Coinbase is developing post-quantum custody safeguards designed to support a wide range of signature schemes, according to the crypto exchange's Head of Cryptography, Yehuda Lindell.

If a cryptographically relevant quantum computer eventually becomes an active threat to Bitcoin's security, Coinbase wants protections already in place—ready for whatever direction Bitcoin and other digital assets take, Lindell said. The concern is grounded in Bitcoin's foundations: the network secures transactions with elliptic-curve signatures, a construction a sufficiently powerful quantum computer could in theory break by deriving private keys from public keys exposed on-chain.

Speaking in a recent appearance on MARA Foundation TV, Lindell told host Isabel Foxen Duke that the company's post-quantum safeguards are being designed to support any potential forms of technical retooling. At present, it remains unclear what kind of post-quantum signature scheme Bitcoin will adopt in practice. Standards bodies have already moved ahead of the chain: the U.S. National Institute of Standards and Technology finalized its first post-quantum signature standards in 2024, spanning lattice-based and hash-based designs.

“It's unlikely that there will be a single signing scheme that everybody will use,” Lindell said, referring to the standards that various networks will ultimately adopt. “That means we have to be prepared and ready for the different outcomes on different blockchains.”

Why Multi-Party Computation Faces a Quantum Problem

Coinbase, which safeguards roughly $250 billion in on behalf of institutions such as BlackRock, has spent years refining its custody procedures. It is now preparing for a world in which a cornerstone of that arrangement becomes more challenging—or even unfeasible in Bitcoin's case: Multi-Party Computation (MPC).

Similar in function to Bitcoin's multi-signature setups, MPC allows different parties to hold distinct “shares” of a private key, enabling multiple signers to execute transactions without exposing whole private keys on a single device. While Bitcoin's native scripting language lets users create multi-signature setups by enforcing quorum rules directly on-chain, MPC operates off-chain using specific cryptographic functions. Because a required quorum of key shares signs each transaction, the complete key is never assembled in one location, effectively eliminating a single point of failure.

As Bitcoin prepares for the post-quantum era, however, experts are increasingly concerned that not all post-quantum signature schemes will be “MPC-friendly.” Hash-based signatures in particular may lack the underlying arithmetic structure that makes traditional cryptographic key-splitting possible. That same lack of mathematical structure is why hash-based signatures are presumed to be secure against quantum threats—but it also makes them difficult to work with when building MPC infrastructure.

“MPC-friendliness or non-MPC-friendliness makes a very big difference,” Lindell explained.

Until recently, executing MPC with hash-based signatures was presumed impossible. Leading cryptographers such as Dan Boneh are now actively researching potential solutions, as detailed in the recent "PRAWNS" paper. The research remains in a highly experimental phase, however, and it is still unclear whether a viable MPC-like scheme can be developed for hash-based signatures.

Concerns about hash-based signatures have also been raised by wallet developers, including Ledger CTO Charles Guillemet.

The Hardware Fallback

If Bitcoin adopts a post-quantum scheme incompatible with MPC, Coinbase is researching a fallback architecture centered on programmable Hardware Security Modules (HSMs)—digital vaults for encrypted keys housed inside private data centers.

Under this arrangement, private keys would be encrypted with post-quantum cryptography and assembled only within the confines of a physically secure HSM. Keeping a complete key in one place—even momentarily—is theoretically less secure than traditional MPC, but an HSM provides strong protection within these constraints. Lindell noted that the rigorous physical side-channel protections and strict code-upload controls support his comfort with the setup.

Given the uncertainty around a potential post-quantum upgrade for Bitcoin, Coinbase is designing its custody architecture to remain agnostic and adaptable to whatever signing scheme Bitcoin adopts in the coming years, Lindell said. Any change to Bitcoin's signature rules would ultimately have to clear the network's consensus process—a bar that has historically taken years to clear—which is why custodians are building for flexibility before a technical direction is set.

The timeline to complete Coinbase's post-quantum security measures remains uncertain. Once complete, however, Lindell added: “I will be able to say, ‘I can support anything.’ We don't have the fear that some blockchain [is going to] decide to use something that we just won't be able to support.”

This article was originally reported by André Beganski, a Senior Content Manager at MARA Foundation who produces content on topics including the intersection of quantum computing and cryptography, and who has previously worked for Decrypt.