Coinbase Just Published Bitcoin's Quantum Playbook. It Could Take Years.

On October 13, Coinbase published a technical paper on how Bitcoin should prepare for quantum computers that can break its cryptography. The exchange says it holds about 5 percent of all Bitcoin in custody, worth more than $80 billion at current prices, and it used that paper to deliver a blunt message to Bitcoin's developers: upgrading the network's security will take several years of planning and coordination, so the work has to begin long before anyone announces a cryptographically relevant quantum computer, a CRQC.

The paper is careful about what it does not claim. No quantum computer in existence can break Bitcoin's signatures today. Coinbase described the threat as a future possibility that requires early planning, not an emergency. Its central argument is about scheduling: Bitcoin's consensus changes and wallet migrations historically take years, and that clock only starts when developers agree on a plan.

Why Bitcoin is exposed in the first place

Bitcoin authorizes transactions with elliptic curve cryptography: ECDSA and Schnorr signatures. A future quantum computer running Shor's algorithm could derive a private key from its exposed public key, letting an attacker spend funds. The exposure is not uniform. Ordinary addresses hide the public key behind a hash until first spent, limiting the window of vulnerability. But older pay-to-public-key outputs, reused addresses, and any address whose public key has appeared on chain are exposed permanently, and quantum computers would only need that public half to work with.

That distinction shapes the whole problem. Coins sitting quietly in modern address types are in decent shape for now. Coins in addresses with exposed public keys, the kind that have been sitting untouched since Bitcoin's earliest years, are the ones the paper worries about most.

The toolbox: flexible outputs and new signatures

Coinbase's first recommendation is structural: Bitcoin needs a flexible output type that can introduce, replace, or combine signature schemes without redesigning the transaction format each time. Two candidates are named. BIP-360 proposes Pay-to-Merkle-Root, or P2MR, a transaction output type derived from Bitcoin's existing Taproot architecture that removes the key-path spending option, the part that puts a public key on chain where a future quantum attacker could harvest it. The second is P2TRv2, a proposed successor to Taproot with similar flexibility built in.

BIP-360 is often misdescribed. It is a draft soft-fork proposal that does not itself add a post-quantum signature algorithm or prevent every quantum attack. It creates a container that new signature systems can join later. In March, BTQ Technologies demonstrated experimental P2MR transactions on its own quantum test network, including address creation, funding, signing, and confirmation. That was a testnet experiment, not activation on Bitcoin's main network.

For the signatures themselves, Coinbase pointed at the NIST post-quantum standards, ML-DSA, SLH-DSA, and FN-DSA, once the relevant standards are finalized and implementations mature, and flagged SHRINCS, a proposed compact hash-based design, as needing further evaluation. The evaluation criteria read like an engineering checklist: signature size, verification speed, transaction fees, and hardware compatibility. Size matters because post-quantum signatures are much larger than today's ECDSA signatures, and every byte lands in Bitcoin's limited block space, which is what determines fees. Whatever Bitcoin adopts must also keep full nodes able to verify the chain independently on modest hardware, a non-negotiable property of the network.

Bitcoin's consensus changes take years, so quantum preparation cannot wait for the quantum breakthrough to be announced.

The hybrid wallet: old and new keys side by side

The migration design Coinbase sketched is deliberately staged. Active wallets should be able to adopt quantum-resistant protection before developers settle the harder policy question of what to do about legacy signatures. The proposed mechanism is a hybrid wallet with a 1-of-2 construction: funds could be spent through either the existing ECDSA or Schnorr key, or through a separate post-quantum key. Users move toward stronger security without waiting for every governance dispute to resolve, and early adopters could even opt for post-quantum-only outputs.

Coinbase also flagged two constraints that matter most to institutions. The first is statefulness. Some post-quantum signature algorithms require the signer to track state across signing operations, and reusing that state can enable signature forgery. Large custodians sign across multiple servers and locations, where state can be lost, duplicated, or restored incorrectly. The paper recommends keeping a stateless signing option available alongside any stateful scheme, with clear recovery instructions for wallet providers. The second is compatibility with multiparty computation, the technique that lets several parties or systems jointly participate in signing, which institutional custody setups rely on. Deterministic verification across platforms, constant-time code, and protection against randomness failures in signing round out the implementation requirements.

The 6.9 million BTC problem

The hardest section of the paper concerns coins that may never migrate. Coinbase's independent quantum advisory board estimated in April that about 6.9 million BTC sit in addresses with exposed public keys. At $83,307 per coin, that is roughly $575 billion. The paper sorts these holdings into categories: pay-to-public-key outputs from Bitcoin's earliest years, addresses with reused keys, dormant holdings whose owners may be gone, and coins whose private keys are simply lost. Some of these coins are legitimately owned and simply unmoved. Others are permanently inaccessible.

Coinbase discussed possible recovery approaches, involving wallet seed information, cryptographic proofs, and transaction commitments, but attached a hard constraint: any recovery mechanism must remain secure against an attacker who has access only to an exposed public key. The related proposal BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, sketches a staged migration followed by tighter rules for legacy transactions, but it too is a draft that has not been activated.

Coinbase's governance advice is pointed. Decisions about inaccessible or abandoned funds belong to Bitcoin's governance process, and disagreements over them should not block technical work protecting active wallets. Keep the two tracks separate, it argued: engineer the signatures now, argue about the lost coins in parallel.

What the paper does not do

The October 13 publication sets no deadline for users to migrate, endorses no final signature algorithm, and proposes no activation date. Coinbase framed the paper as a contribution to community debate rather than a final company position, and said its next work would continue through discussions with researchers, developers, open-source contributors, and its participation in the Bitcoin Security Consortium.

The market context explains the timing. Kevin O'Leary said in September that Bitcoin could reach $1 million only if the quantum question gets resolved. Jefferies strategist Christopher Wood dropped a 10 percent Bitcoin position from his model portfolio over quantum concerns. A June report from Swiss custody firm Taurus argued that prices would collapse once a code-breaking machine became known, before any theft took place.

Step back and the paper is best read as infrastructure planning, not a warning shot. Bitcoin has survived a decade and a half by changing slowly and deliberately, and its cryptography is no exception. The threat is real but not imminent, the replacement math exists but is not yet chosen, and the migration will be measured in years. Coinbase's contribution is to start that clock now, with the technical requirements written down, while the luxury of time still exists. In cryptography, as in everything else on Bitcoin, boring and early beats brilliant and late.