Coinbase Puts Its 5% Bitcoin Stake Behind a Post-Quantum Upgrade Now
Coinbase published a formal post-quantum protocol position paper on October 13, recommending Bitcoin begin its cryptographic transition now, before a threat exists, using hybrid wallets and flexible output designs.
Coinbase is calling for Bitcoin to start its cryptographic transition before quantum computers become a real threat, and it wants the politically toxic lost-coin debate kept separate so it does not block progress.
Key takeaways
- Coinbase, custodian of roughly 5% of all bitcoin for banks, hedge funds, and asset managers, published a formal protocol position paper on October 13 calling for Bitcoin to begin its post-quantum cryptography transition immediately.
- The exchange recommends decoupling the output container from the signature scheme via BIP-360 or P2TRv2, supporting hybrid wallets that hold both classical and quantum-resistant signature paths simultaneously, and evaluating candidate schemes including ML-DSA, SLH-DSA, FN-DSA, and SHRINCS.
- Coinbase explicitly says the volatile question of what to do with lost or dormant coins should run in parallel, not as a prerequisite, so it cannot hold the signature upgrade hostage.
Coinbase, which custodies approximately 5% of all bitcoin in existence for institutional clients including banks, asset managers, and hedge funds, published a protocol position paper on October 13 calling for Bitcoin to begin preparing for post-quantum cryptography now. The exchange frames the push as input to an open community discussion, not a final position, but the institutional weight behind it is hard to ignore.
The blog post, authored by Shashank Agrawal, puts Coinbase's name formally behind a set of technical recommendations for how Bitcoin should upgrade its signature scheme before a cryptographically relevant quantum computer (CRQC) exists. "We want to contribute to the community's efforts and help create the conditions for careful, sustained progress," Agrawal writes. "Our goal is to make our needs and concerns visible so they can be weighed alongside everyone else's."
What Coinbase Is Actually Asking For
The technical recommendations center on flexibility. Coinbase wants Bitcoin's output format decoupled from the underlying signature algorithm, pointing to BIP-360 (Pay-to-Merkle-Root) and P2TRv2 as candidate designs. That separation lets the signature scheme be swapped without redesigning the output container every time.
On the transition itself, Coinbase recommends a 1-of-2 hybrid approach: wallets that hold both a classical signature path and a post-quantum path simultaneously. Funds stay spendable under either scheme during the migration window. Candidate post-quantum signature algorithms named in the post include ML-DSA, SLH-DSA, FN-DSA, and SHRINCS. Coinbase is also participating in the Bitcoin Security Consortium and supporting open-source engineering on the problem.
The exchange is clear-eyed about the timeline. The post acknowledges that Bitcoin consensus changes and ecosystem migrations can take years. That is not pessimism; it is the historical record. BIP-360 was merged into Bitcoin's official BIP repository in February 2026 and had made no implementation progress in Bitcoin Core as of early 2026.
SegWit and Taproot each took multiple years from concept to activation. The math is uncomfortable given that some estimates place a viable CRQC within a few years, though no such machine exists today.
The Governance Fault Line Coinbase Is Trying to Defuse
The most consequential line in the post is the framing around lost and dormant coins. That debate, which touches Satoshi's holdings and every abandoned wallet from the early years, is politically toxic inside Bitcoin. It has the potential to consume years of mailing-list energy and block the signature upgrade entirely.
Coinbase is explicitly calling for the two tracks to run in parallel. Settle the signature migration first; debate lost coins separately. If the Bitcoin community accepts that framing, the technical path clears considerably. If it does not, the upgrade stalls on a question that has no clean answer and no consensus in sight.
This matters more than it sounds. Coinbase does not custody bitcoin for retail tourists. It holds it for fiduciaries: banks, hedge funds, and asset managers with legal obligations to their clients.
If a CRQC materializes before Bitcoin has a deployed fix, those institutions do not just have a technical problem. They have a liability problem. That institutional skin-in-the-game is what elevates this beyond a cypherpunk whitepaper and puts it on board-room agendas.
For self-custody holders, address reuse is already the first line of defense. Any wallet that has exposed its public key by spending from an address is theoretically in scope for a future CRQC attack. Europol has flagged crypto wallets as a primary quantum attack surface.
The threat window estimates vary widely: Fireblocks Vice President of Research Michael Gutkin has cited public estimates of roughly 6.7 to 7 million BTC sitting behind already-exposed public keys, while other analyses put the near-term at-risk figure far lower. The honest answer is that nobody knows exactly when the window closes.
What to Watch
The near-term signal is whether Bitcoin Core picks up any implementation work on BIP-360 or a competing post-quantum BIP in the next 12 to 24 months. Coinbase's paper does not move code. It moves the conversation.
If Core maintainers and major contributors engage seriously, Coinbase's early-mover framing will look like a catalyst. If the lost-coin debate floods the mailing list and implementation stalls again, the paper becomes a footnote and Bitcoin's upgrade velocity becomes the actual story.
A separate Coinbase blog post from July 2026 by Chief Security Officer Jeff Lunglhofer covered the exchange's internal post-quantum preparations for its own systems. That is a distinct effort from the October protocol position paper, which addresses Bitcoin consensus changes directly.
Sources
Frequently Asked Questions
What is BIP-360 and where does it stand in Bitcoin development?
BIP-360, also called Pay-to-Merkle-Root (P2MR), is a proposed Bitcoin output format designed to separate the address type from the underlying signature algorithm. That separation would let Bitcoin upgrade its signature scheme, including to post-quantum algorithms, without also redesigning how outputs are constructed.
BIP-360 was merged into Bitcoin's official BIP repository on February 13, 2026. As of early 2026, Bitcoin Core had made no implementation progress on it. Whether that has changed since is the key variable to watch.
Which bitcoin holdings are already vulnerable to a quantum attack?
Any wallet that has ever broadcast a spending transaction has exposed its public key on-chain, making it theoretically vulnerable to a CRQC that can derive the private key from the public key. Wallets that have received funds but never spent them (and thus never exposed their public key) are not vulnerable under this attack vector. Estimates of the total BTC behind exposed public keys vary significantly across research sources, which reflects genuine uncertainty about both the quantum timeline and the distribution of wallet types.
What happens to Satoshi's coins if Bitcoin upgrades to post-quantum signatures?
That is the question Coinbase is explicitly trying to defer. If a migration window is set and then closed, coins that did not migrate (including early-mined coins widely attributed to Satoshi) could become unspendable, frozen, or burned depending on how the community structures the policy. There is no consensus position. Coinbase's argument is that debating this question in parallel with the signature upgrade, rather than as a prerequisite, prevents the most politically charged edge case from blocking the entire cryptographic fix.
