Mentioned in This Article
1. What is Coinbase proposing for quantum computing and Bitcoin?
Coinbase, the largest US crypto exchange, has published a blueprint for protecting Bitcoin (BTC) against future quantum computers, and CEO Brian Armstrong highlighted it in a post on X in October 2026. The plan covers three areas: new address types, new signature schemes, and a staged migration for existing coins. It does not set a deadline or endorse a single final design.
The proposal arrives after months of groundwork. In January 2026 Coinbase formed an independent quantum advisory board whose members include researchers Scott Aaronson, Dan Boneh and Justin Drake. In July it joined BlackRock, Fidelity, Strategy and other firms in launching the Bitcoin Security Consortium, which pledged $15 million over three years to fund research into Bitcoin security.
Quantum computing matters to Bitcoin because the network's ownership model rests on public-key cryptography. A sufficiently powerful quantum machine could, in theory, derive a private key from an exposed public key and spend the coins it controls. No such machine is known to exist today, but the migration of a network as large and decentralized as Bitcoin would take years, which is why planning is starting now.
Public-key cryptography works because certain mathematical operations are easy to perform in one direction and impractical to reverse with classical computers. Bitcoin uses that asymmetry to let anyone verify a signature without learning the private key behind it. Quantum computers running specialized algorithms are expected, at sufficient scale, to weaken that asymmetry, which is why researchers and companies are studying replacement schemes well before the threat is practical.
2. Why should Bitcoin's address design stay flexible?
Coinbase's central design idea is to separate the address, which acts as a container, from the signature method that unlocks what is inside it. Because nobody yet knows which quantum-safe signature will prove best over the long term, the company argues the address format should allow the signature method to be swapped later without another full redesign.
Two candidate address designs are discussed. BIP-360, known as P2MR, is a draft proposal that adds a new address type intended to reduce quantum exposure. P2TRv2 is a proposal that could accommodate quantum-safe signatures. Neither is sufficient on its own, and BIP-360 in particular would need additional upgrades to deliver complete protection.
Coinbase also floats hybrid addresses, which let funds be spent with either today's signature or a quantum-safe one. Hybrids ease the transition because users are not forced to switch overnight. The drawback is that while the old method remains available, the funds stay exposed to a quantum attacker, so hybrids are a bridge rather than a permanent answer.
A useful comparison is the way websites moved from older encryption standards to newer ones. That change was gradual and coordinated, with old and new methods running side by side for years. Coinbase's hybrid proposal borrows the same logic for Bitcoin, where there is the added complication that no company can simply push an update to every user.
Dropping key-path spending, as BIP-360 does, matters because that route is one of the ways a public key becomes visible on the network. Removing it narrows the opening for an attacker, but it does not replace the underlying signature, which is why the proposals are discussed as parts of a larger package.
3. Which quantum-safe signatures are on the table?
With flexibility established as a principle, the company lists four candidates. ML-DSA is a standardized, well-rounded scheme built on lattice-based cryptography, which is believed to resist quantum attacks; its main drawback is large signatures. SLH-DSA is also standardized and relies on hash functions, but its signatures are larger still.
FN-DSA, based on the Falcon scheme, produces smaller signatures, yet it is harder to implement securely and is still awaiting standardization by the US National Institute of Standards and Technology. SHRINCS is an experimental design focused on Bitcoin, offering smaller signatures but demanding more careful key management.
Size is the common trade-off. Quantum-safe signatures are much bigger than the signatures Bitcoin uses today, and every extra byte consumes limited block space. That could reduce how many transactions fit in a block and push fees higher. Coinbase suggests weighing each option against security, cost, speed, hardware-wallet support and the time needed to migrate.
The distinction between signature families helps explain why none of the candidates is an obvious winner. Lattice-based schemes rely on mathematical problems about points in a high-dimensional grid, while hash-based schemes rely only on the security of hash functions, which are among the most studied components in cryptography. The hash-based approach rests on the most conservative assumptions, but it pays for that caution with bulky signatures.
Standardization status is a practical filter. Schemes already standardized have been through years of public scrutiny, while those still awaiting approval or described as experimental carry a higher chance that weaknesses will be found later. For a network that secures large sums and cannot easily reverse a mistake, that caution weighs heavily in the choice.
