Coinbase wants Bitcoin's quantum-resistant wallets designed now because migration takes years

In an October 13 technical paper, Coinbase warned that upgrading Bitcoin's security could take several years, and that consensus changes and wallet migrations often require years of planning and coordination.

Coinbase treated dormant, lost and exposed funds as a separate governance and engineering issue.

Coinbase's independent advisory board supported developing protective technologies while leaving decisions about inaccessible or abandoned funds to Bitcoin's governance process.

Coinbase favored designs that separate the output 'container' from the signature scheme, so one or more post-quantum systems can be introduced or replaced without a complete redesign, and cited P2MR (BIP-360) and P2TRv2 as constructions that appear to offer such flexibility.

Coinbase said it would support a staged protection in which active wallets could use a post-quantum-capable or hybrid construction before a final policy on legacy signatures is settled, for example a 1-of-2 construction with two alternative spending paths for the same funds, one authorized by a classical ECDSA or Schnorr key and one by a post-quantum key.

Coinbase said any proposal to recover or protect legacy funds should itself be post-quantum safe, and would need to address cases in which no recoverable secret exists or a migration deadline expires.

Considerations Coinbase mentioned for legacy funds included outputs with permanently exposed public keys, reused keys, dormant but controlled funds, lost keys, concentrated holdings, and the possibility of covert quantum theft.

The proposal does not claim that a quantum machine able to break Bitcoin's signatures currently exists or that Bitcoin's cryptographic protections have been broken; Coinbase described the threat as a future possibility.

Coinbase expressed caution about stateful post-quantum signature schemes: they can be smaller and faster, but managing state is error-prone and could lead to forgery if state is reused. It recommended that any support for stateful signatures also include a stateless option.

Coinbase called for a Bitcoin-specific signature-scheme evaluation process, with candidates including finalized standards ML-DSA and SLH-DSA, FN-DSA when standardized, and compact alternatives such as SHRINCS.

Developers must consider transaction fees, network capacity, wallet compatibility and the ability of Bitcoin nodes to verify transactions independently.

Coinbase said a comprehensive transition strategy should fit within Bitcoin's limited block space and preserve independent validation by full nodes, and highlighted the need for consensus limits on witness and script sizes.

Coinbase's evaluation criteria for signature schemes included signature and key sizes, verification time, side-channel resistance, key-generation and signing performance, hardware and MPC feasibility, security assumptions and compatibility with hybrid transitions.

Coinbase emphasized that its recommendations remain contributions to an ongoing development process, not a final decision on Bitcoin's future security design.

5% of all existing BTC is one coin in every twenty.

The official BIP-360 specification does not independently introduce a post-quantum signature algorithm or prevent every possible quantum attack, and the proposal remains in draft status.

Coinbase has begun preparing its own custody systems for post-quantum security, including discussions with Bitcoin researchers, engineering contributions to open-source projects and participation in the Bitcoin Security Consortium.

On October 13, Mysten Labs co-founder Kostas Chalkias announced Sui's first native quantum-safe transaction on Devnet; on October 10, TRON founder Justin Sun said post-quantum cryptography was live on the network's testnet.

BIP-360 introduces Pay-to-Merkle-Root (P2MR), derived from Taproot, and removes Taproot's key-path spending option, which exposes a public key that could become vulnerable to a sufficiently powerful quantum computer.

Transition options Coinbase listed for evaluation included post-quantum-only outputs, hybrid 1-of-2 constructions, commit/reveal mechanisms, staged policies for new and legacy outputs, and various approaches to limiting or ending classical signature spending.

Coinbase said Bitcoin developers should define possible transition modes before deciding on a final policy for legacy signatures.

The official BIP-360 specification describes P2MR as a proposed soft-fork change intended to protect against long-exposure attacks involving public keys.

In a 1-of-2 construction either spending path can authorize a spend, so the classical ECDSA or Schnorr path stays usable until classical spending is limited or ended.