A major custodian with roughly 5% of all bitcoin under its control is now openly asking the protocol’s developers to prepare for the day quantum computers can crack the cryptography that secures the network.
Coinbase has published a detailed set of technical demands aimed at steering Bitcoin toward quantum resistance, marking one of the most significant interventions by a large institutional holder into the protocol’s notoriously slow and conservative upgrade process. The exchange framed its post as an input to public discussion rather than a directive or a final position, but the substance of the proposal reads like a checklist for developers who will ultimately decide how the network evolves.
The timing is deliberate. Coinbase argues that preparation should begin before a cryptographically relevant quantum computer (CRQC) is publicly announced, because changing Bitcoin’s consensus rules and migrating the entire supply of coins to new signature schemes could take years. By the time a CRQC exists, the argument goes, it will be too late to start.
The Technical Core: Hybrid Signatures and BIP-360
At the center of Coinbase’s request is a preference for a hybrid signature scheme, specifically a 1-of-2 construction that would allow the same bitcoin to be spent either by a classical key or by a post-quantum key. The approach is designed to reduce migration risk: users who have not yet moved to quantum-resistant addresses can still spend their coins with legacy ECDSA or Schnorr signatures, while those who have migrated can use new post-quantum algorithms such as ML-DSA, SLH-DSA, or FN-DSA.
The trade-off is an expanded attack surface. Under a 1-of-2 arrangement, an attacker only needs to break one of the two signature schemes to spend the funds. That weakens the security guarantee that quantum resistance is supposed to provide. Coinbase appears to accept this risk on the assumption that classical signatures will remain secure until a CRQC actually arrives, making the hybrid model a bridge rather than an endpoint.
The technical foundation for much of this discussion is BIP-360, a draft proposal that would create P2MR outputs through a soft fork by removing the Taproot key path. Coinbase has expressed support for extensible output types, a design philosophy that would allow new signature schemes to be added or swapped without a complete redesign of Bitcoin’s scripting system. The BIP also references a P2TRv2 design, signaling that the proposal is still evolving.
The Stateful Signature Problem
One of Coinbase’s sharpest warnings concerns stateful signature schemes. These are post-quantum algorithms, such as SLH-DSA, that require the signer to maintain and update a state, often a one-time key, with every signature. If the state is mishandled, the consequences can be severe.
Coinbase described state management as notoriously error-prone, warning that mistakes could even lead to forgery. For a custodian operating signature servers across independent regions, a scheme requiring exclusive locks is not viable. The requirement is a practical one born of operational reality: Coinbase’s infrastructure cannot coordinate a single global state across geographically distributed systems without introducing latency, failure points, or worse.
The exchange’s preferred mitigation is a stateless fallback. It has pointed to candidates such as SHRINCS, a compact hash-based design that pairs a stateful signing path with a stateless backup. The idea is to preserve the efficiency of stateful schemes while retaining a safe recovery path if state management fails. Whether such a hybrid approach can be standardized and deployed across Bitcoin’s ecosystem remains an open question.
MPC Compatibility as an Institutional Requirement
Coinbase also wants at least one quantum-resistant scheme to be compatible with multi-party computation (MPC), which splits signing control across multiple parties. For large custodians, MPC is a core security practice: it reduces single points of failure and makes internal collusion or external compromise far harder.
Coinbase was careful to describe MPC compatibility as a consideration rather than a hard requirement. Still, the signal is clear. A quantum-resistant signature scheme that cannot be used in an MPC setup would be difficult for custodians to adopt at scale, and custodians hold a substantial share of the bitcoin supply. If the goal is to migrate the entire network, the needs of the largest holders cannot be ignored.
Why Coinbase’s Position Matters
Coinbase’s disclosure that it controls roughly 5% of all bitcoin gives its technical preferences unusual weight. That is not a governance stake in any formal sense, Bitcoin has no on-chain voting or foundation with authority over the protocol, but it is a measure of economic exposure. A custodian holding that much bitcoin has both the incentive and the resources to push for a credible quantum-resistance roadmap.
The exchange has been careful to respect Bitcoin’s open governance process. Its post was described as an input to public discussion, not an instruction. That framing matters in a community that is deeply suspicious of institutional influence over protocol development. Bitcoin’s BIP process is open to anyone, but proposals gain traction only through rough consensus among developers, miners, node operators, and users.
