Coinbase has set out a technical roadmap for helping Bitcoin prepare for the eventual arrival of quantum computers capable of breaking today’s widely used cryptography, arguing that the network needs to begin designing signature upgrades and fund-migration tools years before such machines are available.
The exchange, which said it custodies about 5% of Bitcoin’s total supply, framed the challenge as a network-wide engineering and coordination problem rather than a simple replacement of Bitcoin’s existing signature algorithm. Its proposal calls for designs that can protect newly created coins and funds already held in potentially exposed address types, while preserving Bitcoin’s core constraints around block space, full-node validation, wallet usability and institutional custody.
Coinbase’s publication does not suggest that a cryptographically relevant quantum computer, or CRQC, exists today. Instead, it argues that Bitcoin’s long consensus process makes early preparation necessary. Changes to the protocol require broad agreement among developers, miners, node operators, wallet providers and custodians, followed by a lengthy transition in which users would need practical ways to move funds.
Coinbase focuses on flexible output designs
A central part of Coinbase’s preferred approach is to separate the structure that holds a Bitcoin output from the cryptographic signature scheme used to spend it. That architecture could allow Bitcoin to add, replace or combine signature systems later without repeatedly redesigning how coins are represented on-chain.
The company pointed to Pay-to-Merkle-Root, or P2MR, described in BIP-360, and P2TRv2 as examples of output structures that appear capable of supporting such flexibility. Both concepts would give Bitcoin room to define multiple spending conditions, potentially including classical and post-quantum signatures.
Bitcoin currently relies primarily on elliptic-curve cryptography. The system’s ECDSA and Schnorr signatures are secure against conventional computing methods, but a sufficiently capable quantum computer could theoretically derive a private key from a public key using Shor’s algorithm. That risk becomes more immediate once a public key has been exposed on-chain.
Coinbase’s design goals therefore cover two related but distinct tasks: preventing future outputs from revealing keys under legacy assumptions, and creating routes for holders of older or exposed coins to move into quantum-resistant arrangements before a CRQC becomes operational.
Dual-path spending could support a gradual migration
Coinbase proposed a staged protection model rather than an immediate network-wide switch from current signatures to a single post-quantum standard. Under this model, active wallets could move into outputs containing both classical and post-quantum spending paths while Bitcoin developers continue debating the long-term treatment of legacy signatures.
One option described by the exchange is a 1-of-2 arrangement. The same funds could be spent either with an existing ECDSA or Schnorr key or with a post-quantum key. Such a construction could give users a transition route before the ecosystem reaches a final decision on whether and when to disable legacy signing methods for certain outputs.
That approach would reduce pressure to force every wallet, custodian and payment service into a simultaneous upgrade. It also creates a practical complication: hybrid designs may consume more block space or transaction weight than current single-signature outputs. Coinbase explicitly included Bitcoin’s limited block space among its design constraints, indicating that signature size and transaction efficiency will shape the eventual choice of cryptography.
The company also stressed that any solution must preserve independent verification by full nodes. Bitcoin’s security model depends on users being able to validate blocks and transactions without relying on a small group of specialized operators. Post-quantum signature schemes can have substantially larger public keys or signatures than Bitcoin’s present cryptography, creating a trade-off between quantum resistance and the cost of validating and storing transactions.
Stateful signature risks require a fallback
Coinbase said that if Bitcoin adopts any stateful post-quantum signature scheme, it should also retain a stateless alternative. Stateful schemes can be secure and efficient under specific conditions, but require a signer to track which signing states have already been used. Reusing state incorrectly can undermine security and, in some designs, enable forgery.
A stateless option would avoid that operational hazard, though it may impose different costs in signature size or verification. The exchange’s position reflects a wider implementation concern: Bitcoin’s eventual quantum upgrade would need to work not only in carefully managed systems but also across consumer wallets, backup tools, hardware devices and recovery processes.
Institutional custody introduces another requirement. Coinbase said at least one post-quantum signature option should have a viable path toward compatibility with multiparty computation, or MPC. MPC lets several parties jointly authorize a transaction without placing a complete private key with any individual participant. The technology is widely used in institutional custody arrangements, and a signature upgrade that excluded MPC could make migration harder for large custodians and corporate treasuries.
Lost coins remain a separate policy question
The post also raised the issue of coins that cannot or will not migrate. These include Bitcoin held in inaccessible wallets, coins controlled by lost keys, and funds whose owners decline to move them to quantum-resistant outputs.
How Bitcoin should treat such coins would likely become one of the most contentious parts of any quantum transition. Leaving exposed legacy outputs spendable after quantum computers become capable of deriving their keys could create an avenue for theft. Restricting those outputs, meanwhile, would raise difficult questions about property rights and the treatment of dormant funds.
Coinbase indicated that debate over abandoned or inaccessible coins can proceed in parallel with the engineering work needed to add post-quantum signature support. That sequencing could allow developers to build migration tools and test new output formats without waiting for consensus on every policy issue surrounding old coins.
The Global Risk Institute has estimated a 34% probability of a quantum computer capable of breaking current public-key cryptography by 2034. Such forecasts remain uncertain, and cryptographic migration timelines cannot be set by a single hardware milestone. Google has separately targeted 2029 for completing quantum-safe upgrades to specified internal systems, reflecting the long preparation periods required by large technical infrastructures.
For Bitcoin, Coinbase’s outline places the immediate work in protocol design, wallet development and custody compatibility rather than emergency movement of funds. The eventual transition would depend on open-source testing, community agreement and tools that allow users to migrate without sacrificing the network’s decentralization or making routine transactions impractically expensive.
Concerned about Bitcoin’s future security? Explore how digital signatures work and strengthen your understanding of crypto protection today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
