Coinbase, which custodies roughly 5% of all bitcoin in existence, has published its technical priorities for moving the network toward post-quantum security — while being explicit that its paper is an input to an open discussion, not an adopted roadmap and not a final company position. In a blog post dated October 13, the exchange frames quantum resistance as more than a choice of signature scheme: any plan must also protect funds already exposed and funds not yet created, fit inside Bitcoin’s scarce block space, and keep working inside institutional custody.
The timing is deliberate. Coinbase argues the industry should begin preparing before any cryptographically relevant quantum computer is announced, because “Bitcoin consensus changes and ecosystem migrations can take years.” No publicly demonstrated cryptographically relevant quantum computer capable of breaking Bitcoin signatures is known today, and Coinbase’s write-up is one of the most detailed institutional requirements frameworks published by a major Bitcoin custodian — not a migration path anyone has adopted, and not a deadline.
Decoupling the Container From the Signature
Coinbase’s central recommendation is to separate the “container” — the output type that holds funds — from the signature algorithm that authorizes spending. That way a post-quantum scheme could be introduced, replaced, or supplemented without redesigning the entire structure. The post points to two flexible designs: P2MR, proposed in BIP-360, and P2TRv2, both of which keep public keys hidden until needed and leave room for future signature algorithms.
BIP-360 remains a Draft. P2MR removes Taproot’s key-path spending — the route that exposes a public key a future quantum computer could attack — and primarily mitigates long-exposure risk, the danger to keys that sit visible on-chain for long periods. It does not by itself provide full short-exposure protection: an attack in the window between a transaction revealing its key and its confirmation may still require a post-quantum signature scheme. P2TRv2, a Taproot-style output with post-quantum signature paths added, is discussed on the bitcoin-dev mailing list; it is not active and has no BIP of its own.
Signature Options Compared
| Candidate | Status | Problem addressed | Benefit | Limitation |
|---|---|---|---|---|
| P2MR (BIP-360) | Draft | Exposed public keys (long exposure) | Removes Taproot key path; keys stay hidden until spend | No short-exposure protection; needs a separate PQ signature scheme |
| P2TRv2 | Proposal, no BIP | Migration path that preserves today’s habits | Drop-in Taproot compatibility; PQ signature paths added | Every output shows an EC key; relies on a later rule change to disable EC paths |
| 1-of-2 classical/PQ hybrid | Concept | Staged protection during the transition | Two spending paths: ECDSA/Schnorr today, PQ key later | More complex output; still needs a chosen PQ scheme |
| ML-DSA | NIST-standardized (FIPS 204) | General post-quantum signing | Lattice-based; standards-backed, widely studied | Signatures far larger than Schnorr |
| SLH-DSA | NIST-standardized (FIPS 205) | General post-quantum signing | Hash-based and stateless; no signing-state reuse risk | Largest signatures; costly on-chain |
| FN-DSA | In progress (NIST draft) | General post-quantum signing | Compact lattice signatures | Complex implementation; not finalized |
| SHRINCS | Draft, no BIP number | Compact Bitcoin-native PQ signing | SHA-256-based; 548–5,777-byte signatures; stateless fallback | Stateful path risks forgery on state reuse; security proof unfinished |
| Legacy-coin rescue | Open question | Coins in exposed or dormant addresses | Separates rescue from signature migration | Any rescue must itself be quantum-safe; unresolved |
On scheme selection, Coinbase wants an evaluation set spanning NIST’s post-quantum standards and in-progress algorithms — ML-DSA, SLH-DSA and FN-DSA — plus compact candidates such as SHRINCS, while warning that stateful schemes carry a sharp risk: reusing signing state can enable forgery.
The Coins That Cannot Move
The hardest part of the migration is not the cryptography but the funds that may never be migrated. Coinbase argues legacy coins should be treated as a separate governance and engineering problem, distinct from adding post-quantum signature support. That category includes pay-to-public-key outputs with permanently exposed keys, reused addresses, dormant holdings, and Satoshi-era balances, alongside the possibility of covert quantum theft before the public learns a CRQC exists.
It is the same exposure problem that Europol has flagged for exposed wallet keys. Coinbase says any rescue mechanism — whether based on seed knowledge, zero-knowledge proofs, or rate-limiting tripwires — must itself be quantum-safe, so a quantum attacker holding only a public key cannot exploit the recovery path. The exchange leaves the question open.
What Coinbase’s Proposal Does Not Mean
- No Bitcoin upgrade has been approved. The post is an input to discussion, not a decision.
- BIP-360 remains a draft; P2TRv2 is not active.
- Holders were not instructed to move bitcoin today.
- No publicly demonstrated CRQC capable of breaking Bitcoin signatures is known today.
- Inaccessible and abandoned coins remain an unresolved problem.
What a 5% Custodian Adds to the Debate
Coinbase’s stake in the outcome gives the post unusual weight. As one of the largest custodians, it is preparing its own systems, convening Bitcoin developers, and supporting open-source work through the Bitcoin Security Consortium. Its recommendations reflect institutional needs that smaller proposals often skip: MPC-friendly signing, constant-time implementations, and deterministic, cross-platform verification.
Those concerns cut against stateful schemes that look efficient on paper. For a self-custody user, losing or reusing signing state could mean forgery and loss of funds; for an exchange running independent signing servers across regions, a stateful scheme would force exclusive locks that break high-availability operation. The counterweight is that Zcash’s own January quantum plan shows real networks are beginning to commit to concrete timelines. The next signal is whether the Bitcoin community converges on a P2MR- or P2TRv2-style output and a shortlist of schemes that custodians, wallets, and full nodes can all actually run. For the deeper question of whether quantum computers can break Bitcoin, see BlockchainReporter’s 2026 quantum explainer.
