Bitcoin’s Post-Quantum Migration Is a Planning Debate, Not an Agreed Upgrade
Quantum computing is not breaking Bitcoin today. Preparing for a future threat could still take years of technical work and contentious decisions. Bitcoin Suisse has argued for a staged approach, but no Bitcoin migration plan, signature scheme or timeline has been agreed.
- Bitcoin Suisse, not Coinbase, supports staged preparation in the material that can be verified.
- BIP-360 is a proposal, not an adopted post-quantum solution.
- Some public-key exposures may be more vulnerable than others.
- Whether unmigrated coins should remain spendable is a governance question.
A headline has attributed a case for phased migration to Coinbase, but the underlying publication and its specific recommendations cannot be verified here. The distinction matters. Bitcoin Suisse’s analysis offers useful context, but its views should not be presented as Coinbase’s.
What quantum computing could threaten
Bitcoin uses public-key cryptography to authorize transactions. In principle, a sufficiently capable quantum computer running Shor’s algorithm could derive a private key from its corresponding public key and use it to spend funds. Current quantum computers cannot do this to Bitcoin’s signatures.
The risk varies from one bitcoin to another. With pay-to-public-key (P2PK) outputs, the public key is visible on the blockchain from the start. With pay-to-public-key-hash (P2PKH) outputs, the blockchain initially contains a hash of the public key. The key is revealed when the owner spends. Other output types have their own details, so claims that all BTC are equally exposed miss important distinctions.
Exposure does not mean funds are at immediate risk. The threat depends on a future computer becoming capable of deriving keys quickly enough to exploit exposed public keys. Bitcoin has no adopted post-quantum signature scheme or agreed destination address type for a migration.
BIP-360 is a proposal, not a complete fix
In its Bitcoin’s Quantum Readiness and the Challenge of Shor’s Algorithm analysis, part of Outlook 2026, Bitcoin Suisse argues that readiness may require several soft forks. A soft fork changes Bitcoin’s rules while remaining compatible with software that has not adopted every new feature.
Bitcoin Suisse describes BIP-360 as a candidate for an initial step. The proposal introduces Pay-to-Merkle-Root (P2MR), an output type that removes Taproot’s key-path spending route. That could reduce one kind of long-term exposure to a public key visible in an output. But BIP-360 does not provide post-quantum signatures on its own. Spending through a script path would still rely on existing signature cryptography unless further changes were made.
BIP-360 could be one part of the preparation, but it is not a complete quantum-safe migration. Bitcoin Suisse’s recommendation is not an agreed Bitcoin upgrade, and there is no activation schedule or final choice of post-quantum signature scheme.
The unresolved question of unmigrated coins
Bitcoin Suisse estimates that 1.7 million BTC sit in P2PK outputs it considers unsafe. The firm believes most are lost, including coins commonly attributed to Satoshi Nakamoto. These are estimates, not audited counts. The blockchain shows where coins are held, but cannot prove whether their owners still control the keys. Bitcoin Suisse is a digital-asset firm, but its estimates do not establish ownership of those coins.
Bitcoin Suisse outlines three possible approaches if Bitcoin eventually migrates. The network could leave old coins spendable, make them unspendable after a deadline, or “recycle” their value by burning the coins and reissuing value through a mechanism such as an extended miner subsidy. Recycling remains an underspecified idea, not a ready-made process. It would require contentious rule changes and agreement on how replacement value would be issued.
Each option comes with a cost. Leaving coins spendable could make them targets for a future attacker. A deadline could permanently shut out owners who still hold their keys but fail to migrate in time. Reissuing value would raise difficult questions about who qualifies and how the network could separate rightful claims from opportunistic ones.
Choosing a cryptographic design is an engineering challenge. Deciding whether Bitcoin should invalidate, preserve or reassign access to unmigrated coins is also a dispute over consensus and property rights. That is not a minor implementation detail.
Quantum timelines are forecasts, not deadlines
Bitcoin Suisse reports that roadmaps from unnamed companies point to 2029 to 2030 for a milestone involving hundreds of logical qubits and error rates low enough to run deep circuits. Logical qubits are error-corrected units built from more error-prone physical qubits. Bitcoin Suisse says that milestone would still be insufficient to break ECDSA, a signature scheme used by Bitcoin.
The companies are not identified in the material, so readers cannot readily assess the individual roadmaps behind the estimate. Those dates do not predict that a Bitcoin-breaking quantum computer will arrive in 2029 or 2030. For a separate discussion of quantum timelines and their potential market implications, see Bernstein’s forecast for Bitcoin’s quantum threat.
Bitcoin Suisse argues that planning should start early because agreeing on protocol changes and giving users time to move funds could take years. The firm estimates migration would take at least one year, and ideally several years if unmigrated coins were to be made unspendable. These are the firm’s estimates, not an agreed Bitcoin timetable. The report also does not expect quantum progress to have a strong effect on BTC during 2026. That is a forecast, not a guarantee.
Work on post-quantum preparation is also underway beyond Bitcoin. NIST released three post-quantum cryptography standards in August 2024, following a standardization process that began in 2016. Its National Cybersecurity Center of Excellence is working on ways to help organizations replace vulnerable cryptography. That work covers digital systems generally. It does not select a solution for Bitcoin.
Key questions about Bitcoin’s post-quantum migration
-
Has Coinbase published a specific Bitcoin migration plan?
The claim cannot be substantiated without the underlying publication. The staged approach discussed here comes from Bitcoin Suisse’s analysis.
-
Can quantum computers break Bitcoin today?
Nothing presented here indicates that current quantum computers can break Bitcoin’s signatures. The concern is a future machine capable of carrying out the relevant attacks at sufficient scale.
-
Does BIP-360 make Bitcoin quantum-safe?
No. It proposes removing Taproot’s key-path spending route, but does not introduce post-quantum signatures.
-
Are all bitcoin equally exposed?
No. Exposure depends in part on the output type and whether a public key is visible. Bitcoin Suisse’s estimate focuses on P2PK outputs.
-
What happens to coins that are never migrated?
No policy has been adopted. Leaving them spendable, making them unspendable after a deadline, and reissuing value are options Bitcoin Suisse discusses, not settled Bitcoin rules.
Preparing before a quantum threat becomes urgent makes sense. Pretending the path is already settled does not. Bitcoin will need to make any necessary changes carefully and face the trade-off openly: protecting the network while preserving access for owners who do not migrate in time.
