Coinbase Calls for Flexible Bitcoin Quantum-Security Upgrades

Coinbase is urging Bitcoin developers to prepare for quantum-resistant signatures before a cryptographically relevant quantum computer is announced, with designs that can accommodate the signing systems used by large custodians.

The exchange estimates it holds about 5% of all Bitcoin (BTC). It also says changes to Bitcoin’s consensus rules and the later movement of funds could take years, making early planning important.

Coinbase favors an output type that would allow post-quantum signature schemes to be added or replaced without redesigning the system. Options it identified include BIP-360, a draft soft fork that would introduce Pay-to-Merkle-Root outputs by removing Taproot’s key path, and a design called P2TRv2.

The company also outlined a 1-of-2 hybrid design. Under it, the same coins could be spent with either a conventional ECDSA or Schnorr key, or a post-quantum key. That could let active wallets add protection before the network decides how to handle older signature types.

Custody operations influence Coinbase’s concerns about stateful signatures. Its signing servers operate independently across zones, and a scheme requiring an exclusive lock on each key and its state would be infeasible for that setup. Coinbase describes state management in these schemes as error-prone and says mistakes could enable forgery. If Bitcoin adopts stateful signatures, the company wants a stateless fallback.

Coinbase listed SHRINCS, which combines a stateful signing path with a stateless backup, as a candidate for evaluation alongside ML-DSA, SLH-DSA and FN-DSA. It also views compatibility with multiparty computation, which divides signing control among multiple parties, as a factor in choosing schemes. That is a selection consideration, not a request to develop a particular protocol.

Coinbase considers the treatment of dormant or lost Bitcoin a separate governance and engineering question. It also raised whether holders who move late could still migrate their funds after any cutoff for legacy signatures. No cutoff or migration schedule was specified.