Coinbase, which custodies roughly 5% of all bitcoin in existence, has published its technical priorities for moving the network to post-quantum security, warning that the transition will be a
Coinbase, which custodies roughly 5% of all bitcoin in existence, has published its technical priorities for moving the network to post-quantum security, warning that the transition will be a “challenging, complex, and multi-year process.” The exchange laid out its thinking in a blog post that frames quantum resistance as more than a choice of signature scheme. It must also protect already-exposed and newly created funds, fit Bitcoin’s scarce block space, and keep working inside institutional custody.
The timing is deliberate. Coinbase argues the industry should begin preparing well before any cryptographically relevant quantum computer (CRQC) is announced, because “Bitcoin consensus changes and ecosystem migrations can take years.” The post is explicitly an input to an open discussion rather than a final position, but its proposals amount to the first concrete migration path outlined by one of the network’s largest custodians.
Coinbase’s central recommendation is to decouple the “container” — the output type that holds funds — from the signature algorithm that authorizes spending. That way a post-quantum scheme could be introduced, replaced, or supplemented without redesigning the entire structure. The exchange points to two flexible designs: P2MR, proposed in Bitcoin Improvement Proposal 360, and P2TRv2, both of which keep public keys hidden until needed and leave room for future signature algorithms.
For the transition itself, Coinbase favors staged protection. One option is a “1-of-2” hybrid output in which the same funds carry two spending paths: one authorized by a classical ECDSA or Schnorr key and one by a post-quantum key. Users could keep signing classically today and switch to quantum-resistant signing when required. On scheme selection, Coinbase wants an evaluation set spanning standardized and in-progress algorithms — ML-DSA, SLH-DSA and FN-DSA — plus compact candidates such as SHRINCS, while warning that stateful schemes carry a sharp risk: reusing signing state can enable forgery.
The hardest part of the migration is not the cryptography but the funds that may never be migrated. Coinbase argues legacy coins should be treated as a separate governance and engineering problem, distinct from adding post-quantum signature support. That category includes pay-to-public-key outputs with permanently exposed keys, reused addresses, dormant holdings, and Satoshi-era balances, alongside the possibility of covert quantum theft before the public learns a CRQC exists.
It is the same exposure problem that Europol has flagged for exposed wallet keys. Coinbase says any rescue mechanism — whether based on seed knowledge, zero-knowledge proofs, or rate-limiting tripwires — must itself be quantum-safe, so a quantum attacker holding only a public key cannot exploit the recovery path. The exchange leaves the question open, arguing the discussion can run alongside the signature work rather than delaying it.
Coinbase’s stake in the outcome gives the post unusual weight. As one of the largest custodians, it is preparing its own systems, convening Bitcoin developers, and supporting open-source work through the Bitcoin Security Consortium. Its recommendations reflect institutional needs that smaller proposals often skip: MPC-friendly signing, constant-time implementations, and deterministic, cross-platform verification.
Those concerns cut against stateful schemes that look efficient on paper. For a self-custody user, losing or reusing signing state could mean forgery and loss of funds; for an exchange running independent signing servers across regions, a stateful scheme would force exclusive locks that break high-availability operation. The counterweight is that Zcash’s own January quantum plan shows real networks are beginning to commit to concrete timelines. Nothing here is final: no CRQC exists, and Coinbase frames the post as considerations rather than instructions. The next signal is whether the Bitcoin community converges on a P2MR- or P2TRv2-style output and a shortlist of schemes that custodians, wallets, and full nodes can all actually run.
