Coinbase, the Nasdaq-listed crypto exchange that holds roughly 5% of all bitcoin in existence on behalf of clients including banks, asset managers and hedge funds, said Bitcoin should begin preparing now for the Bitcoin quantum threat, machines that could one day derive private keys from public keys and drain vulnerable wallets. The company set out its position in a new blog post describing what it believes the network must do to stay secure against what it called a potential future quantum threat.

The exchange's core argument is about timing. Because Bitcoin's decentralized design makes changes slow to agree and implement, the company said the work cannot wait for a capable machine to appear. As Coinbase put it, "Bitcoin consensus changes, and ecosystem migrations can take years," which is why it said preparation must begin "well ahead of any CRQC announcement."

Why Coinbase is speaking up

About one in every twenty bitcoin in circulation sits in Coinbase wallets, held for institutions rather than for the company itself, according to FXLeaders. The firm said it has safeguarded digital assets at scale for more than 13 years, earning the trust of banks, asset managers, hedge funds and other institutions, and it framed the blog post as an application of that custody experience to an emerging risk to the network.

The Bitcoin quantum threat scenario centers on what researchers call a cryptographically relevant quantum computer, or CRQC, a machine with the power to work backward from a public key to uncover the private key and empty a wallet. No such machine exists today, but Google researchers have suggested one could exist by 2029, and some projections cited by CoinDesk put such a device within a few years.

Bitcoin currently relies on two signature methods, ECDSA and Schnorr, which are considered secure against conventional computers because those machines cannot crack the underlying math. The proposed remedy is post-quantum, or PQ, cryptography, meaning new signature methods built to withstand quantum attacks. Bitcoin developers are already weighing proposals to build such defenses, CoinDesk reported.

Coinbase stressed that its post is meant as a contribution to an open discussion rather than a set of instructions or a final company position. "Our goal is to make our needs and concerns visible so they can be weighed alongside everyone else's," the company said, according to Quantum Zeitgeist.

Flexible formats over a single algorithm

According to Coinbase, simply picking a new signature scheme is not enough to answer the Bitcoin quantum threat. The exchange argued that Bitcoin's transaction format should be redesigned so that new post-quantum signature types can be added, replaced or combined over time without rebuilding the whole system, an approach FXLeaders described as layering in quantum-resistant signatures without dismantling what already works.

The company favors output designs that can accommodate multiple PQ signature systems without requiring complete overhauls, rather than locking Bitcoin into a single algorithm that could later be compromised or superseded, Quantum Zeitgeist reported. Coinbase said proposals known as P2MR (BIP-360) and P2TRv2 appear to offer that kind of flexibility. BIP-360 proposes P2MR as a Taproot-like commitment structure with the key path removed and future PQ integration in mind.

In its post, Coinbase listed the characteristics it wants in a PQ-capable Bitcoin path. These include a commitment structure that hides public keys until they are needed and avoids a quantum-vulnerable key path, versioning that assigns a distinct identifier to every supported scheme and parameter set without requiring a new output type for each one, and clearly defined rules covering how keys are revealed, how control blocks and script leaves behave, and how sighashes, malleability and transaction identification are handled. It also called for consensus and policy limits on witness size, script size, verification work and worst-case block cost, plus an address format that wallets, exchanges, hardware devices and payment flows can adopt with little friction.

On evaluation of candidate schemes, the exchange said the process should weigh signature, public-key, secret-key and total-spend sizes, along with verification time, tail latency and batch-verification behavior, since these translate directly into block capacity and user experience. It also wants strong weight given to software that verifies consistently across platforms, avoids leaking secrets through timing, uses clear parameter settings and stays safe even if the random-number generator used during signing fails.

Staged adoption and the state problem

Coinbase supports letting active wallets start using quantum-resistant or hybrid signatures before Bitcoin finalizes its rules for older signature types, so users can protect funds on their own schedule. One transition design it floated is a 1-of-2 construction in which the same coins can be spent either with a traditional ECDSA or Schnorr key or with a post-quantum key, letting users upgrade without forcing everyone to switch at once. It also pointed to PQ-only outputs for early adopters and commit-and-reveal mechanisms that reduce public-key exposure during migration.

The post devotes considerable attention to stateful signature schemes, which require a wallet to track information after each signature so that one-time keys are never reused. Reusing state can be catastrophic and lead to immediate forgery, the company warned, and a signer that restores from an old backup or loses its record could reuse a key without realizing it, exposing itself to theft.

That risk is acute for large operators. Coinbase said exchanges like itself run multiple independent server instances across zones to produce signatures with low latency and high availability, while a stateful scheme would require an exclusive read and write lock on a key during signing, making that independent operation infeasible. If Bitcoin supports stateful schemes, Coinbase said it should also support stateless options that do not require such record-keeping, and it noted that schemes such as SHRINCS demand careful handling of signer state, recovery and implementation assurance to prevent forgery.

