Coinbase Backs Flexible Designs for Bitcoin's Quantum Upgrade

Coinbase published its priorities for moving Bitcoin to quantum-resistant signatures on October 13, in a blog post written by Shashank Agrawal. The exchange calls the post an input to an open discussion rather than a final position, and it sets no migration deadline and announces no agreed Bitcoin upgrade.

It is intended as an input to an open discussion, not a set of instructions or a final Coinbase position.

If you hold bitcoin, the part that touches you is that the most exposed coins are the ones their owners can no longer move. Coinbase spends much of the post on outputs with permanently exposed public keys, on reused keys, on dormant balances and on funds whose recovery information is gone, and treats that group as a governance problem separate from the engineering.

Coinbase is not a neutral party to this. It says it holds about 5% of all bitcoin in existence and has safeguarded digital assets for more than 13 years, which makes migrating legacy funds a custody problem for the exchange as much as a network one.

Its first stated priority is timing: work should begin well ahead of any announcement of a cryptographically relevant quantum computer, or CRQC, because Bitcoin consensus changes and ecosystem migrations take years.

Separating the Container From the Signature

Coinbase's preferred design keeps the output type separate from the signature scheme, so a post-quantum signature system can be introduced, replaced or supplemented later without a full redesign. It names P2MR, associated with BIP-360, and P2TRv2 as proposals that appear to offer that flexibility.

For wallets that move early, the post floats a 1-of-2 construction: the same funds get two spending paths, one authorized by a classical ECDSA or Schnorr key and one by a post-quantum key. That would let active wallets protect themselves before the community settles what happens to legacy signatures.

It also lists post-quantum-only outputs, such as P2QR, among the options worth evaluating, and wants discussion of how wallets that migrate late could still move their funds if Bitcoin limits or ends classical spending.

Stateful Signatures Need a Stateless Fallback

Coinbase says stateful post-quantum schemes can be smaller and faster, but managing state is error-prone and reusing a signing state can allow forgery. If Bitcoin supports them at all, it wants a stateless option available too. It also says compatibility with multiparty computation, or MPC, matters for its own custody and for its institutional customers.

BIP-360 Is a Draft, and It Draws a Line at Taproot

The proposal Coinbase points to is already written. BIP-360 defines Pay-to-Merkle-Root, or P2MR, as a new output type added by soft fork that works like Taproot but removes the key path spend.

The BIP is blunt about what that buys. P2MR resists long exposure attacks, where a quantum computer reads a public key that has sat on chain for years. Protection against short exposure attacks, where a key is exposed in the mempool while a transaction waits for confirmation, may need post-quantum signatures in Bitcoin, and the document says a separate proposal is intended for that. It also notes that Taproot is not safe against long exposure attacks and is the only activated output type that supports tapscript and script trees.

Bitcoin Optech, which tracks this work, records that BIPs #2198 makes one-path P2MR outputs unsafe, to discourage builders from omitting a post-quantum fallback leaf.

None of it is live. BIP-360 is a draft, and no page confirms a soft fork deployment for any of the proposals named here.

BIP361 Would Sunset ECDSA and Schnorr After Five Years

A rival approach sets a clock. BIP361 would follow the deployment of any post-quantum output type and pre-announce the end of legacy ECDSA and Schnorr signatures. Phase A would disallow sends to quantum-vulnerable addresses. Phase B would restrict ECDSA and Schnorr spends five years after activation.

BIP361 states that as of March 1, 2026, more than 34% of all bitcoin had revealed a public key on chain, and that those coins could be stolen by an attacker with a sufficiently powerful quantum computer. That figure is the argument for a deadline. Coinbase's post is the argument for not setting one yet.

Other chains have moved ahead of Bitcoin here. Tron's post-quantum signatures are already live on a testnet.

The Coins Nobody Can Move

The hardest group is the coins with nobody left to sign. Coinbase lists P2PK outputs with permanently exposed public keys, reused keys, dormant but controlled funds, lost keys, Satoshi-era holdings and the possibility of covert quantum theft.

It says any proposal to rescue or protect those funds must itself be post-quantum safe, and must not be usable by a quantum attacker who only knows an exposed public key. That requirement rules out most of the shortcuts, including anything that lets a new key claim an old output on the strength of a public key alone.

Delaying the Upgrade Has a Cost, Coinbase Argues

Bitcoin Optech notes that quantum-resistant alternatives to ECDSA come with much larger keys and signatures, so most developers seem to prefer to delay upgrading until it is necessary. Coinbase's answer is that waiting for a CRQC announcement leaves too little time to change consensus rules and move coins.

The evaluation set it wants discussed includes ML-DSA, SLH-DSA and FN-DSA when standardized, plus compact candidates such as SHRINCS, whose draft combines a compact stateful FXMSS path with a stateless SLH-DSA-derived fallback. Coinbase adds a warning: generic TLS or PKI rankings do not carry over, because Bitcoin signatures are stored forever and verified by every node.

Its aim stays narrower than a proposal. Put the requirements into the discussion while work on post-quantum signatures continues, with no deadline attached.