Coinbase has called on Bitcoin developers to begin technical preparations for potential quantum computing threats, arguing that consensus changes and ecosystem migrations will require years of coordinated work. The company published a detailed technical paper outlining priorities for a phased transition to post-quantum security.

As one of the largest crypto custodians, Coinbase holds approximately 5% of all existing bitcoin on behalf of clients that include banks, asset managers and hedge funds. The firm stated that it is already preparing its own custody infrastructure while contributing engineering resources and participating in industry efforts such as the Bitcoin Security Consortium.

Why Early Action Matters

Bitcoin currently relies on elliptic-curve cryptography, including ECDSA and Schnorr signatures, to authorize transactions. A sufficiently powerful quantum computer, sometimes described as a cryptographically relevant quantum computer, could in theory derive private keys from exposed public keys and spend the associated funds without authorization.

Coinbase stressed that no such machine exists today and that the threat remains a future possibility. However, the company warned that waiting until a practical quantum attacker appears would leave insufficient time for an orderly upgrade. Consensus changes and large-scale wallet migrations historically take years, so technical groundwork must start well in advance.

The paper frames the challenge as broader than simply selecting a new signature algorithm. Any solution must protect both existing and newly created funds, fit within Bitcoin’s limited block space, allow ordinary full nodes to verify transactions independently, support institutional multiparty computation systems, and accommodate ordinary user wallets.

Flexible Transaction Designs

A central recommendation is to adopt output designs that separate the transaction “container” from the specific signature scheme. This approach would allow developers to introduce, replace or supplement post-quantum algorithms without redesigning Bitcoin’s core transaction structure each time.

Coinbase identified BIP-360, which proposes Pay-to-Merkle-Root (P2MR),and P2TRv2 as constructions that offer this flexibility. BIP-360 builds on Taproot architecture by removing the key-path spending option that exposes a public key vulnerable to long-term quantum attacks. The proposal remains in draft form and does not itself introduce a post-quantum signature algorithm.

Such flexible designs would require clear rules for transaction verification, spending permissions, signature identification and address formats that wallets, exchanges and hardware devices can readily adopt.

Hybrid Migration Paths

For the transition itself, Coinbase favors staged protection that lets active wallets adopt stronger security before final decisions on older signature types are made. One suggested method is a 1-of-2 hybrid construction in which the same funds can be spent either with a classical ECDSA or Schnorr key or with a post-quantum key.

This arrangement would enable gradual migration without forcing every user to switch simultaneously or risk sudden loss of access. The company also suggested evaluating pure post-quantum outputs for early adopters and mechanisms that reduce public-key exposure during the changeover.

Institutional custody adds further requirements. Any new signature system must remain compatible with multiparty computation, a technique that distributes signing authority across multiple parties or systems to reduce single points of failure. Coinbase noted that many large custodians already rely on such systems and that incompatibility would create operational obstacles.

Signature Scheme Considerations

On candidate algorithms, the paper recommended a Bitcoin-specific evaluation process rather than relying on generic rankings used in other cryptographic contexts. Signatures on Bitcoin are stored permanently and verified by every node, so size, verification speed, fee impact and hardware compatibility carry particular weight.

Candidates listed for assessment include ML-DSA, SLH-DSA and FN-DSA once standardized, along with compact designs such as SHRINCS. The latter combines a compact stateful path with a stateless fallback, raising questions about state management and recovery that would need careful review.

Stateful signature schemes can offer advantages in size and speed but carry significant operational risks. Reusing signing state can enable forgery. Self-custody users may struggle to maintain accurate state records, while large distributed custody systems face challenges coordinating exclusive access to keys and state across multiple servers. Coinbase therefore recommended that any support for stateful schemes include a clear, reliable stateless alternative.

Additional evaluation criteria include constant-time and side-channel resistance, deterministic or hedged signing modes, hardware wallet and secure-element feasibility, and measurable effects on block capacity, fees, node validation load and migration throughput for vulnerable unspent outputs.

Handling Dormant and Lost Coins Separately

The paper treats the fate of dormant, lost or permanently exposed bitcoin as a distinct governance and engineering question that should not delay technical work on active wallets. Categories identified include outputs with permanently exposed public keys, reused addresses, legitimately controlled but inactive holdings, inaccessible seeds and concentrated early holdings.

Coinbase observed that any future restrictions on legacy signatures would raise questions about whether and how such funds could still be moved. It advised that rescue proposals must themselves be quantum-safe and unusable by an attacker who knows only an exposed public key. Possible approaches under discussion elsewhere include seed-based proofs, commit-reveal schemes and rate-limiting mechanisms, though the company took no position on specific solutions.

By keeping the debate over inaccessible coins separate from the development of post-quantum signature support, the ecosystem can progress on protections for funds that remain under active control.

Ongoing Work and Next Steps

Coinbase described its paper as a contribution to open discussion rather than a final policy prescription. The company has already begun preparing its custody systems, engaged with researchers and developers, and supported open-source efforts. It expects continued evaluation of signature candidates under realistic network conditions, testing of hardware wallets and fee models, and further refinement of flexible output designs.

No activation timeline, mandatory migration deadline or preferred final algorithm was announced. The emphasis remains on starting the multi-year process now so that Bitcoin’s security architecture can evolve before any practical quantum threat materializes.