Coinbase Urges Bitcoin Quantum Upgrade Amid Lost-Coin Debate

• Coinbase urges Bitcoin developers to prepare for future quantum threats.
• BIP-360 and P2TRv2 could support new cryptographic protections.
• Larger signatures could increase transaction costs and complicate custody.
• The future of dormant Bitcoin remains unresolved. 

Coinbase is calling for a phased overhaul of Bitcoin’s cryptographic security, arguing that developers should prioritize practical migration tools rather than wait for agreement on how to handle potentially vulnerable, inactive holdings.

In an October 13 paper, Coinbase’s Shashank Agrawal outlined the exchange’s preferred approach to post-quantum preparation, including flexible address designs, alternative signing methods and compatibility with institutional custody systems.

The company’s interest extends beyond research. Coinbase says it safeguards approximately 5% of all Bitcoin in existence, giving it considerable operational exposure to any future change in how transactions are authorized.

Its proposals remain recommendations for community discussion. Bitcoin has not approved a post-quantum signature upgrade, and the paper does not identify an activation date.

Why Bitcoin Needs More Than a New Signature

Bitcoin currently relies on elliptic-curve digital signatures, including ECDSA and Schnorr, to prove that transactions have been authorized by the appropriate private keys.

A sufficiently capable quantum computer could theoretically recover private keys from exposed public keys, undermining that protection.

The risk is not identical for every Bitcoin output.

Some addresses reveal their public keys only when funds are spent. Others, including older pay-to-public-key outputs and certain reused addresses, expose information that an attacker could study for much longer.

This difference is central to BIP-360, a draft proposal introducing Pay-to-Merkle-Root (P2MR).

P2MR resembles Taproot’s script-tree structure but removes its conventional key-path spending option. That change would prevent the output from exposing a vulnerable key through the mechanism used by ordinary Taproot key-path spending.

However, the proposal addresses long-exposure attacks, not every possible quantum attack.

A public key may still become visible when a transaction is broadcast. Protecting against an attacker capable of recovering its private key before confirmation would require post-quantum signatures or other additional safeguards.

Coinbase therefore favors an address architecture that can support multiple cryptographic algorithms without requiring a completely new output design whenever the preferred algorithm changes.

The company also identifies P2TRv2 as an approach worth evaluating.

Hybrid Wallets Offer Flexibility, Not Complete Protection

Coinbase proposes examining transitional wallet designs that combine existing signatures with quantum-resistant alternatives.

One possibility is a one-of-two arrangement in which either a conventional ECDSA or Schnorr signature, or a post-quantum signature, can authorize spending.

This would let wallets adopt new signing technology without immediately abandoning established systems.

The limitation lies in the authorization rule.

If a wallet accepts either signature independently, its conventional spending path remains a potential weakness once quantum attacks become practical. Adding a secure alternative does not eliminate the risk associated with the older one.

A genuinely quantum-resistant end state would therefore require stronger restrictions on vulnerable signing paths.

Coinbase wants the Bitcoin community to evaluate candidates including ML-DSA, SLH-DSA and other emerging constructions before selecting a preferred approach.

The assessment must extend beyond mathematical security to the conditions under which Bitcoin actually operates.

Block Space and Institutional Custody Shape the Decision

Post-quantum signatures can be substantially larger than Bitcoin’s existing signatures.

That creates a network-level constraint: larger transaction witnesses consume block capacity, potentially increasing fees and reducing the number of transfers that fit into a block.

A signature algorithm that performs well in a laboratory may consequently be unsuitable for mass migration if its size or verification requirements place excessive demands on nodes.

Coinbase identifies several practical evaluation criteria:

• Transaction costs: Signature and public-key sizes must be assessed against Bitcoin’s limited block space.
• Node performance: Verification must remain manageable for independently operated full nodes.
• Wallet security: Implementations need safeguards against signing failures, weak randomness and side-channel attacks.
• Custody compatibility: Institutional systems must be able to distribute signing authority without creating operational bottlenecks.

The last requirement is particularly important for Coinbase.

Large custodians frequently use multi-party computation (MPC), distributing key operations across multiple systems rather than relying on a single signing device.

Some post-quantum approaches may be more compatible with this model than others.

Stateful signatures present an additional challenge. They can offer attractive performance characteristics, but certain designs require signers to maintain state that must not be reused.

A failed backup restoration or an unsynchronized signing server could cause accidental state reuse, potentially exposing funds to forgery.

For institutions operating independent signing servers across multiple locations, safely coordinating that state may be difficult.

Coinbase consequently argues that Bitcoin should retain a stateless signing option even if stateful algorithms are supported.

Dormant Coins Could Become Bitcoin’s Hardest Policy Dispute

Technical upgrades can protect wallets whose owners are able and willing to move their funds.

The more contentious question concerns Bitcoin that remains in older, potentially vulnerable outputs.

Some holdings may belong to inactive investors. Others may be inaccessible because their private keys have been lost. Blockchain records cannot reliably distinguish the two categories.

If Bitcoin eventually disables conventional signatures, legitimate owners who have not migrated could lose the ability to spend their coins.

Leaving those signatures valid indefinitely would preserve existing spending rights but could also expose vulnerable holdings to future quantum theft.

Coinbase identifies several possibilities for further discussion, including freezing affected outputs, limiting how quickly they can be spent or developing alternative ways for owners to prove control.

Each involves a different compromise between security and property rights.

The exchange’s Independent Advisory Board previously examined the problem, but Coinbase’s latest paper does not endorse a final policy.

Instead, it argues that the debate should run alongside work on new signature systems rather than become a prerequisite for that work.

What Would Turn the Proposals Into a Bitcoin Upgrade?

The next step is a reproducible evaluation of competing cryptographic designs, including their transaction sizes, verification costs and compatibility with real custody infrastructure.

Any consensus change would still require technical review, implementation and adoption across the Bitcoin ecosystem.

No timeline has been established for completing that process.

For now, Coinbase’s contribution is a set of engineering priorities rather than an upgrade proposal ready for activation. The unresolved issue is whether Bitcoin can introduce stronger signatures early enough to give holders a practical migration path without imposing unacceptable costs on the network.