Not everyone agrees on the path forward. Charles Hoskinson, the founder of Cardano, has weighed in on BIP-361, a separate proposal that would phase out legacy ECDSA and Schnorr spending. Hoskinson argued that the proposal would effectively require a hard fork, a contentious claim in a community that has long prioritized backward compatibility and soft-fork upgrades. The disagreement illustrates that even among technically literate observers, the roadmap to quantum resistance is far from settled.
The Late-Migrator Problem
One of the most difficult challenges Coinbase’s proposal does not fully solve is the question of late migrators. Bitcoin’s supply includes coins held in dormant wallets, lost keys, and addresses whose owners may not be reachable or may not care about quantum risk until it is too late. If a CRQC emerges, any coin whose public key is exposed on-chain could be vulnerable. Coins in unspent transaction outputs with revealed public keys are particularly at risk.
A soft fork that removes the Taproot key path and introduces new output types would not automatically migrate old coins. Users would need to move their funds to quantum-resistant addresses, and that migration could take years. Coinbase’s emphasis on extensible output types and hybrid spending paths appears designed to reduce friction, but it cannot eliminate the underlying coordination problem. The network can only upgrade as fast as its slowest participants.
Market and Ecosystem Implications
In the short term, the market impact of Coinbase’s proposal is likely to be limited. The message is a technical discussion, not a product launch or a price catalyst. Bitcoin’s price continues to be driven primarily by macroeconomic conditions, ETF flows, and the halving cycle. Quantum resistance is a long-horizon narrative, not a trading signal.
Over the longer term, however, the implications are significant. A successful quantum-resistant upgrade would reinforce bitcoin’s narrative as the most secure asset in crypto, potentially attracting more institutional allocation. A failed or delayed upgrade could expose bitcoin to a quantum risk premium, as investors price in the possibility that the network’s cryptography becomes obsolete. The stakes are existential in the literal sense: if a CRQC arrives before migration is complete, coins with exposed public keys could be stolen, and confidence in bitcoin’s security model could collapse.
The competitive dimension is also worth watching. Other layer-one networks, including Ethereum, are pursuing their own quantum-resistance research. If Bitcoin stalls while competitors advance, the gap could narrow. Coinbase’s intervention may be intended partly to prevent that outcome by raising the urgency of the issue among Bitcoin’s developer community.
Operational and Custody Pressures
Coinbase’s specific technical demands reflect its role as a regulated custodian. Its signature servers operate independently across regions, which rules out schemes requiring exclusive locks. Its compliance obligations demand auditable, reliable signing processes, which makes error-prone stateful schemes unattractive. Its security model relies on MPC to distribute trust, which makes MPC compatibility a practical necessity.
These constraints are not unique to Coinbase. Other large custodians, including exchanges and institutional storage providers, face similar operational realities. If the largest holders converge on a set of requirements, those requirements will shape the design space for any eventual BIP. The risk is that institutional needs could narrow the range of acceptable solutions, but the counterargument is that without institutional adoption, a quantum-resistant upgrade may never achieve the network-wide migration it requires.
A Test of Bitcoin’s Governance
Coinbase’s proposal is ultimately a test of Bitcoin’s governance. The network has no leader, no foundation, and no formal process for weighing the interests of large holders against those of individual users. Changes happen through rough consensus, and consensus is slow. The quantum-resistant upgrade, if it happens, will require coordination across developers, miners, node operators, wallet providers, exchanges, and users.
That process could take years. Coinbase’s message is a reminder that the clock may be ticking. A CRQC has not been announced, and its arrival may still be distant, but the exchange argues that preparation cannot wait until the threat is confirmed. The alternative is a rushed, contested upgrade under the shadow of an active quantum attack, a scenario that would test Bitcoin’s social consensus in ways it has never been tested before.
For now, the conversation is early. BIP-360 is a draft, not a formal proposal. The post-quantum signature schemes under consideration, ML-DSA, SLH-DSA, and FN-DSA, are NIST standards, but their integration into Bitcoin’s consensus rules is far from trivial. The community has time, but not unlimited time. Coinbase’s intervention ensures that the question of quantum resistance is no longer a fringe academic topic. It is now a live issue for the institutions that hold, secure, and depend on the world’s largest cryptocurrency.