Coinbase, Custodian of 5% of Bitcoin, Urges Post-Quantum Fix Now

Coinbase has published a position paper arguing that bitcoin must begin migrating to post-quantum signature schemes now, well before any quantum computer capable of breaking today's cryptography is announced. The Nasdaq-listed exchange, which holds roughly 5% of all bitcoin in existence for banks, asset managers, hedge funds and retail clients, laid out seven requirements for that migration, from flexible output types to multiparty computation compatibility, and argued that the explosive question of lost coins belongs on a separate track.

What Coinbase actually proposed

The paper reads as a design brief rather than a single cryptographic switch. Coinbase's stated requirements for a post-quantum bitcoin path are that it protects both exposed and newly created funds, fits inside bitcoin's scarce block space, keeps full-node validation independent and bounded by a machine's resources, works inside institutional custody, and still functions for self-custody wallets. It framed the document as an input to open discussion rather than a final position.

BIP-360 already fits part of that brief. It removes the exposed key path from Taproot. Coinbase also flagged P2TRv2.

The staged-protection idea is the one most traders will recognize. Coinbase backs transition modes that let active wallets add a post-quantum or hybrid spending path before bitcoin settles its final policy on legacy signatures, with a '1-of-2' design as the example: the same funds carry two ways to be spent, one authorized by a classical ECDSA or Schnorr key and one by a post-quantum key. Classical signing works first, and nobody is cut off mid-migration.

Coinbase also asked that stateless options exist alongside stateful ones.

That request comes from a specific failure mode. Some hash-based post-quantum schemes rely on one-time signing keys, so a wallet must remember which have already been spent. If state is lost during a restore, or a signer cannot tell whether an update committed, the same key gets used twice, and reuse in these schemes produces a valid forged signature. Coinbase argues self-custody users cannot easily verify state on chain, and that operators running independent signing servers would need exclusive locks on each key.

How a quantum computer breaks bitcoin's locks

Bitcoin ownership is a keypair, and a transaction is a signature with it. When someone spends, their wallet signs with a private key and nodes check that signature against the public key. Two schemes do that work today: ECDSA, which has secured bitcoin since 2009, and Schnorr, which arrived with the Taproot upgrade in November 2021. On ordinary computers, working backwards from a public key to a private key is computationally hopeless.

Shor's algorithm is what changes that arithmetic.

On a sufficiently powerful quantum machine, Shor's algorithm turns that reversal into a tractable problem. Researchers call a machine capable of breaking today's blockchain cryptography a cryptographically relevant quantum computer, or CRQC. Google researchers have projected one could exist as early as 2029. Today's most advanced machines measure fewer than 1,000 qubits, far short of what breaking elliptic-curve signatures requires.

Exposure is not uniform, and that is the detail most people get wrong. Public keys stay hidden in bitcoin's address formats until a coin is spent, with two exceptions: old pay-to-public-key outputs and Taproot outputs, which reveal the key the moment the coin is created. A fresh address holding an unspent balance is comparatively safe today, while an address that has been spent from, or that uses the oldest or Taproot formats, has already published its key for good.

Estimates put the exposed population in the high single-digit millions of bitcoin.

What does this mean for bitcoin traders?

Nothing here changes bitcoin's price structure today, and nothing in the paper forces a soft fork, a freeze or a forced balance migration in the near term. Coinbase explicitly set the lost-coin question aside, and the proposals it backs are still drafts under discussion. What changes is the calendar. The exchange is arguing that a migration measured in years should already be underway, which makes quantum readiness a multi-year planning item for anyone operating at scale rather than a dated event.

Bitcoin traded near $83,400 when the paper landed. The post-quantum theme was not the driver.

For holders, the near-term distinction is custodial versus self-custodial. Coins sitting on an exchange are governed by the exchange's ability to keep signing: key material is split across systems so no single machine ever reconstructs it, exactly the property Coinbase wants post-quantum schemes to preserve. That is why multiparty computation compatibility sits in the requirements list, and why the exchange asked for at least one candidate scheme that splits cleanly across multiple signers.

