Coinbase has called on Bitcoin developers to begin preparing now for potential quantum computing threats, warning in a technical paper published on October 13 that upgrading the Bitcoin network's security could take several years.

The exchange holds roughly 5% of all existing Bitcoin in custody and said it is already preparing its own systems for a post-quantum future. That preparatory work includes ongoing discussions with Bitcoin researchers, contributions to open-source projects, and membership in the Bitcoin Security Consortium.

"We believe it is important to begin preparing well ahead of any CRQC (Cryptographically Relevant Quantum Computer) announcement," Coinbase said. "Bitcoin consensus changes and ecosystem migrations can take years, so it is important that we begin this work now."

Why Bitcoin Faces a Quantum Risk

Bitcoin currently relies on elliptic-curve cryptography, including the ECDSA and Schnorr signature schemes, to authorize transactions. In theory, a sufficiently powerful quantum computer could derive private keys from exposed public keys. The concern traces back to Shor's algorithm, the 1994 result showing that a sufficiently capable quantum computer could solve the mathematical problems on which elliptic-curve signatures rest.

Coinbase did not claim that such a machine exists today. The company described the threat as a future possibility, one that nonetheless requires planning well in advance given how long protocol changes can take. Bitcoin's own upgrade history illustrates the point: SegWit took roughly two years from proposal to activation in 2017, and Taproot close to four years, activating in 2021.

According to the paper, the remedy involves far more than simply picking a new signature algorithm. Developers must weigh trade-offs across transaction fees, block space, wallet support, and the ability of nodes to verify transactions on their own.

Coinbase Backs Flexible Designs and Hybrid Wallets

In the paper, Coinbase pointed to BIP-360 and P2TRv2 as designs worth considering. Both approaches separate the transaction structure from the signature scheme itself, meaning new algorithms could be added, or existing ones replaced, without redesigning the transaction format.

BIP-360 introduces Pay-to-Merkle-Root, or P2MR, which removes Taproot's key-path spending option, the mechanism through which a public key is exposed. The proposal remains in draft status.

The exchange recommended studying post-quantum algorithms such as ML-DSA, SLH-DSA, and FN-DSA once their standards are ready. All three emerge from the U.S. National Institute of Standards and Technology's post-quantum cryptography program, finalized ML-DSA as FIPS 204 and SLH-DSA as FIPS 205 in 2024, with FN-DSA still moving through that process. It also named SHRINCS, a compact hash-based design, as a candidate for review.

For the migration itself, Coinbase described a 1-of-2 hybrid wallet designed to support both current and post-quantum signatures. Under this structure, funds could be spent with either a conventional ECDSA or Schnorr key or a separate post-quantum key.

The company added that any new system should remain compatible with multiparty computation (MPC), a technique large custodians use to protect keys. It also cautioned that stateful signature schemes carry forgery risks if signing records are mishandled, and asked for a stateless option.

Old and Lost Coins Remain an Open Question

The fate of old and lost coins remains unresolved. This category includes dormant wallets, lost keys, and Bitcoin from the network's earliest years. Outputs from that early period, when paying directly to a public key was the standard format, leave that key visible on-chain, which is one reason the era draws attention in these discussions.

A separate proposal, BIP-361, suggests gradually restricting older signatures once a post-quantum option becomes available. It, too, remains a draft and has not been activated.

Coinbase said disputes over these inaccessible funds should be debated in parallel and should not hold up protections for active wallets.

Notably, the paper did not set a migration deadline, endorse a final algorithm, or propose an activation date. Coinbase said its next steps will continue through conversations with researchers, developers, and open-source contributors. In the near term, the draft status of BIP-360 and BIP-361 offers the most concrete marker of how the effort is progressing.

This article is based on reporting by Blockonomi.