Key Highlights
- Coinbase said Bitcoin’s post-quantum transition requires more than a new signature scheme, including compatibility with block-space limits, full-node validation, wallets, and institutional custody.
- The company advocated beginning preparations early and considering flexible output designs such as P2MR (BIP-360) and P2TRv2 to support future signature changes.
- Coinbase raised concerns about stateful post-quantum signatures, citing risks from incorrect state management, and recommended including stateless alternatives.
Crypto exchange Coinbase has outlined technical considerations for transitioning Bitcoin to post-quantum cryptography, arguing that the process will require changes beyond adopting a quantum-resistant digital signature scheme.
In a blog post dated October 13, the exchange said a comprehensive transition strategy should protect exposed and newly created funds, fit within Bitcoin’s limited block space, preserve independent validation by full nodes, accommodate institutional custody, support ordinary wallets, and provide a migration path for coins that cannot or will not move.
Caution regarding post-quantum signature schemes
Coinbase listed several considerations for Bitcoin’s preparation. It said preparation should begin well ahead of any cryptographically relevant quantum computer announcement because consensus changes and ecosystem migrations can take years.
The company favored designs that separate the output “container” from the signature scheme. This could allow one or more post-quantum systems to be introduced or replaced without a complete redesign. It cited P2MR (BIP-360) and P2TRv2 as constructions that appear to offer such flexibility.
Coinbase also said it would support a staged protection in which active wallets could use a post-quantum-capable or hybrid construction before a final policy on legacy signatures is settled. One possible design mentioned was a 1-of-2 construction that provides two alternative spending paths for the same funds, one authorized by a classical ECDSA or Schnorr key and one by a post-quantum key.
The exchange expressed caution about stateful post-quantum signature schemes. While such schemes can be smaller and faster, Coinbase said managing state is error-prone and could lead to forgery if state is reused. It recommended that any support for stateful signatures also include a stateless option.
Other considerations included robust, deterministic, constant-time implementations and the importance of multi-party computation (MPC) friendliness for institutional custody.
Output architecture and signature evaluation
On output and script design, Coinbase said a post-quantum approach should ideally include a commitment structure that hides public keys until they are needed, versioning with unambiguous identifiers for each scheme and parameter set, and clearly defined rules for key revelation.
The company also highlighted the need for consensus limits on witness and script sizes, along with a low-friction address format.
For signature-scheme selection, the company called for a Bitcoin-specific evaluation process. It suggested candidates should include finalized standards such as ML-DSA and SLH-DSA, FN-DSA when standardized, and compact alternatives such as SHRINCS.
Evaluation criteria listed included signature and key sizes, verification time, side-channel resistance, key-generation and signing performance, hardware and MPC feasibility, security assumptions, and compatibility with hybrid transitions.
Transition modes and legacy funds
Coinbase said Bitcoin developers should define possible transition modes before deciding on a final policy for legacy signatures.
Options it listed for evaluation included post-quantum-only outputs, hybrid 1-of-2 constructions, commit/reveal mechanisms, staged policies for new and legacy outputs, and various approaches to limiting or ending classical signature spending.
The company treated dormant, lost, and exposed funds as a separate governance and engineering issue. Considerations mentioned included outputs with permanently exposed public keys, reused keys, dormant but controlled funds, lost keys, concentrated holdings, and the possibility of covert quantum theft.
Coinbase said any proposal to recover or protect legacy funds should itself be post-quantum safe. It also said such a proposal would need to address cases in which no recoverable secret exists, or a migration deadline expires.
Activity on other networks
Other blockchain networks have also taken steps toward post-quantum cryptography.
On October 13, Mysten Labs co-founder Kostas Chalkias announced Sui’s first native quantum-safe transaction on Devnet, linked to a record showing execution at checkpoint 264,197. Sui has added ML-DSA-65 support to its development network.
On October 10, TRON founder Justin Sun said post-quantum cryptography was live on the network’s testnet and could be brought to mainnet when needed. Meanwhile, NEAR Protocol recently stated that its account model supports post-quantum signatures using ML-DSA, with additional wallet and recovery features under development.
Coinbase acknowledged that the transition will involve difficult tradeoffs and that no single solution may satisfy every protocol constraint or meet the needs of all users, custodians, and institutions. The company said it wants its requirements and concerns to be considered alongside those of other participants in the Bitcoin ecosystem.
Also Read: Starknet Introduces Shadow Accounts for Private DeFi Access
