Coinbase outlines Bitcoin’s quantum-security priorities

Coinbase, which holds about 5% of all bitcoin in custody, published technical priorities for protecting the network from future quantum attacks in a blog post dated Oct. 13. The post is intended for discussion and does not represent an approved migration plan or final company position.

The exchange wrote that Bitcoin should begin preparing before a cryptographically relevant quantum computer is publicly demonstrated. Such a machine could potentially break the digital signatures used to authorize bitcoin transactions. None is known to exist today.

Consensus changes and migrations by exchanges, wallets and other network participants could take years, according to the post. Coinbase did not instruct bitcoin holders to move their funds.

The exchange recommended separating the transaction structure that holds funds from the signature system used to spend them. That design would allow Bitcoin to add, replace or combine signature systems without changing the entire transaction structure.

Coinbase highlighted P2MR, proposed in draft Bitcoin Improvement Proposal 360, and P2TRv2. P2MR would remove Taproot’s key-path spending and keep public keys hidden until funds are spent. It is designed to reduce the risk posed by public keys that remain exposed on the blockchain for long periods. It would not protect a transaction during the short period between the key’s disclosure and confirmation, which would require a post-quantum signature system.

P2TRv2 would add post-quantum signature paths to a Taproot-style output. The design is under discussion on the Bitcoin developer mailing list, but it is not active and does not have its own BIP. Coinbase also discussed a hybrid design with separate classical and post-quantum spending paths. That approach could support a gradual transition but would make transaction outputs more complex.

For signature algorithms, Coinbase identified ML-DSA, a lattice-based system standardized by the U.S. National Institute of Standards and Technology; SLH-DSA, a stateless, hash-based system; and FN-DSA, which remains in NIST’s development process. The exchange also mentioned SHRINCS, a Bitcoin-focused proposal that uses SHA-256 and produces signatures ranging from 548 to 5,777 bytes.

Post-quantum signatures are generally larger than current Schnorr signatures and could use more of Bitcoin’s limited block space. Coinbase warned that stateful systems can allow forgery if signing information is reused. The risk could affect exchanges operating signing servers in different regions and users who lose track of signing state.

The exchange treated potentially inaccessible bitcoin as a separate issue from the wider transition to post-quantum signatures. This category includes funds held in pay-to-public-key outputs, reused addresses, dormant wallets and early bitcoin holdings. Some may have permanently exposed public keys, while others may be inaccessible to their owners.

A future recovery system would also need to resist quantum attacks. Possible methods include proof of seed ownership, zero-knowledge proofs and limits on recovery attempts. Coinbase did not endorse a specific method and did not resolve how abandoned or inaccessible coins should be handled.

The priorities reflect requirements for large custodians, including multiparty computation, constant-time implementations and consistent verification across platforms. Coinbase supports related open-source work through the Bitcoin Security Consortium and has discussed the issue with Bitcoin developers.

BIP-360 remains a draft, and P2TRv2 has not been adopted. No Bitcoin upgrade related to the proposals has been approved, and the network has set no deadline for a post-quantum migration.