Over the past couple of years, people in the crypto world have become increasingly concerned that a sufficiently powerful quantum computer could one day unlock vulnerable Bitcoin, including founder Satoshi Nakamoto’s unmoved coins. In response, some of the largest players in the industry, such as Coinbase, have started putting resources toward solving the potential security issue.
Now Coinbase has gotten more specific. In a blog post published Tuesday, the exchange outlined the particular features it would like to see in a plan to protect Bitcoin from quantum computers. Its wish list:
“We believe a comprehensive transition strategy would ideally protect exposed and newly created funds, fit Bitcoin’s scarce block space, preserve independent resource-bounded validation by full nodes, work in institutional custody, support ordinary wallets, and give the ecosystem a credible migration path for coins that cannot or will not move.”
From there, the company broke its perspective down into seven points. Most notably, Coinbase wants a flexible design that separates the container holding coins from the signature scheme itself, so post-quantum signature systems can be added or swapped out later.
Coinbase would also welcome a staged transition. That would include a 1-of-2 setup in which the same funds could be spent with either a classical key or a post-quantum key, as well as signature schemes compatible with multi-party computation (MPC), the key-splitting technique Coinbase and many of its institutional customers use to guard against theft. The list also covers starting preparations well before a cryptographically relevant quantum computer (CRQC) arrives, keeping a stateless signature option available, robust implementations, and a path for wallets that migrate late.
Satoshi’s Coins Can Wait
One of the more notable aspects of the post is that Coinbase does not think the debate over old, exposed coins needs to be settled before the rest of the work moves forward.
“In our view, legacy funds are best treated as a separate governance and engineering problem,” the post reads.
That category includes coins held in early address types with permanently exposed public keys, as well as other early holdings, including Satoshi’s. Many of these addresses may be tied to private keys that have been lost, so whoever builds the first quantum computer capable of breaking their encryption could potentially claim them as their own.
That has led to a debate over whether bitcoin left in quantum-vulnerable addresses should eventually be frozen. One draft proposal co-authored by Casa co-founder and Chief Security Officer Jameson Lopp, BIP-361, would block sends to vulnerable addresses and later restrict spending from them unless owners use a quantum-safe rescue method.
Coinbase’s quantum advisory board also published a report in June on what should happen to coins that never get moved to quantum-safe addresses, laying out the tradeoffs between freezing them, leaving them alone, and middle-ground approaches without taking a side. The board estimated that roughly 1.7 million bitcoin sit in the oldest vulnerable address type, with about 7 million bitcoin considered vulnerable in total.
For now, Coinbase would simply like to see protection made available to those who are already willing to upgrade.
A Different Approach From the Block Size War
Notably, Coinbase was careful to frame the post as its own views rather than an attempt to steer Bitcoin in one direction or another.
“It is intended as an input to an open discussion, not a set of instructions or a final Coinbase position,” the post reads. “We want to contribute to the community’s efforts and help create the conditions for careful, sustained progress.”
That is a notable change in tone from the block size war of 2015 to 2017, when Coinbase CEO Brian Armstrong was a vocal supporter of alternative Bitcoin software clients that would have raised the network’s block size limit via a hard fork. Coinbase later signed the New York Agreement behind SegWit2x, which critics viewed as a corporate takeover of Bitcoin, and which ultimately failed. Armstrong also wrote in a 2016 email revealed in the Epstein files that Coinbase was “working with a number of the teams behind the scenes to help ensure the protocol keeps scaling (and is not held back by any of the early idealists).”
Interesting email from Coinbase CEO Brian Armstrong to investors found in the Epstein files. It's from February 2016, during Bitcoin's block size debate.
Armstrong talks about how Coinbase is working in the background to ensure the network is not held back by "the early… pic.twitter.com/3MuxKyVhSz
— Kyle Torpey (@kyletorpey) February 1, 2026
Coinbase appears to understand that it is simply one node on a decentralized network. Of course, it is a rather large node. The post notes that Coinbase custodies about 5% of all bitcoin in existence, and the company has also been adding to its own corporate bitcoin holdings through weekly purchases.
The Work Is Already Underway
While Coinbase argues that preparation needs to begin now, Bitcoin developers are not exactly sitting around. The post itself points to much of the work already happening. BIP-360 proposes an output type called Pay-to-Merkle-Root (P2MR), and the public discussion also includes an alternative known as P2TRv2. In August, a StarkWare researcher sent the first quantum-resistant Bitcoin transaction on mainnet, using a method that required no changes to the network’s consensus rules, though it is better viewed as an emergency escape hatch than a full solution.
On the signature front, Coinbase would like an evaluation that includes ML-DSA, SLH-DSA, and FN-DSA, along with SHRINCS, a compact hash-based candidate first proposed by Blockstream Research that combines a stateful path with a stateless SLH-DSA-derived fallback. Coinbase also noted its participation in the Bitcoin Security Consortium, a group of institutions including BlackRock, Fidelity Digital Assets, and Strategy that pledged $15 million over three years in July to support developers and researchers working on Bitcoin’s security. The consortium itself described post-quantum protections as something the Bitcoin technical community is already actively working on.
Coinbase also noted that Bitcoin consensus changes and ecosystem migrations can take years, which is why it wants the process to start now. That is true in normal circumstances, but Bitcoin would also likely be able to move much faster if there were a real emergency situation that had developed. Bitcoin developers also generally reject fear-based protocol changes outside of extreme circumstances and see a hastily added quantum upgrade as a potential security vulnerability in itself.
Is AI or Quantum the Bigger Threat?
More recently, Ethereum Foundation researcher Justin Drake argued in an X post that AI-driven mathematical breakthroughs could break ECDSA, one of the signature schemes used to secure bitcoin private keys and the same one at the center of the quantum concerns, before a quantum computer does. Drake suggested that, in the worst case, this could happen in months rather than years, and he urged holders to calmly move funds to addresses whose public keys have never been revealed.
Coinbase’s head of cryptography Yehuda Lindell and other experts pushed back. Lindell argued that AI’s recent success with difficult math problems says nothing about whether the problems that secure cryptography are actually hard, calling the claim “fear mongering since there’s zero evidence to this capability existing.” He added, “The fact that AI can prove theorems that have been hard does not indicate in any way that problems assumed to be hard are not,” in the same X thread.
