Coinbase wants Bitcoin's quantum-resistant wallets designed now because migration takes years

Coinbase said a comprehensive transition strategy should fit within Bitcoin's limited block space and preserve independent validation by full nodes, and highlighted the need for consensus limits on witness and script sizes.

Coinbase encouraged developers to begin preparing before researchers demonstrate a quantum computer powerful enough to break Bitcoin's existing cryptographic signatures.

Coinbase said any proposal to recover or protect legacy funds should itself be post-quantum safe, and would need to address cases in which no recoverable secret exists or a migration deadline expires.

Considerations Coinbase mentioned for legacy funds included outputs with permanently exposed public keys, reused keys, dormant but controlled funds, lost keys, concentrated holdings, and the possibility of covert quantum theft.

Coinbase says it holds approximately 5% of all existing BTC in custody.

The official BIP-360 specification does not independently introduce a post-quantum signature algorithm or prevent every possible quantum attack, and the proposal remains in draft status.

The proposal does not claim that a quantum machine able to break Bitcoin's signatures currently exists or that Bitcoin's cryptographic protections have been broken; Coinbase described the threat as a future possibility.

Coinbase has begun preparing its own custody systems for post-quantum security, including discussions with Bitcoin researchers, engineering contributions to open-source projects and participation in the Bitcoin Security Consortium.

Coinbase expressed caution about stateful post-quantum signature schemes: they can be smaller and faster, but managing state is error-prone and could lead to forgery if state is reused. It recommended that any support for stateful signatures also include a stateless option.

Coinbase called for a Bitcoin-specific signature-scheme evaluation process, with candidates including finalized standards ML-DSA and SLH-DSA, FN-DSA when standardized, and compact alternatives such as SHRINCS.

On October 13, Mysten Labs co-founder Kostas Chalkias announced Sui's first native quantum-safe transaction on Devnet; on October 10, TRON founder Justin Sun said post-quantum cryptography was live on the network's testnet.

BIP-360 introduces Pay-to-Merkle-Root (P2MR), derived from Taproot, and removes Taproot's key-path spending option, which exposes a public key that could become vulnerable to a sufficiently powerful quantum computer.

Coinbase's evaluation criteria for signature schemes included signature and key sizes, verification time, side-channel resistance, key-generation and signing performance, hardware and MPC feasibility, security assumptions and compatibility with hybrid transitions.

Transition options Coinbase listed for evaluation included post-quantum-only outputs, hybrid 1-of-2 constructions, commit/reveal mechanisms, staged policies for new and legacy outputs, and various approaches to limiting or ending classical signature spending.

Coinbase called for flexible transaction designs, stronger wallet protections and a migration process that does not depend on resolving every dispute over older coins.

Coinbase said Bitcoin developers should define possible transition modes before deciding on a final policy for legacy signatures.

The official BIP-360 specification describes P2MR as a proposed soft-fork change intended to protect against long-exposure attacks involving public keys.

Coinbase emphasized that its recommendations remain contributions to an ongoing development process, not a final decision on Bitcoin's future security design.

In a 1-of-2 construction either spending path can authorize a spend, so the classical ECDSA or Schnorr path stays usable until classical spending is limited or ended.

5% of all existing BTC is one coin in every twenty.