Coinbase, which holds 5% of all bitcoin, wants the quantum fix started now

When a user sends bitcoin, their wallet uses the private key to create a digital signature, a tamper-proof stamp. The network checks it against the user's public key; if it matches, the transaction is approved.

The Bitcoin blockchain uses two methods, called ECDSA and Schnorr, to create and verify these digital signatures. These are extremely secure for now because current computers aren't powerful enough to crack the math behind these techniques and reverse-engineer a user's private key from its digital signature or public key.

Enter the quantum risk

A sufficiently powerful quantum computer, one that could exist by 2029, according to Google Researchers, could do just that: reverse-engineer a private key from a public key and drain holders' bitcoin wallets.

Researchers call a machine with that capability a cryptographically relevant quantum computer, or CRQC.

The proposed fix is post-quantum, or PQ, cryptography. In plain English, new signature methods that withstand quantum attacks.

According to Coinbase, just picking a new security method isn't enough. They believe a complete upgrade to protect Bitcoin from quantum computers must secure both old and new funds, fit neatly within Bitcoin's limited data space, and let regular computers keep running the network. It also has to work for both giant crypto platforms and everyday users, while offering a clear plan for older coins that might never move.

Coinbase wants to move now

Such efforts need to begin immediately, largely because Bitcoin’s decentralized design, often praised as an advantage over centralized institutions, also makes implementing changes difficult.

As the exchange put it, "Bitcoin consensus changes, and ecosystem migrations can take years." That's why work needs to start "well ahead of any CRQC announcement."

Bitcoin developers are already considering proposals to build quantum defenses.

Measures proposed by Coinbase

Separating the “container” from the signature

In simple terms, Bitcoin should be designed such that its transaction format can support new post-quantum signature types without needing to rebuild the whole system. That would make it easier to add, replace or combine quantum-resistant signatures over time. Two proposals, P2MR (BIP-360) and P2TRv2, appear to offer this kind of flexibility, Coinbase said.

Staged protection

Coinbase supports an approach that lets active wallets start using quantum-resistant, or hybrid, signatures before Bitcoin finalises its rules for older signature types. One possible transition would be a “1-of-2” setup: the same bitcoin could be spent using either a traditional ECDSA or Schnorr key, or a post-quantum key. This would let users protect their funds earlier, without forcing everyone to switch at once or risking a sudden loss of access.

Use of state

Some post-quantum signature schemes need the wallet to keep track of information, called “state," after each signature. These schemes use many one-time signing keys, and the wallet must remember which ones have already been used so it never reuses one. If a wallet restores from an old backup or fails to save that record, it could accidentally reuse a key.

That can let an attacker forge a valid signature. Stateful signatures can be smaller and faster, but they are easier to misuse. If Bitcoin supports them, Coinbase thinks it should also support stateless options that don't require this record-keeping. This would give users and wallet developers a safer choice and reduce the risk of lost funds or forged transactions.

Robust implementations

Coinbase hopes the evaluation process gives strong weight to software that works reliably across platforms, verifies signatures consistently everywhere, avoids leaking secret information through timing, uses clear settings, and remains safe even if the random-number generator used during signing fails. This would make quantum-resistant Bitcoin wallets more dependable and reduce the risk of bugs, hacks or lost funds.

MPC-friendliness

For Coinbase and many of their customers, post-quantum schemes must work well with multi-party computation, or MPC. When done properly, MPC can help protect private keys from theft and adds an important layer of security for large organizations that face constant attacks on their systems. This would make it easier for exchanges, custodians, and large businesses to secure bitcoin without relying on a single person or device to hold a key.

A path for wallets that migrate late

If Bitcoin eventually restricts or ends ECDSA and Schnorr spending, some people may still have funds in older wallet formats. Coinbase thinks it would be useful to consider whether – and how – those users could move their funds to quantum-safe outputs later. The right approach and its trade-offs are still open questions. This would help prevent some users from being locked out of their bitcoin if they do not upgrade in time. The discussion can happen alongside, and separately from, the technical work to add post-quantum signature support, so it does not need to hold up that work.

Forgotten coins

Lastly, not everyone will upgrade to post-quantum in time, especially wallets that have been long dormant. Some of those belong to people who have lost their keys. Some bitcoin also sits in old address types that have left public keys exposed.

Coinbase is worried that someone could quietly build a quantum machine and start draining coins from these wallets "before the public learns."

The exchange did not take sides on what to do with these coins but said the debate should be handled separately, so it doesn't hold up protection for others. It stressed that any rescue should be quantum-safe, or thieves could exploit the rescue method itself.

1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7
8. 8
9. 9
10. 10