Coinbase’s plan for quantum-secure Bitcoin

Yesterday, Brian Armstrong shared Coinbase’s latest thoughts on preparing Bitcoin for quantum computers.

This is the latest step in an effort started in January, when Coinbase established a independent quantum energy advisory board featuring researchers like Scott Aaronson, Dan Boneh and Justin Drake. In July, he also joined BlackRock, Fidelity, Strategy and others to launch the Bitcoin Security Consortiumwhich pledged $15 million over three years for Bitcoin security research.

Now, Coinbase has presented his vision for what a quantum-secure Bitcoin needs, from new addresses and signatures to a migration plan for existing coins.

Let’s dig.

— (@)

The central idea of ​​Coinbase is to separate the container from the signature, the first being the type of address holding Bitcoin and the second being the method used to unlock it.

Since no one knows which quantum-secure signatures will prove most secure and effective over time, Coinbase is looking for an address design that supports different methods without requiring a redesign every time the cryptography changes.

Coinbase indicates two potential approaches: BIP-360 (P2MR)an upgrade project that would introduce a new type of Bitcoin address designed to reduce exposure to quantum attacks, and P2TRv2another proposed address design that could support quantum-secure signatures.

Both could provide the flexibility Coinbase desires, although neither is a complete solution on its own. The BIP-360, in particular, would still need additional upgrades to support quantum-secure signatures.

Coinbase also offers hybrid addresses, allowing users to spend the same funds using either current or quantum-secure signatures.

But there’s a catch: As long as the old method of spending is still available, these funds remain vulnerable to quantum attacks. Hybrids might ease the transition, but they would not be a permanent solution.

With flexibility being a fundamental principle of address design, the next question is which quantum-secure signatures Bitcoin should use.

Coinbase presents four candidates:

• ML-DSA: A standardized and complete option using lattice-based cryptographya type of mathematics believed to be resistant to quantum attacks, but with large signatures.

• SLH-DSA: Also standardized, using established cryptographic hash functions, but with even larger signatures.

• FN-DSA (Falcon): smaller signatures, but more difficult to implement securely and still awaiting standardization.

• SHRINKS: An experimental design focused on Bitcoin offering smaller signatures but requiring more careful key management.

The biggest compromise is size. Quantum-secure signatures are much larger than today, consuming more block space, potentially reducing transaction capacity and increasing fees.

Coinbase therefore suggests evaluating them on security, cost, speed, hardware wallet compatibility, and time required to migrate the vulnerable BTC.

Another concern is how certain signatures are handled.

Stateful signatures require users to track signing keys they have already used. Reusing one accidentally, perhaps after restoring an outdated wallet backup, I could let someone forge a signature and steal their funds.

So why use them? Efficiency. Stateful signatures can be significantly smaller, potentially reducing fees. But this carries additional risk, which is why Coinbase argues that Bitcoin should also support stateless signatures, which do not require this accounting.

Finally, Coinbase is pushing for signatures that work for institutional custodians, many of which rely on multi-party signing, where control of a private key is distributed among multiple machines.

Some network-based approaches may be better suited to this setup, making compatibility another factor.

Of course, Coinbase has a commercial interest here. As one of the largest custodians of Bitcoin, it wants a solution compatible with its security infrastructure. But given how much BTC institutions hold, their needs matter more broadly to Bitcoin.

Beyond the choice of signatures, Coinbase’s goal is a clear plan to gradually move Bitcoin to quantum-secure addresses.

It describes five potential steps:

1. Early adoption: Allow users to voluntarily move to quantum-secure addresses.

2. Hybrid addresses: Support a gradual transition using current or quantum-secure signatures.

3. Safer migration: Explore ways to keep public keys hidden while funds move, reducing exposure to quantum attacks.

4. New rules: Gradually limit sending Bitcoin to vulnerable addresses and possibly spending from them.

5. Final transition: Decide what happens to coins still in old addresses, whether through a deadline, a freeze, spending limits, or a clawback mechanism.

Coinbase does not endorse any particular outcome. Its priority is to evaluate these options, including the behavior of wallets and non-upgraded nodes, before choosing a final approach.

Then comes perhaps the most controversial question: what happens to the pieces that never move?

Millions of BTC are in older addresses with exposed public keys, including those mined by Satoshi. Some belong to long-term holders; others may be permanently lost.

These coins are prime targets for quantum attacks, especially if someone secretly develops a powerful computer and begins stealing funds before the industry realizes the threat has arrived.

Coinbase does not advocate freezing, saving, or leaving these coins alone. Instead, he calls for separating this debate from the signature upgrade so that disagreements over dormant Bitcoin don’t delay protection for everyone.

For any recovery mechanism, Coinbase sets two conditions:

• It must be quantum secure: Someone with only an exposed public key should not be able to steal coins via recovery.

• It must take into account extreme cases: What happens if an owner lost their recovery information, the system can’t handle the request, or someone misses the deadline?

Ultimately, Coinbase presents its proposal as a contribution to an open discussion and not as a final plan. With no company or developer capable of dictating Bitcoin’s future, reaching agreement within the ecosystem may prove more difficult than developing the crypto itself.