Coinbase is calling on Bitcoin developers to begin planning now for a possible future shift to post-quantum security, arguing that any meaningful upgrade would likely take years to coordinate across wallets, nodes, custody systems and transaction formats.

In a technical paper dated Oct. 13, the company said the issue goes well beyond swapping in a new signature scheme. It said developers would need to account for transaction fees, block-space demands, wallet compatibility and the ability of Bitcoin nodes to continue verifying transactions independently. Coinbase did not say Bitcoin is currently broken or that a quantum attacker exists today, but framed the risk as a long-term threat that should be addressed before it becomes urgent.

Why Coinbase says preparation should start early

Bitcoin today relies on elliptic-curve cryptography, including ECDSA and Schnorr signatures, to authorize spending. Coinbase said a sufficiently powerful quantum computer could, in theory, derive private keys from exposed public keys and allow unauthorized spending.

The paper presents that scenario as a future possibility rather than a present failure. Still, Coinbase argued that because consensus changes and large wallet migrations are slow and complex, waiting until researchers demonstrate a practical attack would leave too little time for a coordinated response.

The exchange said it holds roughly 5% of all existing BTC in custody, and added that it has already begun preparing its own custody systems for a post-quantum future through discussions with Bitcoin researchers, contributions to open-source projects and participation in the Bitcoin Security Consortium.

Draft technical paths under discussion

Among the designs Coinbase highlighted are BIP-360 and P2TRv2. BIP-360, also described as Pay-to-Merkle-Root or P2MR, would remove Taproot’s key-path spending option in an effort to reduce exposure of public keys to long-exposure quantum attacks.

According to the paper, BIP-360 remains a draft soft-fork proposal and does not itself add a post-quantum signature algorithm. Coinbase said a flexible output design could make it easier to introduce or replace cryptographic algorithms later without redesigning Bitcoin transaction structures, but only if verification rules, spending permissions and signature identification are clearly defined.

The company also pointed to several post-quantum signature candidates for evaluation, including ML-DSA, SLH-DSA and FN-DSA, with SHRINCS listed as another option needing review. It said developers should compare trade-offs such as signature size, processing speed, fee impact and hardware compatibility, since larger signatures could raise both block-space use and migration costs.

Wallet migration and custody concerns

For the migration itself, Coinbase proposed a phased approach rather than an immediate cutoff. One idea is a hybrid wallet model that supports two spending paths: the current ECDSA or Schnorr method and a separate post-quantum key. In that 1-of-2 structure, users could begin adopting stronger protections before every remaining policy decision is finalized.

The paper said institutional custody introduces additional constraints, especially for systems that rely on multiparty computation. Coinbase flagged concerns around stateful signature schemes, which require information to be tracked across signing operations and could complicate coordination inside custodial infrastructure.

If stateful post-quantum algorithms are considered, the company said a stateless signing option may be preferable, along with clear recovery procedures for managing signing state.

Unresolved policy questions and next steps

Coinbase also called for a separate debate over how migration rules should treat lost Bitcoin, dormant addresses, early-era coins and wallets with exposed keys. It said any recovery or transition method would need to resist attackers who have access only to exposed public keys.

The paper referenced BIP-361, a proposal for post-quantum migration and a gradual sunset of legacy signatures after a post-quantum output system becomes available. But Coinbase stressed that this remains only a proposal, not an activated change.

For now, the company is not endorsing a final algorithm, design or activation date. It said the next step is broader testing under realistic network conditions, including transaction verification, hardware wallet support, fee effects, block propagation and migration timelines, alongside continued discussion with researchers, developers and open-source contributors.

Source: crypto.news