Coinbase, Custodian of 5% of Bitcoin (BTC), Proposes Phased Quantum-Security Migration

Update 13:31 UTC: Cardano founder Charles Hoskinson argued that BIP-361, the draft proposing to phase out legacy ECDSA and Schnorr spending, would in practice require a hard fork rather than the soft-fork path the migration framework implies.

Coinbase's October 13 Post-Quantum Paper

Coinbase, which custodies roughly 5% of all existing Bitcoin (BTC), published a technical paper on Tuesday, October 13, urging developers to start preparing now for quantum computing threats, a transition the company expects could take several years. The full recommendations appear on the exchange's official blog and call for flexible transaction designs, stronger wallet protections and a migration process that does not depend on settling every dispute over older coins. The paper lands while Bitcoin (BTC) price action holds the market's wider attention; the exchange framed quantum risk instead as an engineering and coordination problem. Bitcoin today relies on elliptic-curve cryptography, specifically ECDSA and Schnorr signatures, to authorize transactions. A sufficiently powerful quantum computer could theoretically derive private keys from exposed public keys, letting an attacker spend funds without authorization. Coinbase's paper does not claim such a machine exists or that the network's protections have been broken; it treats the threat as a future possibility demanding preparation before the technology arrives. The proposal centers on hybrid wallets built as a 1-of-2 construction, in which users keep authorizing transactions with existing ECDSA or Schnorr signatures while a separate post-quantum key provides an additional spending path. That design would let holders move toward quantum-resistant security without waiting for developers to settle every detail of a future policy on older signatures. The exchange also called for flexible output designs that could accommodate new signature systems without repeatedly redesigning Bitcoin's transaction structure, alongside stronger protections for wallets and institutional custody. Its roughly 5% custody share sits in cold wallet infrastructure across multiple servers and locations, which shapes the paper's institutional requirements. Coinbase presented the document as a contribution to an ongoing development process, not a final decision on Bitcoin's security design.

BIP-360 and the Flexible Output Path

Among the designs worth considering, Coinbase identified BIP-360 and P2TRv2. BIP-360 introduces Pay-to-Merkle-Root, or P2MR, a proposed transaction output type derived from Bitcoin's existing Taproot architecture that removes the key-path spending option, which exposes a public key a future quantum machine could target. The official draft specification describes P2MR as a proposed soft-fork change aimed at long-exposure attacks involving public keys; it does not itself introduce a post-quantum signature algorithm and remains in draft status with no mainnet activation. Coinbase recommended examining post-quantum signature algorithms including ML-DSA, SLH-DSA and FN-DSA once the relevant standards are available, and flagged SHRINCS, a compact hash-based design, as another candidate requiring evaluation. Developers should weigh signature size, processing speed, transaction fees and hardware compatibility, since larger signatures could raise block-space requirements and migration costs. BTQ Technologies demonstrated experimental P2MR transactions, covering address creation, funding, signing and confirmation, on a test network in March; that work did not represent activation on the main chain. On migration, Coinbase proposed a phased system with HD wallet structures and hybrid spending methods so users adopt stronger protections before older signatures are discontinued. New signature systems should stay compatible with multiparty computation, the exchange said, and it warned specifically about stateful algorithms that track information across signing operations, which create forgery risks when large custodians coordinate signing across many servers. Treasury-scale holders, from a corporate Strategic Bitcoin Reserve to exchange custody desks, face the same stateful-signing constraints. The paper also quarantined a separate problem: coins in old wallets that may never migrate, including dormant holdings, lost private keys and Bitcoin (BTC) from the network's earliest years. The related BIP-361 draft, titled Post Quantum Migration and Legacy Signature Sunset, proposes gradually restricting older signatures and has not been activated. Coinbase urged that disagreements over inaccessible funds be discussed independently from the Bitcoin development process, so disputes do not block protections for active wallets.

The scale of the exposed-coin problem now has a number attached. Coinbase's quantum advisory board estimated in April that roughly 6.9 million BTC sit in addresses with exposed public keys, worth about $575 billion at a price of $83,307 per coin. The exchange's own custodied stack, the 5% share referenced in its paper, carries a value above $80 billion at current prices. The blog post also argues legacy funds deserve a governance and engineering track of their own, running in parallel with the signature work, and it lists pay-to-public-key outputs, reused keys, lost keys and Satoshi-era holdings under that banner. On market sensitivity, the exchange flagged covert theft before any machine becomes publicly known as a risk to weigh for legacy coins.

The published document organizes Coinbase's position into seven formal claims, a structure that goes beyond the summary framing already reported. The first claim holds that work should begin now rather than wait for a working quantum machine, since consensus changes and ecosystem migration could take years. Others call for keeping address formats and signature algorithms as separately designed components, and for preserving a stateless-only signing mode if stateful signatures are adopted, on the grounds that reused state can immediately enable forgery and self-custody users cannot reliably track state across updates. Coinbase also asked that at least one evaluated candidate be compatible with multiparty computation, which it described as a key-theft defense for large institutions, without requiring the community to build a specific protocol. The post restated its June quantum risk report, which estimated that roughly 7 million Bitcoin (BTC) have exposed public keys.

The paper, authored by Coinbase analyst Shashank Agrawal under the title "Working Together on Bitcoin's Post-Quantum Readiness," adds a set of constraints the company says must be weighed together rather than solved by picking one signature algorithm: block-space limits, full-node verification capacity, institutional custody requirements, compatibility with retail wallets, and the treatment of funds that cannot be moved. The exchange also cited Google researchers' projection that a cryptographically relevant quantum computer could exist by 2029, a date that frames the multi-year migration window it described. Coinbase argued developers, researchers and other ecosystem stakeholders need to coordinate on these factors in parallel, not sequentially.

Pushback on the legacy-sunset question surfaced after the paper's release. Cardano founder Charles Hoskinson argued that BIP-361, the draft proposing to phase out legacy ECDSA and Schnorr spending, would in practice require a hard fork rather than the soft-fork path the migration framework implies. Coinbase's own custody setup also explains its caution on signing: its signing servers run independently across zones, an arrangement the exchange said a scheme demanding an exclusive lock on each key and its state would make infeasible, and it described state management as notoriously error-prone, with errors potentially enabling forgery.

What the 5% Custody Count Does Not Cover

Our read: both load-bearing documents here are provisional, and the paper's own numbers define its limits. Coinbase's 5% figure counts only holdings in its custody; the migration problem it describes extends to a population that count cannot see. Dormant holdings, lost private keys and coins from the earliest years may sit under legitimate ownership or be permanently inaccessible, and Coinbase argued any recovery mechanism, whether built on wallet seed information, cryptographic proofs or transaction commitments, must stay secure against an attacker holding nothing but an exposed public key. The BIP-360 draft itself states P2MR neither introduces a post-quantum algorithm nor prevents every possible attack. Institutional demand continues regardless: related coverage shows Fidelity's Bitcoin fund took 94% of $109.8 million in daily ETF inflows, and the Coinbase Premium recently slipped back negative. Coinbase set no migration deadline and endorsed no final signature algorithm, leaving both to the open development process.