Institutions, MPC and dormant coins

For Coinbase and many of its institutional customers, compatibility with multi-party computation signing is an important factor in judging PQ schemes, the company said. MPC, in which key control is split across multiple parties, provides strong protection against key theft and is a standard layer of defense for large organizations under constant attack. Coinbase noted that certain approaches, lattice-based designs among them, could lend themselves to MPC more readily than alternatives, and it framed this as a consideration for scheme selection rather than a request for the Bitcoin community to build a particular MPC protocol.

The thorniest issue raised by the Bitcoin quantum threat is what happens to coins that never move. If Bitcoin eventually limits or ends ECDSA and Schnorr spending, some wallets may not have migrated to PQ-safe outputs by then, including P2PK and other outputs with permanently exposed public keys. Coinbase said it is worth examining whether those users might still be given a way to shift their funds into quantum-safe outputs at a later date, while acknowledging the tradeoffs involved.

Coinbase argued that the contentious question of dormant or late-migrating wallets should be handled separately so it does not delay broader protections, with the discussion proceeding alongside the technical work of adding PQ support. FXLeaders noted that the dormant wallet question is where the exchange pulled back from taking a firm position, and Coinbase itself said such questions, including how to handle abandoned or inaccessible coins, deserve thoughtful debate.

The company also raised the possibility of covert quantum theft, in which someone quietly builds a capable machine and begins draining coins from exposed wallets before the public learns the machine exists. It said proposals should spell out what happens when an owner has no recoverable secret, a proof system fails to scale or a rescue deadline expires.

What Coinbase is doing itself

Beyond publishing design principles, Coinbase said it is contributing engineering resources and participating in the Bitcoin Security Consortium, according to Quantum Zeitgeist. The company said it believes that "making Bitcoin secure against this emerging threat involves more than choosing a quantum-resistant digital signature scheme."

"We want to contribute to the community's efforts and help create the conditions for careful, sustained progress," the company stated. It acknowledged that no single solution will satisfy every constraint and said its aim is to have its concerns weighed alongside those of other stakeholders as the ecosystem begins what it expects to be a multi-year migration.

Conclusion

Coinbase, custodian of about 5% of all bitcoin for institutional clients, has laid out what it wants from a quantum-safe Bitcoin: flexible output formats that accept multiple post-quantum signature schemes, staged adoption through hybrid constructions, stateless options alongside any stateful schemes, MPC compatibility and a separate track for dormant coins. The exchange framed the post as an input to open debate rather than a final position, and said it is putting engineering resources into the effort through the Bitcoin Security Consortium. The next step it points to is community evaluation of candidate schemes and proposals such as P2MR and P2TRv2, work it says must begin well before any cryptographically relevant quantum computer is announced.

Frequently Asked Questions

How much bitcoin does Coinbase hold?

Coinbase holds roughly 5% of all bitcoin in existence, about one in every twenty coins in circulation, on behalf of clients that include banks, asset managers and hedge funds. The company says it has safeguarded digital assets at scale for more than 13 years, which it cites as the basis for weighing in on Bitcoin's quantum security planning.

When could a quantum computer threaten Bitcoin?

No cryptographically relevant quantum computer, or CRQC, exists today. Google researchers have suggested a machine able to work backward from a public key to uncover the private key and empty a wallet could arrive by 2029, and some projections cited by CoinDesk place such a machine within a few years. Coinbase argues preparation must start well ahead of any CRQC announcement.

What is the 1-of-2 transition design Coinbase described?

The 1-of-2 construction would give the same bitcoin two spending paths, one authorized by a classical ECDSA or Schnorr key and the other by a post-quantum key. Coinbase presented it as one possible transition design that would let active wallets adopt quantum-resistant or hybrid signatures before Bitcoin finalizes rules for older signature types, without forcing all users to switch at once.

Why does Coinbase oppose relying only on stateful signature schemes?

Stateful schemes require wallets to track which one-time keys have been used, and reusing state can enable immediate forgery. Coinbase said its servers operate independently across zones, which an exclusive signing lock would make infeasible, and that backups or lost records could cause accidental reuse. It wants stateless options supported alongside any stateful ones.

What does Coinbase say should happen to dormant bitcoin wallets?

Coinbase said the question of dormant or late-migrating wallets ought to be settled on a separate track so it does not hold up broader quantum protections. It suggested considering mechanisms for those users to move funds even after ECDSA or Schnorr spending is limited, while acknowledging the tradeoffs and declining to take a firm position on the issue.