Mentioned in This Article
1. Why Coinbase Wants Quantum Computing and Bitcoin Work to Start Now
On October 14, 2026, Coinbase published a blog post arguing that Bitcoin's developers and users should begin preparing for quantum computing immediately instead of waiting for a working attack machine to appear. The Nasdaq-listed exchange, which safeguards roughly 5% of all bitcoin for banks, asset managers and hedge funds, recommends flexible signature formats, staged adoption and a separate discussion about dormant coins.
The company frames the matter as one of lead time. No quantum computer capable of breaking Bitcoin's cryptography exists today, but some projections place such a machine within a few years, and the company's position is that the network cannot count on a long warning period. Its post sets out what a sound upgrade would have to accomplish and which design choices it believes should be kept open.
Coinbase's standing makes the document notable. As a custodian serving large institutions, it has a direct interest in the question of whether the assets it holds could one day be exposed, and its clients include the kinds of organizations that ask hard questions about long-term security risk. The post does not announce a product or a specific technical standard. It is a set of principles meant to steer the discussion that Bitcoin developers have already begun.
2. How Do Bitcoin Keys and Signatures Work?
Bitcoin ownership rests on a pair of linked keys. A public key works like the slot on a mailbox: anyone can use it to deposit funds, and it reveals nothing that lets a stranger open the box. The private key is the single key that opens it, and only its holder can authorize spending.
When a user sends bitcoin, the wallet uses the private key to produce a digital signature attached to the transaction. Nodes on the network check that signature against the public key. If the two match, the transaction is accepted; if not, it is rejected. The private key itself is never revealed in this process.
Bitcoin currently relies on two signature methods, known as ECDSA and Schnorr. Both are considered secure today because ordinary computers cannot work backward from a public key or a signature to recover the private key that produced it. The difficulty of that reverse calculation is the foundation on which the ownership of every coin rests.
3. What Is the Quantum Threat to Bitcoin?
A sufficiently powerful quantum computer could perform exactly that reverse calculation. If it could derive private keys from public information, an attacker could forge signatures and move coins out of wallets that belong to someone else. Researchers refer to such a machine as a cryptographically relevant quantum computer, or CRQC. Google researchers have named 2029 as a possible timeframe, which is one reason the topic has moved from academic discussion into practical planning.
The usual remedy is post-quantum cryptography, a family of signature schemes designed to hold up against quantum attacks. Coinbase stresses, however, that choosing a new algorithm is only a small part of the job. A complete upgrade must protect both older and newer funds, fit within Bitcoin's limited block space, allow the network to keep running on ordinary computers, serve large platforms as well as everyday users, and include a plan for coins that may never be moved.
Those requirements pull in different directions. Post-quantum signatures are generally larger than the ones in use today, so each transaction can take up more room on a chain where space is scarce. Any change also has to be adopted by a decentralized community that has no central authority able to order an upgrade, which is why the design details matter so much.
4. Why the Timeline Matters
Bitcoin's decentralized structure is often described as its main strength, but it makes coordinated change slow. Protocol upgrades require broad agreement among developers, miners, node operators, exchanges and wallet makers, and each group moves at its own pace. Coinbase says plainly that consensus changes and ecosystem migrations can take years, and that preparation should begin well ahead of any public announcement that a quantum machine has become capable of an attack.
The argument is essentially about asymmetry. If the work is done early and the threat arrives late, the cost is some engineering effort that proved cautious. If the threat arrives before the work is done, the cost could be the loss of funds held in vulnerable wallets. Bitcoin developers are already weighing several quantum-defense proposals, and the Coinbase post adds an institutional voice to that conversation.
The company also points to the number of parties that must migrate. Individual holders, exchanges, custodians, hardware wallet makers and software developers each have to update their systems, and a transition that depends on all of them cannot be finished in a short window once an emergency is declared.