4. What risks do stateful signatures bring?
Some of the smaller schemes are stateful, meaning users must keep track of which keys they have already used. If a key is reused, for example after restoring a wallet from an outdated backup, an attacker could forge signatures and steal funds.
Stateful signatures can nonetheless be significantly smaller, which keeps fees lower. Because of the added risk, Coinbase argues that Bitcoin should also support stateless signatures, which skip the bookkeeping at the cost of larger size.
Custody is another consideration. Many institutional custodians use multiparty signing, which splits a private key across several machines so no single device holds it entirely. Certain lattice-based approaches may suit this arrangement better than others, making compatibility a criterion in its own right. As one of Bitcoin's largest custodians, Coinbase has an obvious interest in a solution that fits its security infrastructure, and since institutions hold substantial amounts of BTC, their requirements matter to the network as a whole.
The block-space concern is particularly relevant for Bitcoin because its block size is fixed and users already compete for room through fees. Larger signatures would mean each transaction takes up more of that room, so a quantum-safe upgrade could carry an ongoing economic cost for every user, not just a one-time technical change.
5. How would coins move to quantum-safe addresses?
Beyond choosing signatures, Coinbase wants a gradual and transparent path for moving Bitcoin to quantum-safe addresses. It outlines five possible steps. First, users would adopt quantum-safe addresses voluntarily. Second, hybrid addresses would let people transition using either signature type. Third, migration would be made safer by keeping public keys hidden while coins move, reducing exposure.
Fourth, new network rules would gradually restrict sending to vulnerable addresses and, later, spending from them. Fifth, a final transition would decide what happens to coins still sitting in old addresses, through a deadline, a freeze, spending limits or a recovery mechanism.
Coinbase is careful not to back any specific outcome. Its stated focus is on evaluating the options, including how wallets and nodes that have not upgraded would behave while the rules change.
The ordering of the steps reflects a common principle in network upgrades: begin with options people can choose, and add compulsion only after the new tools have proved reliable. Restrictions on old addresses are the most disruptive part, since they would affect holders who have not paid attention to the upgrade, which is why Coinbase places them late in the sequence.
6. What should happen to dormant and lost coins?
The most contentious question is what to do with coins that never move. Millions of BTC sit in older addresses whose public keys are already exposed, including coins mined by Bitcoin's creator, Satoshi Nakamoto. Some belong to active long-term holders, while others may be permanently lost. These coins are the most attractive targets for a quantum attacker, especially one who builds a capable machine in secret.
Coinbase does not advocate freezing them, rescuing them, or leaving them alone. Instead it wants the debate separated from the signature upgrade, so that disagreement over dormant coins does not delay protection for everyone else.
For any recovery mechanism, the company sets two conditions. It must itself be quantum-safe, so that someone holding only an exposed public key cannot steal funds through it. And it must handle edge cases, such as lost recovery information, capacity limits under heavy demand and missed deadlines.
The scale of the issue is what makes it politically sensitive. Freezing coins would override the property rights that many Bitcoin users consider fundamental, whereas leaving them alone would allow a future attacker to take them. Because both positions carry real costs, Coinbase's decision to keep the question apart from the signature work is a procedural choice as much as a technical one.
7. What happens next for Bitcoin's quantum plans?
Coinbase presents the document as a contribution to open discussion rather than a final blueprint. Bitcoin has no central authority, and changes require broad agreement among developers, node operators, miners, exchanges and users. That makes consensus potentially harder to reach than the cryptography itself.
For now, the proposal sets out the vocabulary of the debate: flexible addresses, a short list of candidate signatures, a staged migration and a separate track for dormant coins. Which of those ideas, if any, are adopted will depend on how the wider Bitcoin community responds, and none of the items described in the plan has a scheduled activation date.
Past Bitcoin upgrades, such as the introduction of Taproot, took years from first proposal to activation and required extensive review and signaling. A change touching every address type and signature would almost certainly demand a similar or longer process, which explains why Coinbase frames its contribution as groundwork for that discussion instead of a set of instructions.