against quantum computing

Coinbase has published a technical paper urging Bitcoin developers and ecosystem participants to begin planning now for the risk posed by future quantum computers. While the company does not claim that today’s quantum machines can break Bitcoin’s cryptography, it warns that the upgrade path to quantum-resistant signatures could take years and requires careful coordination across wallets, exchanges, miners and node operators.

The recommendations are significant: Coinbase says it holds roughly 5% of circulating Bitcoin in custody and has already started adapting its systems. The company laid out design principles, concrete proposals such as BIP-360 and P2TRv2, and migration strategies like hybrid wallets that allow coexistence of legacy and post-quantum authentication. The goal is to protect current users and institutional holdings while enabling a secure, gradual transition to quantum-resistant cryptography.

Why Bitcoin needs a post-quantum plan

Bitcoin’s transaction security today depends on elliptic-curve cryptography—ECDSA and Schnorr signatures. These schemes are efficient and compact, but a sufficiently powerful quantum computer could in theory derive private keys from exposed public keys. That would let an attacker forge signatures and spend funds from vulnerable addresses.

Coinbase’s paper stresses that this is a forward-looking risk rather than an immediate breach: no practical quantum attacker is known to exist today. Still, the company argues that migration planning must start well before such a machine appears because consensus changes, wallet upgrades and institutional migrations can require years of testing, deployment and coordination.

Key technical recommendations from Coinbase

Coinbase outlines several technical priorities to make a safe, manageable migration possible:

• Adopt flexible transaction formats that can accommodate future signature algorithms without repeated protocol redesigns.
• Favor designs that minimize public-key exposure in common spending flows.
• Provide wallet vendors and custodians clear guidance for managing signing state and recovery for stateful algorithms.
• Test candidate post-quantum signature schemes for signature size, verification speed, fee impact and hardware compatibility.
• Separate technical upgrades from political questions about dormant or inaccessible coins to prevent disputes from delaying security work.

BIP-360 and P2TRv2: flexible transaction outputs

Coinbase highlights BIP-360 and P2TRv2 as promising approaches. BIP-360 proposes a Pay-to-Merkle-Root (P2MR) output derived from Taproot that removes key-path spending—which currently reveals a public key—and adds a Merkle-root-based structure to hide most spending conditions until they are used. P2TRv2 similarly seeks to create extensible output formats that can accept different signature schemes in the future.

These designs don’t themselves introduce a specific post-quantum signature, but they aim to make the protocol more adaptable so new algorithms can be added or swapped without repeated structural changes to Bitcoin’s transaction model. Coinbase emphasizes the importance of defining clear verification rules and signature identifiers so nodes can validate mixed-format transactions reliably.

Which post-quantum algorithms could work?

Coinbase recommends evaluating multiple candidate signature families once standards mature. Options it mentions include ML-DSA, SLH-DSA and FN-DSA, along with compact hash-based proposals such as SHRINCS. The company advises rigorous benchmarking for signature size, signing and verification speed, memory and hardware constraints, and how each candidate affects transaction fees and block-space usage during a broad migration.

Large signatures, or slower verification, could materially increase transaction costs and strain full nodes during a mass migration. Coinbase therefore calls for reproducible testing under realistic network conditions, including propagation, mempool behavior and block validation times.

Hybrid wallets: an incremental migration path

To help users adopt quantum-resistant security without a hard, all-at-once switch, Coinbase proposes hybrid wallets that support two spending paths. One path would use today’s ECDSA or Schnorr signatures for backward compatibility; the other would use a post-quantum signature keyed separately. A 1-of-2 construction, for example, could let a user spend with either the legacy signature or the new post-quantum key.

This approach allows gradual adoption: early adopters can move funds to post-quantum-only outputs, while the broader user base transitions over time. Hybrid wallets also reduce the need for a single protocol decision to be made before any migration begins, enabling practical protection for active funds while the community continues to evaluate final standards.

Reducing public-key exposure

Another practical recommendation is to reduce unnecessary public-key exposure in normal transactions. Designs that hide keys until they are spent—like P2MR—limit an attacker’s window to harvest public keys from the blockchain and later use a quantum computer to derive corresponding private keys.

