Coinbase has published a list of what it would like to see in bitcoin’s eventual move to quantum-resistant signatures, in a blog post dated 13 Oct by Shashank Agrawal. The exchange says it holds about 5% of all bitcoin in custody, which gives its preferences weight. It calls the post “an input to an open discussion, not a set of instructions or a final Coinbase position”.
What Coinbase is asking for
The concern is a cryptographically relevant quantum computer, or CRQC: a machine large enough to work out a private key from a public one, which would break the signatures bitcoin uses today. I explained why exposed public keys are the weak point in my 7 Oct note on the Europol quantum report, and the basics are in what a quantum attack on bitcoin means.
Coinbase makes seven points. Four carry most of the weight:
- Start before certainty. Consensus changes and migrations take years, so work should begin well ahead of any CRQC announcement.
- Separate the container from the signature. An output type, the format that locks a coin, should let new post-quantum schemes be added or swapped without a redesign. Coinbase names BIP-360, which proposes Pay-to-Merkle-Root (P2MR), and a design called P2TRv2 as candidates.
- Stage the protection. One option is a “1-of-2” coin with two spending paths, one signed with today’s keys and one with a post-quantum key, so active wallets can be protected before the community decides when old signatures stop working.
- Keep a stateless option. Some compact hash-based schemes are “stateful”: the signer must track which one-time keys it has used, and reusing one can allow forgery. Coinbase says that is hard for self-custody users and for an exchange running many signing servers at once.
The other three ask for robust, constant-time implementations, at least one scheme that works with MPC (multi-party computation, where several machines each hold part of a key), and a path for wallets that migrate late.
Where the case holds, and where it is open
The steelman is strong. P2MR, according to its draft, works almost like Taproot but removes the key-path spend, which the authors say makes it resistant to attacks on public keys that sit exposed for a long time. A container that outlives any one signature scheme is a sensible hedge when no post-quantum scheme has a long record inside bitcoin. The 1-of-2 idea lets people move early without forcing a deadline on everyone.
The test is cost and consensus. BIP-360 is still marked “Draft”, and post-quantum signatures are much larger than today’s: an ML-DSA-44 signature is 2,420 bytes, against 64 bytes for a Schnorr signature under BIP-340. That matters in a system with limited block space. Coinbase’s own list of evaluation criteria starts with sizes and verification time. It also leaves the hardest question, what to do with coins whose owners never move, as “a separate governance and engineering problem”. That is honest, and it is also where any bitcoin soft fork tends to slow down.
Other chains are moving in steps too, from Tron’s testnet signatures to Zcash’s January target. Bitcoin’s process is slower by design.
My base case I will call the two-key bridge: more likely than not, bitcoin’s first post-quantum step, when it comes, will be an optional output type with a classical and a post-quantum path side by side, and the question of legacy coins will be argued separately and for longer.
What would change my mind. A BIP-360 move from Draft toward a deployment proposal, or a reference implementation merged in Bitcoin Core, would bring the timeline forward. A public dispute among developers over which signature scheme to pick, or a large custodian rejecting the hybrid design, would push it back.
The bottom line
Coinbase has not proposed a fork. It has told developers what its custody systems need, and its points line up with designs already on the table.
The bottom line: the largest custodian’s wish list favours flexibility over speed, and it leaves the oldest coins for a later and harder debate.
— Alasdair
This article is for information only and is not investment advice.