Claims that Coinbase has published a detailed Bitcoin quantum-readiness plan deserve caution. The specific recommendations attributed to the company could not be independently confirmed from an accessible copy of the paper. The broader problem is real: preparing Bitcoin for post-quantum security would involve wallets, transaction rules, custody and difficult decisions about coins that do not migrate. It would take more than choosing a new signature algorithm.
- There is no established quantum attack on Bitcoin today.
- NIST finalized two post-quantum signature standards in 2024; Bitcoin has adopted neither.
- BIP-361 proposes a staged migration, but remains a draft and sets no active deadline.
- A hybrid wallet that still accepts classical signatures would not, by itself, block a quantum attacker.
What quantum computing could put at risk
Bitcoin uses ECDSA and Schnorr signatures to authorize transactions. In theory, a sufficiently powerful quantum computer could derive a private key from its corresponding public key. An attacker with that private key could create a valid signature and try to spend the coins.
That is a future threat model, not evidence that Bitcoin’s cryptography has been broken. No ability to carry out such an attack against Bitcoin has been established, and the risk partly depends on whether a public key has been exposed on-chain.
Exposure varies by output type and use. Some Bitcoin outputs reveal a public key when spent. Taproot outputs, by contrast, include a public key on-chain from the outset. That difference matters to a potential attacker with a sufficiently capable quantum computer. It does not make exposed coins vulnerable to an attack that cannot currently be performed.
What can, and cannot, be confirmed about Coinbase
Several detailed proposals have been attributed to Coinbase, including examining BIP-360 and P2TRv2, testing post-quantum signature algorithms, and considering hybrid wallets for a transition period. But the company’s paper could not be independently verified, so those recommendations should not be described as confirmed Coinbase policy or a finalized plan.
This distinction matters, especially for BIP-360 and P2TRv2. Without verified specifications and an accessible Coinbase paper, it is not possible to responsibly explain how they relate or what precise designs are under discussion. Neither should be mistaken for an adopted Bitcoin upgrade.
One reported idea is a hybrid wallet with two alternative ways to spend: a conventional ECDSA or Schnorr signature, or a separate post-quantum signature. If that description is accurate, the design could give users a migration option. But it would not protect funds from a quantum attacker while the classical spending path remains valid. An attacker able to forge the old signature could use that route. A design requiring both signatures would involve a different trade-off. It could withstand a break in either one, but would depend on both systems working and being implemented securely.
Standards are a starting point, not a Bitcoin upgrade
NIST finalized its first three post-quantum cryptography standards in August 2024. Two relevant digital-signature standards are ML-DSA, based on CRYSTALS-Dilithium, and SLH-DSA, based on SPHINCS+.
Standardization makes these schemes available for evaluation. It does not establish that either one is right for Bitcoin. Developers would still need to assess signature size, verification demands, transaction fees, hardware-wallet support and the changes required to Bitcoin’s consensus rules. Larger signatures could use more block space and put upward pressure on fees during a large migration, though the materials available here provide no comparative Bitcoin performance results or cost estimates. NIST’s post-quantum cryptography project provides more background on this work.
NIST’s announcement said a FALCON-based standard was planned for late 2024. That announcement alone does not confirm the standard’s later status, so FN-DSA should not be treated as a verified recommendation or a confirmed Bitcoin candidate on that basis.
Migration is a wallet and custody problem, too
Any transition would require support from wallet providers, hardware manufacturers, custodians and users. A new signature algorithm is useful only if people can securely create, store and use its keys, and if the network can verify transactions that use it.
Institutional custody adds another layer. Multiparty computation, or MPC, can distribute key control across multiple participants or systems, so no single participant holds the complete key. A post-quantum design for large custodians would need to work safely with those arrangements.
Some signature schemes are stateful, meaning signing devices must track information between operations. If that state is reused or mishandled, security can fail. This concern applies to stateful schemes, not every post-quantum signature. Any implementation would need sound procedures for backups, recovery and coordination across signing systems.
BIP-361 puts the legacy-coin question on the table
BIP-361, titled Post Quantum Migration and Legacy Signature Sunset, is a draft proposal for staged migration and tighter rules for older signature types. Its Phase A would allow 160, 000 blocks, about three years after activation, for migration. Phase B would tighten ECDSA and Schnorr verification two years after Phase A begins.
Those are proposed intervals, not a Bitcoin-wide countdown. BIP-361 has not been activated, and its stages would depend on the proposal being adopted.
The proposal also raises a hard governance question: what happens to coins that do not move? Some may be inaccessible because their owners lost their keys. Others may belong to people who are inactive or deliberately holding for the long term. There is no reliable way to distinguish those cases just by seeing that coins have not moved.
Restricting older spending methods could reduce the risk of future theft. But it could also prevent legitimate owners from spending funds if they cannot migrate in time. Treating lost coins as a minor technical detail would be wishful thinking. Decisions about them could have real consequences for ownership and Bitcoin’s rules.
The Coinbase position attributed in some accounts, which separates technical protections for active wallets from debate over inaccessible coins, could not be confirmed. BIP-361, meanwhile, addresses legacy spending directly. These are competing policy emphases, not evidence of a settled Bitcoin consensus. The proposal has also prompted a security-versus-freedom debate.
Prepare early, but do not manufacture certainty
Planning ahead makes sense. Changes to consensus rules, wallets and custody systems require coordination and testing. But urgency is no reason to rush an upgrade or present a hypothetical threat as a current breach.
Bitcoin has no confirmed post-quantum signature choice, migration deadline or activation plan. The responsible path is to test candidate designs openly, measure their costs under realistic conditions and make the trade-offs clear, especially for users whose coins might not migrate. Quantum preparedness is serious engineering work, not a price-prediction opportunity or a reason to declare Bitcoin already broken.
Key questions and answers
-
Has quantum computing broken Bitcoin?
No. The concern is a future attack requiring a sufficiently powerful quantum computer, not a demonstrated compromise of Bitcoin’s signatures.
-
Has Bitcoin selected a post-quantum signature?
No. NIST finalized ML-DSA and SLH-DSA in 2024, but standardization does not mean Bitcoin has adopted them.
-
Is BIP-361 active?
No. It is a draft proposing migration stages and later restrictions on legacy signatures. Its timetable would begin only if the proposal is activated.
-
Would a hybrid wallet automatically protect coins?
No. If a classical signature remains an alternative spending route, a quantum attacker able to forge it could still use that route.
-
Why are unmoved coins controversial?
Inactive coins may be lost or simply held for the long term. Restricting legacy spending could reduce future theft risk, but might also strand funds their owners cannot migrate.