Institutional custody and MPC concerns

For custodians and exchanges, Coinbase emphasizes compatibility with multiparty computation (MPC) systems used for keyless signing across distributed infrastructure. Many proposed post-quantum algorithms are stateful (they require tracking signing state across operations), which complicates deployment across many servers, data centers and recovery scenarios.

Coinbase warns that stateful signature systems create operational risk if signing state is lost, duplicated or restored incorrectly—potentially enabling signature forgeries. The company therefore recommends keeping a stateless signing option available and providing clear recovery procedures and deterministic state-management instructions for wallet implementers.

Handling dormant coins, lost keys and early Bitcoin holdings

One thorny policy area Coinbase highlights is how to treat Bitcoin locked in addresses that may never migrate: dormant holdings, coins with lost private keys, or early addresses with exposed public keys. Some of these funds belong to living users who could still regain access; others are likely irretrievable.

Coinbase suggests separating technical migration choices from the political and governance debates over how to treat inaccessible coins. For instance, BIP-361 (Post Quantum Migration and Legacy Signature Sunset) proposes a staged migration that would gradually restrict older signature types and consider recovery mechanisms, but it remains a draft and not activated. Coinbase argues that discussion of recovery rules should not block technical work on protecting active wallets.

The paper explores potential recovery mechanisms involving wallet seeds, cryptographic proofs and transaction commitments, but cautions that any process must not open new attack vectors for parties who only have a public key.

Testing, testnets and early implementations

Coinbase points to previous experimental work as instructive: BIP-360 testing on specialized testnets has demonstrated experimental P2MR transactions. BTQ Technologies ran tests showing address creation, funding, signing and confirmation on a quantum-focused test network, though such implementations did not represent activation on mainnet.

The company calls for broad, reproducible testing of candidate signature schemes and transaction formats across diverse conditions: hardware wallets, HSMs, MPC setups, node implementations, fee market scenarios and large-scale migrations. Measuring block propagation, mempool behavior and CPU/memory impacts will be crucial to selecting realistic options that do not unduly harm network performance or increase user costs.

Timeline, coordination and governance

Coinbase’s paper is explicit that it does not set a migration deadline, pick a final algorithm, or propose an activation date. Instead, the firm frames its recommendations as contributions to an ongoing, community-driven decision process. The company encourages early planning because consensus-layer changes and industry-wide wallet migrations are typically multi-year efforts.

Key coordination tasks include defining upgrade rules, developing comprehensive test suites, building interoperable wallet and custody support, and agreeing on transparent recovery or sunset policies for legacy signatures. Coinbase also underscores the need for open-source collaboration, security audits and participation in groups like the Bitcoin Security Consortium to harmonize efforts across the ecosystem.

What Bitcoin users and developers should do next

For developers: begin experimenting with flexible output types like P2MR, test proposed post-quantum signature schemes for real-world performance, and design verification rules that support mixed-format transactions.

For wallet providers and custodians: prototype hybrid wallets, plan MPC and HSM integration for proposed algorithms, and establish robust state-management and recovery processes to avoid operational pitfalls with stateful signatures.

For node operators and miners: assess block validation impacts and ensure that verification of larger or different signature types will not choke bandwidth-constrained or resource-limited nodes.

For the broader Bitcoin community: separate technical migration work from governance debates about legacy coins, and prioritize collaborative testing and transparent timelines so the network can transition smoothly if and when post-quantum threats become feasible.

Conclusion

Coinbase’s paper is a comprehensive call to action: quantum computing presents a plausible future threat to Bitcoin, and preparing now will reduce systemic risk and avoid rushed, disruptive changes. By promoting flexible transaction formats, hybrid wallets, careful evaluation of post-quantum signature candidates, and coordinated testing across custody and wallet implementations, the paper aims to make a long-term migration achievable without undermining the security and fungibility of Bitcoin today.

The core message is pragmatic: plan early, test widely, and keep debates about inaccessible coins separate from technical progress so that the ecosystem can enhance cryptographic resilience before a practical quantum attacker emerges.

Coinbase has signaled its own commitment by adapting custody infrastructure, contributing to open-source efforts, and engaging with researchers and the Bitcoin developer community. The next phase will depend on continued cross-industry collaboration, standardized benchmarks, and careful governance as the network evaluates real-world post-quantum migration strategies.