Coinbase Urges Bitcoin Quantum Fix as It Holds 5% of BTC

Coinbase favors flexible Bitcoin spending paths

Coinbase favors separating an output’s structure from its signature algorithm, so future cryptographic systems can be added or replaced without rebuilding the entire design. It identifies Pay-to-Merkle-Root, or P2MR, and P2TRv2 as possible frameworks.

An output records the conditions under which coins can be spent. A signature supplies evidence that the spender satisfies those conditions. Changing the output structure and changing the signature algorithm are related decisions, but they are not interchangeable.

The BIP-360 specification remains a draft. It proposes a Taproot-like structure with the direct key-spending route removed, reducing the exposure of public keys while coins remain unspent. Publishing a proposal does not activate it on Bitcoin.

BIP-360 distinguishes long-exposure attacks on publicly available blockchain data from short-exposure attacks during transaction confirmation. Its authors say protection against the latter may require post-quantum signatures, which the current proposal does not introduce.

Coinbase also discusses a 1-of-2 construction, with one classical signature path and one post-quantum path. In that arrangement, either route could authorize spending. It would not require an owner to provide both signatures for every transaction.

That creates an important transition condition: adding a stronger route would not neutralize a broken classical route while both remain usable. Restrictions on legacy signing would still need to fit the chosen design and the threat being addressed.

The public developer discussion examines different combinations of output designs, cryptographic operations and mechanisms for disabling older paths. These are competing engineering options, not a completed community agreement on one implementation.

Bitcoin signatures must fit wallets and block space

Coinbase’s preferences extend beyond mathematical security to implementations that verify consistently across systems, handle signing failures and work with institutional custody. Its 5% custody figure describes customer assets under safekeeping, rather than a disclosed corporate Bitcoin purchase.

The practical question is whether a replacement can be used safely at scale. Larger signatures occupy more transaction space, while additional verification work can raise the resources needed by independently operated nodes. Those costs affect users even when the cryptography is sound.

Migration would also involve wallet software, exchanges and hardware devices that must recognize the same spending conditions. A technically valid output would have limited practical value if a user’s signing device could not authorize it or a receiving service could not identify the address.

NIST’s post-quantum standards already include the ML-DSA and SLH-DSA digital-signature systems, finalized in 2024. Their availability gives engineers standardized candidates to evaluate; it does not automatically make either part of Bitcoin’s consensus rules.

NIST distinguishes these signing systems from ML-KEM, a standard for establishing shared keys. That difference is relevant because Bitcoin needs a way to verify spending authorization, rather than simply encrypt a private communication channel.

NIST’s transition guidance calls for removing quantum-vulnerable algorithms from its standards by 2035, with higher-risk systems moving earlier. That is a standards-policy timeline, not a Bitcoin activation deadline. A decentralized network still needs its own compatible implementation and coordination process; neither NIST nor a custodian can impose that date on Bitcoin holders.

Another distinction is between stateful and stateless signatures. Stateful systems require the signer to track prior use correctly. NIST’s guidance warns that their security depends on careful state management and that they are not suitable for general use.

For a wallet, restoring an older backup can therefore involve more than recovering a secret key. The signing system must also avoid reusing state that was already consumed. Reliable recovery becomes part of the security design.

Coinbase wants a stateless option available if Bitcoin supports stateful signatures. It also favors compatibility with multiparty computation, which distributes signing work rather than entrusting the whole operation to one participant.

Institutional involvement has already included a $15 million Bitcoin Security Consortium commitment. Research funding can support implementation work, but it does not confer authority to change the spending rules of Bitcoin users.

Dormant Bitcoin policy remains unresolved

The paper separates work on new signature support from decisions about dormant, lost or inaccessible coins. Coinbase says those debates can proceed in parallel, rather than prevent active wallets from obtaining future protection.

Dormancy alone does not prove that keys are lost. An owner may deliberately leave funds untouched for years. A rule aimed at exposed coins would therefore have to distinguish technical vulnerability from assumptions about whether anyone can still authorize a transfer.

The potential consequences differ. Freezing an old spending route could block a legitimate owner who has not migrated; leaving it available after its cryptography fails could permit unauthorized spending. Neither outcome is resolved by announcing a new signature algorithm.

Coinbase discusses possible routes for late-migrating wallets but does not select a final rescue policy. It also does not disclose a customer migration deadline, an approved activation mechanism or a firm network rollout date.

Other networks have different upgrade paths. Sui’s planned quantum-safe accounts illustrate a separate approach involving account authentication and recovery-phrase continuity. Its timetable does not establish when Bitcoin could adopt comparable protections.

Alternative.me’s Fear and Greed Index stood at 62 on October 14, versus 57 the previous day, checked at 12:05 UTC. That measures market sentiment, rather than the probability of a quantum breakthrough or support for a proposed upgrade.

The next concrete developments to watch are proposal revisions, reproducible performance results and decisions about how wallets would migrate. Coinbase’s publication adds a large custodian’s requirements to that process; the final cryptographic choices and treatment of legacy funds remain open.