On October 13, Coinbase published a long technical post laying out what it would want from a Bitcoin upgrade to quantum-resistant signatures. The author, Coinbase’s Shashank Agrawal, frames it as “an input to an open discussion, not a set of instructions or a final Coinbase position.” Still, it carries weight. Coinbase says it holds about 5% of all BTC in existence, which makes it one of the largest stakeholders in how, and how fast, Bitcoin moves away from today’s signature schemes.
By Wednesday morning in Asia the post was all over X. Cointelegraph summed it up as a call for “a staged, multi-year migration to quantum-resistant signatures,” with lost and Satoshi-era coins left “for a separate debate.” The Block and BSCN picked out the same design preferences: P2MR and P2TRv2.
This article covers what Coinbase actually asked for, what it left open, and what it means for ordinary holders. Nothing has changed on the Bitcoin network yet.
Why a custodian is talking about quantum now
Bitcoin uses elliptic-curve signatures (ECDSA and, since Taproot, Schnorr) to prove ownership. A large enough “cryptographically relevant quantum computer” (CRQC) could in theory work out a private key from a public key that is already exposed. No such machine exists today. The argument is about lead time.
”We believe it is important to begin preparing well ahead of any CRQC announcement,” Coinbase wrote. “Bitcoin consensus changes and ecosystem migrations can take years, so it is important that we begin this work now.”
That is the core of it. Bitcoin soft forks have historically taken years from proposal to activation, and getting millions of wallets, exchanges and hardware devices to move funds takes longer still. If the work only starts once a credible quantum machine is announced, the migration window could be dangerously short.
The seven priorities, in plain English
Coinbase listed seven high-level points. Here they are without the jargon:
- Prepare before certainty. Start design and testing now rather than waiting for a quantum breakthrough.
- Separate the “container” from the signature. Coinbase wants a new output type that lets post-quantum (PQ) signature schemes be “introduced, replaced, or supplemented without a complete redesign.” It names P2MR (BIP-360) and P2TRv2 as designs that appear to offer this. The company describes BIP-360’s P2MR as “a Taproot-like commitment with the key path removed.”
- Staged protection. Active wallets should be able to use PQ-capable or hybrid outputs before the community decides what eventually happens to legacy signatures.
- Be careful with state. Stateful hash-based schemes can be smaller and faster, but Coinbase warns that state management “is notoriously error-prone and could even lead to forgery.” If stateful schemes are supported, it wants a stateless option alongside them.
- Robust implementations. Deterministic, cross-platform verification, constant-time code, and resistance to random-number-generator failures.
- MPC-friendliness. Big custodians split signing across multiple parties with multi-party computation (MPC). Coinbase wants at least one PQ option that works well with MPC.
- A path for late movers. If Bitcoin eventually limits or ends classical signature spending, there should be some thought about how stragglers could still recover their funds.
The 1-of-2 hybrid idea
The most concrete transition proposal in the post is a 1-of-2 construction. The same coins would have two alternative spending paths: one authorized by a classical ECDSA/Schnorr key and one by a post-quantum key.
In practice, users could keep signing normally with small, cheap classical signatures today and still have a quantum-safe path ready if it is ever needed or required. Coinbase says designs such as P2MR and P2TRv2 can support hybrids like this. It also lists other options worth evaluating, including PQ-only outputs for early adopters, commit/reveal schemes that limit public-key exposure during migration, and a staged policy covering new outputs, sends to legacy outputs, and spends from legacy outputs.
Which signature schemes are on the table
Coinbase wants a Bitcoin-specific, reproducible evaluation instead of reusing rankings built for web security. As it puts it, “Bitcoin signatures are stored forever and verified by every node.” Its suggested candidate list includes NIST’s ML-DSA and SLH-DSA, FN-DSA once it is standardized, and compact hash-based designs such as SHRINCS.
The criteria are where Bitcoin’s constraints show up. Coinbase wants each candidate measured on signature and key sizes, verification time, fee cost, full-node and initial-block-download impact, block propagation, and how long and how expensive it would be to migrate a representative set of vulnerable UTXOs. Post-quantum signatures are typically much larger than today’s, so block space is the hard limit in this debate.
The part Coinbase deliberately left open: dormant coins
The most divisive question is what to do about coins that can’t or won’t move. That includes early pay-to-public-key outputs, reused addresses, lost keys, and Satoshi-era holdings. Coinbase’s position is that these funds “are best treated as a separate governance and engineering problem,” and that the debate can run in parallel without holding up work on PQ signatures.
It lists the options without choosing one: sunset, freeze, rate-limiting, “tripwire” mechanisms, or rescue schemes based on seed knowledge or zero-knowledge proofs. It also sets a test for any rescue proposal: the rescue path must itself be quantum-safe and unusable by an attacker who only knows an exposed public key.
That restraint matters. Freezing or “confiscating” unmoved coins would cut against Bitcoin’s property-rights ethos, and an exchange pushing such a plan would draw heavy pushback. By splitting the questions apart, Coinbase is trying to keep the less controversial engineering work moving.
How it fits the wider push
The post did not come out of nowhere. Coinbase has described its own internal post-quantum program, including a PQ version of its key-management system. CoinMarketCap reports that Coinbase co-hosted a post-quantum Bitcoin workshop at Stanford and is one of nine firms behind the Bitcoin Security Consortium, which committed $15 million over three years in July. The Quantum Insider notes that Coinbase accepts no single design may satisfy every user, custodian and institution.
What it means for holders today
For now, very little has to change. Current quantum computers cannot break Bitcoin keys, and any new output type would need the usual open review and soft-fork process. Some basic habits are still worth keeping:
- Avoid address reuse. Funds sitting at addresses whose public keys have never been revealed on-chain are less exposed.
- Keep wallet software and firmware current, so you can use PQ-capable outputs once they exist.
- Be wary of “quantum-safe” token pitches. Real protection for BTC will come through Bitcoin’s own consensus process, not a new coin.
The bigger signal is that one of Bitcoin’s largest custodians is publicly asking for the work to start now, and for it to start with flexibility. Whether the community settles on P2MR, P2TRv2 or something else, the post-quantum migration has become a mainstream conversation.
This article is for informational purposes only and is not financial, investment, or security advice. Do your own research before making decisions about your holdings.
Sources: Coinbase blog · The Block · CoinMarketCap Academy · The Quantum Insider · X posts from Cointelegraph, The Block, BSCN