Coinbase Lays Out Post-Quantum Needs for Bitcoin Custody

Coinbase, the custodian holding about 5% of all BTC, published a technical blog on October 13 outlining what it wants from Bitcoin’s move to quantum-resistant security.

Its central point is that choosing a new digital signature scheme is only one piece of the job, since any plan also has to fit Bitcoin’s scarce block space and work for custodians and everyday wallets.

Work to Begin Before Quantum Threat Is Certain

In the blog post, the exchange said it is already preparing its own systems, convening talks with Bitcoin developers and backing open-source work through the Bitcoin Security Consortium.

The company pointed to P2MR, proposed in BIP-360, and P2TRv2 as possible output designs that could accommodate future post-quantum signature systems without requiring a complete redesign each time the cryptography changes.

It also proposed evaluating hybrid arrangements in which a wallet could spend funds through either a conventional ECDSA/Schnorr signature or a post-quantum key during the transition.

Coinbase raised particular concerns about stateful post-quantum signatures. Although these schemes can be smaller and faster than stateless alternatives, reusing signing state can make forgery possible. The company warned that recovering from failed updates or lost state could be difficult for exchanges running multiple signing servers, as well as individuals managing their own wallets.

Its suggested evaluation criteria include signature size, verification speed, transaction fees, full-node workload, hardware wallet compatibility, and multi-party computation, or MPC, which allows parties to produce signatures without relying on one complete private key held in a single place. Coinbase also named ML-DSA, the prospective FN-DSA standard, and SHRINCS as candidates for assessment.

Freeze Proposals and Exposure Estimates Frame the Debate

Wallets that migrate late are the last open item. If Bitcoin eventually limits or ends ECDSA and Schnorr spending, Coinbase wondered whether and how those users could move funds afterward.

The issue is already being considered, with BIP-361, fronted by Jameson Lopp and five other developers, proposing to first restrict sending to quantum-vulnerable addresses and later stop old-style signatures from spending, with an unconfirmed third phase that might let people recover funds after a missed deadline.

The plan has drawn objections that protocol-level freezes cut against censorship resistance and self-responsibility for funds. But in April, BitMEX Research floated a “canary” alternative, where a freeze would trigger only if funds leave a special address whose private key nobody knows, since such a spend would prove a quantum computer exists.