Coinbase has urged Bitcoin developers to start preparing for future quantum computing threats, warning that upgrading the network’s security could take several years. In a technical paper published on October 13, the company outlined possible changes to Bitcoin’s transaction system, wallet security and cryptographic signatures.
Coinbase, which says it holds approximately 5% of existing Bitcoin in custody, called for early planning to protect wallets and institutional holdings before quantum computers become capable of breaking Bitcoin’s current cryptographic protections.
The company stressed that this is a future risk, not an attack that has already happened. No quantum computer has been demonstrated to possess the capabilities needed to break Bitcoin’s existing signature system at scale.
Bitcoin currently relies on elliptic-curve cryptography, including ECDSA and Schnorr signatures, to authorize transactions. A sufficiently powerful quantum computer could potentially derive private keys from exposed public keys, allowing an attacker to spend funds without the owner’s permission.
Coinbase said preparing for this possibility involves more than choosing a new signature algorithm. Developers must also consider transaction fees, network capacity, wallet compatibility and the ability of Bitcoin nodes to verify transactions.
The company has identified BIP-360 and P2TRv2 as potential designs worth exploring for a transition to quantum-resistant security. These approaches aim to make Bitcoin’s transaction structure more flexible so developers can introduce new cryptographic systems without repeatedly redesigning the network.
BIP-360 proposes a transaction output type called Pay-to-Merkle-Root, or P2MR. Based on Bitcoin’s Taproot architecture, the design removes the key-path spending option, which can expose a public key that might become vulnerable to a sufficiently powerful quantum computer.
However, BIP-360 does not itself introduce a post-quantum signature algorithm or protect against every possible quantum attack. The proposal remains in draft status and has not been activated on Bitcoin’s main network.
Coinbase said developers should also evaluate signature algorithms such as ML-DSA, SLH-DSA and FN-DSA, along with other experimental designs. Each option needs to be assessed for signature size, processing speed, transaction fees and hardware compatibility.
Larger signatures could increase the amount of data required for transactions, potentially raising costs and creating additional pressure on block space during a large-scale migration.
The company also recommended exploring hybrid wallets that support both existing Bitcoin signatures and future post-quantum authentication methods. One possible design would allow users to authorize transactions through either an existing ECDSA or Schnorr signature or a separate quantum-resistant key.
This could give users a way to adopt stronger protection gradually instead of waiting for every aspect of Bitcoin’s future security policy to be finalized.
Coinbase said institutional custody systems would need special attention during the transition. Many large custodians use multiparty computation, or MPC, which allows several systems or participants to work together when signing transactions.
Some post-quantum signature systems require signing information to be tracked and updated carefully. If that information is lost, duplicated or restored incorrectly, the security of the signing process could be weakened.
Coinbase recommended evaluating stateless signing options where possible and providing clear procedures for managing signing information and recovering from system failures.
The company also called for testing across hardware wallets, transaction verification, network propagation and transaction fees. It said developers need a reliable way to compare different signature systems under realistic conditions before selecting a final approach.
Another major challenge involves Bitcoin held in old or abandoned wallets. Some coins belong to owners who may never move them, while others may be permanently inaccessible because their private keys have been lost.
Coinbase said the technical transition should be considered separately from decisions about how to handle these holdings. Any recovery mechanism would need to prevent attackers from using exposed public keys to claim coins that do not belong to them.
The issue is already being discussed in Bitcoin development proposals. BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, proposes gradually restricting older signature methods after quantum-resistant alternatives become available. However, it remains a draft proposal and has not been activated.
Coinbase argued that disagreements over dormant or inaccessible Bitcoin should not prevent developers from building protections for active wallets. It did not endorse a final policy for handling older coins or establish a deadline for users to migrate.
The company has also been working with Bitcoin researchers and open-source contributors through discussions about post-quantum security. Its latest paper adds recommendations for transaction formats, wallet design and institutional custody, but it does not represent a final decision on Bitcoin’s future security standards.
For now, Coinbase is calling for early preparation rather than an immediate network change. The company said further research and coordination will be needed to determine which cryptographic systems are suitable, how existing wallets can migrate and how Bitcoin can adopt stronger protections without disrupting normal network operations.