Self-custody carries the opposite profile. Nothing forces a holder to move coins, and an untouched address with a hidden public key is not the exposed case. But a holder who has spent repeatedly from the same address, or who inherited old-format coins, has published keys already, and waiting for a later deadline is still a choice with a deadline attached.

Why start now, years before a CRQC exists

Because bitcoin has no switch to flip. Coinbase's own framing is that consensus changes and ecosystem migrations can take years, which is why the work has to start well ahead of any CRQC announcement. A soft fork needs node operators and wallet makers to ship software, and holders to adopt it, and that chain has no deadline until someone attaches one.

Taproot is the precedent, and it is not encouraging.

Taproot bundled three BIPs into one soft fork and took roughly five years to reach activation in November 2021. It was opt-in, and most users never migrated, which is a large reason so much supply ended up in Taproot outputs with publicly visible keys. A post-quantum migration cannot rely on opt-in behavior, because a holder who does nothing is a holder whose keys eventually fail. Post-quantum signatures are also far larger than the 64-byte Schnorr signatures they would partly replace, and bigger signatures eat the block space that sets fee and throughput economics.

Institutional money has been funding the unglamorous parts. Coinbase is a founding member of the Bitcoin Security Consortium, an industry group launched with a $15 million commitment and backed by names including BlackRock, Fidelity Digital Assets, Block, Blockstream and Strategy. The exchange has also co-hosted closed-door post-quantum workshops with researchers at Stanford, where developers, custodians and hardware-wallet makers worked through signature tradeoffs and institutional custody requirements. Engineering time is the cheapest input here, and the one that cannot be bought back.

What happens to the lost coins?

Coinbase declined to take a side, and that is the point. The exchange listed dormant, lost and exposed funds as a governance question to be handled separately from the technical work, so the hardest political fight in the ecosystem does not stall the protection work for everyone else.

The stakes are measured in millions of coins.

Public estimates put the bitcoin sitting behind already-exposed public keys in the region of seven million, roughly a third of circulating supply. That figure includes early-era outputs whose keys were published by design, reused keys in otherwise hashed formats, and coins attributed to Satoshi Nakamoto that have never moved. A rescue mechanism built on seed knowledge or proof of secret knowledge would have to be shown post-quantum safe in its own right, or the rescue becomes the attack surface.

There is a timing problem underneath all of it: a theft that happens before the public learns a CRQC exists cannot be responded to.

Coinbase raised the possibility of a quantum machine assembled quietly, with drains starting against exposed wallets before any announcement. That is the argument for building rate limits, tripwires or staged sunsets early even when their eventual form is unknown, because a mechanism that gives warning without creating an unbounded incentive to attack first is hard to retrofit under pressure.

What to watch next

Output-type design is the first thing to track. BIP-360's P2MR is the reference shape Coinbase likes, removing the key path while keeping a Taproot-like commitment structure, and P2TRv2 plus proposals such as P2QR, a post-quantum-only output for holders willing to migrate early, sit in the same public discussion. Versioning rules matter as much as the base design, because the requirement is that a new scheme or parameter set never needs a brand-new output type.

Coinbase argued that a bitcoin-specific, reproducible evaluation beats any generic ranking, because bitcoin signatures are stored forever and verified by every node. It wants ML-DSA, SLH-DSA, FN-DSA once standardized, plus compact or assumption-diverse candidates including SHRINCS, judged on signature and key sizes, verification time, side-channel resistance, hardware-wallet feasibility and migration throughput. Block capacity, fee cost and the time needed to move a vulnerable UTXO population belong in the scorecard.

The handoff from debate to code is the signal that matters. Once an output type and a scheme are paired, this stops being a research question and becomes a deployment question with costs attached.

Custodians are running their own clock in parallel. Coinbase said it has begun building a post-quantum version of its key management system, combining secure enclaves, secret sharing and threshold cryptography, with a signing pipeline meant to support any post-quantum algorithm once blockchains adopt one. It is also ranking its cryptography inventory by criticality and setting quantum milestones that would trigger real migrations. That is the line item with a timeline attached.