Bitcoin's post-quantum shift: what Coinbase needs

Coinbase has published a list of what it wants from Bitcoin's move to signatures that could survive a future quantum computer, Unchained reported on 2026-10-14. The exchange says it holds roughly 5% of all BTC, and much of its list comes from how a big custodian signs transactions day to day. This article looks at the output types and signature schemes on the table, and why custody shapes the choice.

The change in one paragraph

Bitcoin coins are locked today by ECDSA or Schnorr keys. A cryptographically relevant quantum computer, or CRQC, would be a machine able to work out a private key from a public key that has been exposed. Coinbase argues that the network should start preparing before any such machine is announced, because changes to consensus rules, and the coin migrations that follow them, can take years. Its post, according to Unchained, is framed as input to an open discussion rather than instructions or a final company position.

Coinbase summed up its timing view this way: "We believe it is important to begin preparing well ahead of any CRQC announcement".

Under the hood: outputs, keys and signatures

Every bitcoin sits in an output, a small record that states which conditions must be met to spend it. A post-quantum upgrade has to change two things: the shape of those outputs and the signature schemes they accept. Coinbase's preferences touch both.

• Swappable design: Coinbase favours an output type where new post-quantum schemes can be added or replaced later without redesigning the whole system.
• BIP-360: a draft soft fork that removes the Taproot key path to produce a new output called Pay-to-Merkle-Root, or P2MR. Coinbase also pointed to a separate design called P2TRv2.
• Hybrid keys: a 1-of-2 arrangement where one set of coins accepts a post-quantum key as well as a classical ECDSA or Schnorr key, and either one can unlock them.
• Scheme candidates: SHRINCS, a compact hash-based draft, plus ML-DSA, SLH-DSA and FN-DSA.

Why drop the key path? In a Taproot output, the key path lets a coin be spent with a single signature from a public key that is visible on the chain. That visible key is exactly what a quantum attacker would target. A Merkle root, by contrast, is a hash that commits to a tree of spending scripts. Only the script actually used is revealed at spending time, and a hash gives a quantum machine far less to work with than a public key.

The hybrid idea solves an ordering problem. A wallet can add a post-quantum key now and keep spending with its classical key, while the network is still deciding what happens to older signature types. If the classical path is ever switched off, the post-quantum path is already in place.

Why a custodian cares about signing state

Signature schemes come in two families. A stateful scheme uses a key that can sign only a limited number of times, so the signer must keep a running record, or state, of which one-time parts have been used. Signing twice with the same part can leak enough to let someone forge a signature. A stateless scheme needs no such record. Stateful schemes can be smaller and faster, but Coinbase warned that tracking state is error-prone and could even enable forgery.

The problem is sharper for a firm of Coinbase's size. According to Coinbase, its signing machines operate on their own in separate zones. Coinbase said a scheme that needs an exclusive lock on every key and its state would be infeasible for its setup. So if Bitcoin adopts a stateful scheme, Coinbase wants a stateless fallback. SHRINCS, one of the schemes Coinbase named, already pairs a stateful path with a stateless backup.

Coinbase also wants at least one scheme that looks workable with multi-party computation, or MPC, where several parties share control over signing. It stressed that this is a factor in choosing a scheme, not a request that developers build a specific MPC protocol.

Who is affected

Custodians and exchanges would have to rebuild signing systems around whichever scheme wins. Wallet developers would need to support new output types and, possibly, hybrid keys. Holders would eventually move coins into new outputs.

The hardest group is people who move late, or never. Coinbase asked developers to consider whether slow holders would keep a way to move their coins once old-style signatures stop being accepted, and said dormant and lost coins should be handled as their own governance and engineering problem. That point is already contested. Charles Hoskinson, who founded Cardano, has said BIP-361, a draft that would retire old ECDSA and Schnorr spending, would effectively need a hard fork, meaning a rule change that nodes must all adopt to stay on the same chain.

Status and next steps

Nothing has been decided. BIP-360 and BIP-361 are drafts, and the scheme candidates are still to be evaluated. Coinbase's post adds one large holder's requirements to that debate. The risk it points to is timing: Unchained noted that Google researchers described earlier this year how a fast quantum machine might go after bitcoin transactions while they wait to be confirmed, a window of minutes.

Sources

• Unchained, 14 Oct 2026

AI wrote this summary from the primary documents and reports cited above. It went live automatically after checks that figures match those sources and nothing is copied; there was no human review. It explains a protocol or rule change and is not investment advice.