5. The Design Principles Coinbase Proposes
The first principle is to separate the container from the lock inside it. Transaction formats, Coinbase says, should be able to accommodate new kinds of signatures without the whole system being rebuilt each time. The company cites two proposals, P2MR (BIP-360) and P2TRv2, as examples of designs that offer this flexibility. A format that can carry different signature types lets the network adopt a better scheme later without another overhaul.
The second is staged protection. Wallets that are in active use could adopt hybrid or quantum-resistant signatures before the rules for the older signature types are finalized. One example is a 1-of-2 arrangement, in which a coin can be spent with either a conventional ECDSA or Schnorr key or with a post-quantum key. That gives owners a backup path if one of the two schemes is ever compromised, without forcing everyone to switch at once.
The third concerns state. Some post-quantum schemes require a wallet to keep track of one-time keys that have already been used. Restoring an old backup, or failing to save a record, could cause a key to be used twice, and that reuse can allow forgery. For that reason Coinbase says stateless options should be supported alongside stateful ones, so that ordinary users are not exposed to errors in bookkeeping.
6. Implementation Quality and Institutional Needs
A fourth principle is that the quality of the software matters as much as the mathematics. Coinbase says candidates should be judged on whether the implementation works across platforms, verifies signatures consistently, resists timing leaks, uses clearly defined parameters and stays safe even when the random-number generator fails. A scheme that is sound on paper can still be undermined by a flawed implementation, and a consensus system cannot tolerate nodes that disagree about whether a signature is valid.
The fifth principle addresses large holders. Many institutions use multi-party computation, a technique that splits control of a key among several participants so that no single device or person can move funds alone. It protects organizations from single points of failure. Coinbase says any post-quantum scheme chosen for Bitcoin must work with this approach, since the custodians that secure significant amounts of bitcoin depend on it.
Together these points reflect the company's view that Bitcoin's upgrade has to serve very different users at the same time. A retail holder with a single hardware device and a bank with a distributed signing setup have different needs, and a standard that suits only one of them would leave the other exposed.
7. What Happens to Wallets That Migrate Late?
Coinbase also considers the people who will not upgrade in time. If the network eventually restricts spending under ECDSA and Schnorr, holders of older address formats could be locked out of their own funds. The company suggests that developers consider whether, and by what method, such holders might still move their coins into quantum-safe outputs.
It describes this approach as unresolved and says it can proceed separately from the core technical work. The point is that a recovery path for late movers should not hold up the more urgent job of putting protective formats and signature schemes in place.
The distinction is practical as well as technical. Designing the signature container and the staged adoption path is a question of engineering, while deciding how to treat people who miss a deadline is partly a question of policy and fairness, and the two are likely to move at different speeds.
8. The Separate Question of Forgotten Coins
The most delicate part of the post concerns coins that may never move. Some belong to holders who have lost their keys. Others sit in older address types that expose the public key, which makes them easier targets for a future quantum attacker. Coinbase worries that someone could build a capable machine and quietly drain such wallets before the public learns it exists.
On what should happen to those coins, the company takes no position. It argues instead that the debate should be kept apart from the rest of the upgrade so that it does not delay other protections. It adds that any mechanism designed to rescue such funds must itself be quantum-safe, or it could become an opening for exploitation.
The question touches on a core Bitcoin principle, that no one can seize or freeze another person's coins. Any proposal that treats dormant balances differently would therefore raise philosophical objections in addition to technical ones, which is part of why Coinbase wants the argument conducted on its own track.
9. What Comes Next for Quantum Planning
The post does not set a deadline or call for a vote, and Coinbase does not claim that its principles settle any of the open proposals. What it offers is a framework, backed by an exchange that holds a large share of the supply, for judging them. Bitcoin developers are already discussing quantum-defense proposals, and the contest between competing designs is likely to continue over the coming months.
For holders, the immediate message is not a call to act but a reason to follow the debate. Whatever formats the network eventually adopts, the post suggests that the transition will be gradual, will favor wallets that can support new signature types, and will leave the fate of dormant coins as a distinct and contested issue.