Coinbase's Plan for a Quantum-Safe Bitcoin

Yesterday, Brian Armstrong shared Coinbase's latest thinking on preparing Bitcoin for quantum computers.

It's the newest step in a push that started in January, when Coinbase established an independent quantum advisory board featuring researchers like Scott Aaronson, Dan Boneh, and Justin Drake. In July, it also joined BlackRock, Fidelity, Strategy, and others in launching the Bitcoin Security Consortium, which pledged $15 million over three years toward Bitcoin security research.

Now, Coinbase has laid out its vision for what a quantum-safe Bitcoin needs, from new addresses and signatures to a plan for migrating existing coins.

Let's dig in.

— (@)

Build an Upgrade That Can Change Later

Coinbase's central idea is to separate the container from the signature, the former being the type of address that holds Bitcoin and the latter being the method used to unlock it.

Since no one knows which quantum-safe signatures will prove most secure and effective over time, Coinbase is looking for an address design that supports different methods without requiring a redesign every time the cryptography changes.

Coinbase points to two potential approaches: BIP-360 (P2MR), a draft upgrade that would introduce a new type of Bitcoin address designed to reduce exposure to quantum attacks, and P2TRv2, another proposed address design that could support quantum-safe signatures.

Both could provide the flexibility Coinbase wants, though neither is a complete solution on its own. BIP-360, in particular, would still need additional upgrades to support quantum-safe signatures.

Coinbase also floats hybrid addresses, allowing users to spend the same funds using either today's signatures or quantum-safe ones.

But there's a catch: As long as the old spending method is still available, those funds remain vulnerable to quantum attacks. Hybrids could ease the transition, but they would not be a permanent solution.

Pick the Right Signature

With flexibility established as a core principle of the address design, the next question is which quantum-safe signatures Bitcoin should use.

Coinbase outlines four candidates:

• ML-DSA: A standardized, well-rounded option using lattice-based cryptography, a type of mathematics believed to resist quantum attacks, but with large signatures.

• SLH-DSA: Also standardized, using established cryptographic hash functions, but with even larger signatures.

• FN-DSA (Falcon): Smaller signatures, but harder to implement securely and still awaiting standardization.

• SHRINCS: An experimental Bitcoin-focused design offering smaller signatures but requiring more careful key management.

The biggest trade-off is size. Quantum-safe signatures are much larger than today's, consuming more block space, potentially reducing transaction capacity and increasing fees.

Coinbase therefore suggests evaluating them on security, cost, speed, hardware wallet compatibility, and the time required to migrate vulnerable BTC.

Another concern is how certain signatures are managed.

Stateful signatures require users to track which signing keys they've already used. Accidentally reusing one, perhaps after restoring an outdated wallet backup, could let someone forge a signature and steal their funds.

So why use them? Efficiency. Stateful signatures can be significantly smaller, potentially keeping fees lower. But that comes with additional risk, so Coinbase argues Bitcoin should also support stateless signatures, which don't require this bookkeeping.

Finally, Coinbase is pushing for signatures that work for institutional custodians, many of which rely on multiparty signing, where control of a private key is split across several machines.

Certain lattice-based approaches may be better suited to this setup, making compatibility another factor.

Of course, Coinbase has a business interest here. As one of Bitcoin's largest custodians, it wants a solution compatible with its security infrastructure. But given how much BTC institutions hold, their needs matter to Bitcoin more broadly.

Plan the Transition in Stages

Beyond choosing signatures, Coinbase's goal is a clear plan for gradually moving Bitcoin onto quantum-safe addresses.

It outlines five potential steps:

1. Early Adoption: Let users voluntarily move into quantum-safe addresses.

2. Hybrid Addresses: Support a gradual transition using either current or quantum-safe signatures.

3. Safer Migration: Explore ways to keep public keys hidden while funds move, reducing exposure to quantum attacks.

4. New Rules: Gradually restrict sending Bitcoin to vulnerable addresses and eventually spending from them.

5. Final Transition: Decide what happens to coins still in old addresses, whether through a deadline, freeze, spending limits, or recovery mechanism.

Coinbase isn't endorsing any particular outcome. Its priority is evaluating these options, including how non-upgraded wallets and nodes would behave, before settling on a final approach.

Handle Dormant and Lost Coins Separately

Then comes perhaps the most controversial question: What happens to coins that never move?

Millions of BTC sit in older addresses with exposed public keys, including those mined by Satoshi. Some belong to long-term holders; others may be permanently lost.

These coins are prime targets for quantum attacks, particularly if someone develops a capable computer in secret and begins stealing funds before the industry realizes the threat has arrived.

Coinbase doesn't advocate for freezing, rescuing, or leaving these coins alone. Instead, it calls for separating this debate from the signature upgrade so disagreements over dormant Bitcoin don't delay protection for everyone else.

For any recovery mechanism, Coinbase sets two conditions:

• It must be quantum-safe: Someone with only an exposed public key shouldn't be able to steal coins through recovery.

• It must account for edge cases: What if an owner has lost their recovery information, the system cannot handle demand, or someone misses the deadline?

Ultimately, Coinbase frames its proposal as a contribution to an open discussion, not a final blueprint. With no single company or developer able to dictate Bitcoin's future, reaching agreement across the ecosystem may prove harder than developing the cryptography itself.