Coinbase has urged Bitcoin developers to begin preparing for quantum computing threats, warning in an October 13 technical paper that upgrading the cryptocurrency’s security could take several years.
Summary
- Coinbase holds approximately 5% of existing Bitcoin and recommends early preparations against future quantum threats.
- Bitcoin’s transition to quantum resistant security could take several years, according to Coinbase’s technical paper.
- Coinbase identified BIP-360 and P2TRv2 as flexible designs for introducing future quantum resistant signature systems.
- The company proposed hybrid wallets supporting existing Bitcoin signatures alongside future post quantum authentication methods.
- Coinbase urged developers to address dormant Bitcoin and lost private keys separately from technical upgrades.
Coinbase published its recommendations on Tuesday, outlining how Bitcoin could gradually adopt quantum-resistant digital signatures while protecting existing wallets and institutional holdings. The company, which says it holds approximately 5% of all existing BTC in custody, called for flexible transaction designs, stronger wallet protections and a migration process that does not depend on resolving every dispute over older coins.
Coinbase warns Bitcoin quantum security upgrades could take years
In its October 13 paper, Coinbase explained that Bitcoin’s move toward quantum-resistant security involves more than introducing a new digital signature algorithm. Developers must consider transaction fees, network capacity, wallet compatibility and the ability of Bitcoin nodes to verify transactions independently.
The company warned that consensus changes and wallet migrations often require years of planning and coordination. It encouraged developers to begin preparing before researchers demonstrate a quantum computer powerful enough to break Bitcoin’s existing cryptographic signatures.
Bitcoin currently relies on elliptic-curve cryptography, including ECDSA and Schnorr signatures, to authorize transactions. A sufficiently powerful quantum computer could theoretically derive private keys from exposed public keys, allowing an attacker to spend funds without authorization.
The proposal does not claim that such a machine currently exists or that Bitcoin’s cryptographic protections have been broken. Coinbase described the threat as a future possibility requiring preparation before the necessary technology becomes available.
The company has already begun preparing its own custody systems for post-quantum security. Its work includes discussions with Bitcoin researchers, engineering contributions to open-source projects and participation in the Bitcoin Security Consortium.
Earlier Coinbase research into Bitcoin quantum risks called for migration planning to begin before a practical quantum attacker emerges. The company’s independent advisory board supported developing protective technologies while leaving decisions about inaccessible or abandoned funds to Bitcoin’s governance process.
Coinbase’s October publication advances that discussion by identifying technical requirements for wallets, transaction formats and institutional custody. The company emphasized that its recommendations remain contributions to an ongoing development process, not a final decision on Bitcoin’s future security design.
Coinbase supports BIP-360 and flexible Bitcoin wallets
Among the proposed technical approaches, Coinbase identified BIP-360 and P2TRv2 as designs worth considering for Bitcoin’s transition. Both seek to provide flexible transaction structures that could accommodate new digital signature systems.
BIP-360 introduces Pay-to-Merkle-Root, or P2MR, a proposed transaction output type derived from Bitcoin’s existing Taproot architecture. The design removes Taproot’s key-path spending option, which exposes a public key that could become vulnerable to a sufficiently powerful quantum computer.
The official BIP-360 specification describes P2MR as a proposed soft-fork change intended to protect against long-exposure attacks involving public keys. It does not independently introduce a post-quantum signature algorithm or prevent every possible quantum attack. The proposal remains in draft status.
Coinbase suggested that a flexible output design could allow developers to introduce or replace cryptographic algorithms without redesigning Bitcoin’s transaction structure each time. Such flexibility would require clear rules for transaction verification, spending permissions and signature identification.
The company specifically recommended examining post-quantum signature algorithms including ML-DSA, SLH-DSA and FN-DSA, once the relevant standards are available. It identified SHRINCS, a proposed compact hash-based signature design, as another candidate requiring further evaluation.
According to Coinbase, developers should assess the size of signatures, processing speed, transaction fees and hardware compatibility before choosing an approach. Larger signatures could increase block-space requirements and raise transaction costs during a large migration.
Previous BIP-360 testing on a Bitcoin quantum testnet demonstrated experimental P2MR transactions. In March, BTQ Technologies reported support for address creation, funding, signing and transaction confirmation on its test network. The implementation did not represent activation of BIP-360 on Bitcoin mainnet.
Bitcoin wallets could support old and new signatures
For the migration itself, Coinbase recommended evaluating a phased system that allows Bitcoin users to adopt stronger protections before older signatures are discontinued.
One possible approach involves a hybrid wallet with two alternative spending methods. Users could authorize transactions through existing ECDSA or Schnorr signatures, while a separate post-quantum key would provide another spending path.
Coinbase described this arrangement as a potential 1-of-2 construction. The design could let users move toward quantum-resistant security without waiting for developers to settle every detail of a future policy governing older Bitcoin signatures.
The company proposed evaluating post-quantum-only outputs for early adopters, along with mechanisms intended to reduce public-key exposure during transactions. Possible future restrictions on payments to older address types would require separate consideration.
Institutional custody creates further requirements. Coinbase said new signature systems should remain compatible with multiparty computation, or MPC, a security technique that allows several parties or systems to participate in cryptographic signing.
Coinbase expressed particular concern about stateful signature algorithms, which require systems to track information across signing operations. Reusing signing state can create security weaknesses, including potential signature forgery.
According to the paper, large custodians operate signing infrastructure across multiple servers and locations. Coordinating stateful signatures across those systems could introduce operational difficulties if records are lost, duplicated or restored incorrectly.
The company recommended maintaining a stateless signing option if Bitcoin eventually supports stateful post-quantum algorithms. Developers should provide wallet providers with clear instructions for managing signing state and recovering safely from failures.
Earlier Coinbase work on post-quantum custody examined how institutions could prepare for different cryptographic systems before Bitcoin developers selected a final standard. The September discussion included potential alternatives involving programmable hardware security modules.
Coinbase urges separate debate over lost Bitcoin
Another unresolved issue concerns Bitcoin held in old wallets that may never migrate to quantum-resistant addresses.
Coinbase identified several categories requiring attention, including wallets with publicly exposed keys, dormant holdings, lost private keys and Bitcoin associated with the cryptocurrency’s earliest years.
Some of these coins may remain under legitimate ownership, while others could be permanently inaccessible. The company said future migration policies would need to consider whether such funds could move after restrictions on older signatures take effect.
The paper discussed possible recovery methods involving wallet seed information, cryptographic proofs and transaction commitments. Coinbase cautioned that any recovery mechanism must remain secure against an attacker who has access only to an exposed public key.
The question has appeared in separate Bitcoin development proposals. BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, proposes gradually restricting older signatures after a post-quantum output system becomes available. Its draft describes a staged migration followed by tighter rules for legacy transactions.
BIP-361 remains a proposal and has not been activated. Its authors outline a possible timetable involving an initial transition period and subsequent restrictions on legacy spending, with recovery arrangements remaining subject to further research.
Coinbase recommended discussing such decisions independently from the technical development of post-quantum signatures. The company said disagreements over inaccessible funds should not prevent work on protections for active wallets.
The paper identified further testing needs involving transaction verification, hardware wallets, fee costs, block propagation and the time required to move potentially vulnerable Bitcoin holdings. Coinbase called for a reproducible evaluation process that compares alternative signature systems under realistic network conditions.
Its October 13 publication did not establish a deadline for Bitcoin users to migrate, endorse a specific final signature algorithm or announce a proposed activation date. The company said its next work would continue through discussions with researchers, developers and open-source contributors.
