Key takeaways
- Coinbase says Bitcoin should start its post quantum migration now because consensus changes take years.
- It backs flexible output designs such as BIP-360 (P2MR) and P2TRv2, plus hybrid protection for active wallets.
- Dormant and lost coins should be debated separately, and any rescue method must itself be quantum safe.
Coinbase, the custodian that holds roughly 5% of all bitcoin for its clients, is urging the Bitcoin community to begin work on a quantum computing fix now rather than waiting for the threat to arrive. In a blog post published October 13, the exchange laid out what it believes a sensible Bitcoin quantum upgrade should look like, from how new signatures plug into transactions to what happens to coins whose owners never move them. The company stresses that the post is a contribution to an open debate, not a final position, but the size of its holdings makes its voice hard to ignore.
What Coinbase actually said
The post, written by Coinbase's Shashank Agrawal, argues that choosing a quantum resistant signature scheme is only one piece of the job. The harder work is designing how Bitcoin moves to that scheme without breaking wallets, exchanges and custody systems along the way.
According to the blog, the company organized its thinking into seven high level points and a list of criteria it wants any candidate scheme to meet. Coinbase describes the document as "an input to an open discussion, not a set of instructions or a final Coinbase position."
CoinDesk, which reported on the post early Wednesday, noted that Coinbase has provided custody for more than 13 years and counts banks, asset managers and hedge funds among its clients. That gives the exchange a direct stake in how any migration plays out.
Why the Bitcoin quantum upgrade matters now
Bitcoin today relies on ECDSA and Schnorr signatures. Both are secure against ordinary computers. The worry is a future machine that researchers call a cryptographically relevant quantum computer. Such a device could, in theory, work backward from a public key to the private key that controls a wallet, then sign transactions and drain the funds.
No machine like that exists. CoinDesk reports that Google researchers have projected one could exist by 2029, though forecasts in this field vary widely and have shifted before.
Coinbase's core argument is about timing. As the blog puts it, consensus changes and ecosystem migrations can take years. Bitcoin's last major upgrade, Taproot, went from early proposals to activation over a long stretch, and that change was far less disruptive than swapping out the signature system. If the work starts only after a quantum breakthrough is confirmed, the network may not have enough time to move.
We have covered a related warning before. An Ethereum researcher recently urged holders to adopt a crypto bunker mode out of concern that new technology could expose wallet keys. Coinbase's post is calmer in tone but points at the same basic risk.
The main recommendations
Separate the container from the signature
Coinbase wants Bitcoin's output format to support new signature types without a full redesign each time. It names two proposals that offer this flexibility: BIP-360, also called P2MR, and P2TRv2. The blog describes P2MR as a Taproot style commitment with the key path removed, built with post quantum integration in mind.
The logic is simple. If the first post quantum scheme turns out to have a flaw, the network should be able to switch to another one without starting from scratch.
Protect active wallets in stages
Rather than waiting for one big switch, Coinbase favors letting active wallets adopt hybrid protection early. CoinDesk gives the example of a "1 of 2" setup, where funds can be spent with either a traditional key or a post quantum key. That lets users add a safety net before the community settles what to do about the old signature types.
Be careful with stateful signatures
Some post quantum schemes, especially hash based ones, require a wallet to track which one time keys it has already used. Restore an old backup and you might reuse a key without knowing it. Coinbase is blunt about the danger, writing that "state reuse can be catastrophic, leading to immediate forgery."
The company says self custody users and exchanges running many servers would both struggle with this. It wants clear warnings, wallet guidance and a stateless fallback offered alongside any stateful option. The blog mentions SHRINCS, a compact hash based candidate that pairs a stateful path with a stateless fallback derived from SLH-DSA.
Favor robust, MPC friendly schemes
Coinbase lists practical tests for any candidate: deterministic verification, constant time code that does not leak timing information, clear parameters and safety even if a random number generator fails. It also wants at least one scheme that works well with multi party computation (MPC), a technique large custodians use to split control of keys so no single server holds the whole secret. The blog names ML-DSA, SLH-DSA and FN-DSA (once standardized) as signature families worth evaluating.
Who is affected
Long term holders and dormant coins
The thorniest question is what happens to coins that never move. Some sit in wallets that have been idle for years, some belong to people who lost their keys and some are held in older address types that already expose public keys on chain. CoinDesk reports that Coinbase warned someone could quietly build a quantum machine and drain those coins before the public learns about it.
Coinbase does not say what should be done with them. It argues that this governance debate should run separately from the technical work so it does not slow everything else down. It also warns that any rescue method must itself be quantum safe, otherwise attackers could exploit the rescue path. The blog points to "tripwire" style ideas discussed on the bitcoin developer mailing list that could give early warning of an attack without creating a new incentive to steal.
Late movers
Coinbase also asks developers to study whether people who migrate late could still move funds after legacy signatures are restricted. It calls the approach an open question.
Everyday users
For most people holding bitcoin on an exchange or in an ETF, nothing changes today. If you are new to how these products hold coins, our explainers on Bitcoin ETFs and how a blockchain works cover the basics.
What you can do now
There is no quantum deadline today, so panic moves make little sense. A few sensible habits still help:
- Avoid reusing addresses. Spending from an address reveals its public key, which is the piece a future quantum attacker would need.
- Keep wallet software up to date so you can adopt new output types when wallets add support.
- Follow proposals like BIP-360 through official Bitcoin development channels rather than social media summaries.
- Be wary of anyone selling "quantum proof" wallets or tokens. Bitcoin has not adopted any post quantum standard yet.
What to watch next
The next signs of progress will come from Bitcoin developers, not exchanges. Watch for movement on BIP-360 and competing designs, debate over whether to restrict old signature types and how the community handles dormant coins. Coinbase's blog also references a $15 million pledge connected to a Bitcoin Security Consortium, according to a linked announcement, which suggests the exchange plans to keep funding the effort.
Markets are a separate story this week. Bitcoin slipped from near $84,000 ahead of US inflation data, CoinDesk reported, a reminder that day to day prices move on macro news long before any quantum risk. For more on recent price swings, see our coverage of bitcoin falling to $80,000, and for a recent example of a protocol level flaw being fixed before it was abused, read about the XRP Ledger bug. You can find more stories on our crypto page.
Frequently asked questions
Can quantum computers break Bitcoin today?
No. No existing quantum computer can derive a Bitcoin private key from a public key. The concern is a future machine, which some Google researchers project could arrive by 2029.
What is BIP-360?
BIP-360, also known as P2MR, is a proposed Bitcoin output type that removes Taproot's key path and is designed to make adding post quantum signatures easier. Coinbase cited it as a flexible option.
Is Coinbase changing how it stores my bitcoin?
The blog does not announce any change to customer accounts. It is a set of recommendations for the wider Bitcoin community.
What happens to lost or dormant bitcoin?
That is still undecided. Coinbase says the question should be debated separately and that any rescue method must itself be quantum safe.
Sources
Share this story
Spotted an error? Tell us
