Coinbase published a position paper on October 13 outlining a multi-year migration path for Bitcoin's cryptographic infrastructure to withstand quantum computing attacks. The exchange, which custodies approximately 5% of all Bitcoin in circulation, endorsed BIP-360's Pay-to-Merkle-Root (P2MR) add...
"Their inaction creates a systemic risk and a negative externality for the rest of the network." — Coinbase Independent Advisory Board on Quantum Computing and Blockchain, June 2026
Coinbase published a position paper on October 13 outlining a multi-year migration path for Bitcoin's cryptographic infrastructure to withstand quantum computing attacks. The exchange, which custodies approximately 5% of all Bitcoin in circulation, endorsed BIP-360's Pay-to-Merkle-Root (P2MR) address format and proposed hybrid wallets combining existing elliptic-curve signatures with post-quantum authentication. The paper does not set deadlines or announce protocol changes; it frames the discussion around engineering trade-offs that Bitcoin developers must resolve before quantum hardware matures.
The timing is deliberate. In March 2026, Google Quantum AI published resource estimates showing that breaking Bitcoin's secp256k1 elliptic-curve cryptography would require fewer than 500,000 physical qubits — a 20x reduction from prior benchmarks. IBM, Quantinuum, and Microsoft now project fault-tolerant quantum machines by 2029. Glassnode data from May 2026 places 6.04 million BTC (30.2% of circulating supply) in addresses with exposed public keys. The clock is ticking, and no top-20 blockchain has post-quantum algorithms running on mainnet.
The paper, published on the Coinbase blog on October 13, 2026, is framed as "an input to open discussion" rather than a final company position. Its core argument: Bitcoin's transition to quantum-resistant cryptography is a complex, multi-year undertaking, and preparation must begin before the threat materializes — not after.
Coinbase identifies BIP-360 and P2TRv2 as the most promising soft-fork transaction output designs for introducing post-quantum signature schemes. Both proposals offer flexibility to accommodate different quantum-resistant algorithms over time, avoiding a lock-in to any single cryptographic standard.
The paper recommends hybrid wallets — a 1-of-2 construction supporting both existing Bitcoin signatures and future post-quantum authentication. This approach allows incremental migration without forcing an immediate network-wide upgrade. Coinbase emphasizes that any replacement signature scheme must support stateless signing, a requirement for institutional custody operations where key material is distributed across hardware security modules.
Coinbase backs its paper with an Independent Advisory Board on Quantum Computing and Blockchain, convened in June 2026, comprising researchers from Stanford, UT Austin, UC Santa Barbara, Bar-Ilan University, the Ethereum Foundation, and Eigen Labs. The board's June report identified approximately 20,000 public keys directly exposed in P2PK addresses, corresponding to roughly 1.7 million BTC.
Glassnode published an analysis in May 2026 that provides the most granular breakdown of Bitcoin's quantum exposure:
| Category | BTC Exposed | % of Supply | |---|---|---| | Structural exposure (P2PK, unhashed keys) | 1.92M | 9.6% | | Operational exposure (address reuse, poor hygiene) | 4.12M | 20.6% | | Total exposed | 6.04M | 30.2% | | Secure supply | 13.99M | 69.8% |
Structural exposure is protocol-level: Pay-to-Public-Key (P2PK) scripts write raw public keys directly into locking scripts. An estimated 1.1 million BTC attributed to Satoshi Nakamoto sit in these early P2PK addresses with public keys permanently visible on-chain. An additional 620,000 BTC from early network participants and roughly 200,000 BTC in modern Taproot outputs carry similar structural exposure.
Operational exposure is behavioral. When users spend coins from an address, the unlocking script reveals the public key. Any remaining balance at that address is then exposed to at-rest attacks permanently. Exchange holdings account for approximately 1.66 million BTC of this category. Glassnode noted that centralized exchange quantum safety metrics declined from 55% to 45% between 2018 and mid-2026, indicating deteriorating address rotation practices across major platforms.
Government-seized wallets show 0% exposure (99.8% safety metrics), reflecting strict key management. At the other end, fixed-address custodial platforms register 100% exposure. Advanced platforms implementing hierarchical deterministic (HD) wallets maintain below-5% exposure rates.
Three data points define the current threat horizon:
Google Quantum AI (March 2026): A white paper co-authored with researchers from the Ethereum Foundation and Stanford estimated that breaking secp256k1 requires approximately 1,200 logical qubits and 90 million Toffoli gates — fewer than 500,000 physical qubits under Google's superconducting hardware assumptions. The previous best estimate was roughly 10 million physical qubits. Google published a zero-knowledge proof of the circuit's existence rather than the circuit itself.
Hardware roadmaps (2026): Google's Willow chip operates at 105 qubits. IBM projects a fault-tolerant system (Starling) with 200 logical qubits by 2029. Quantinuum targets full fault tolerance by 2029. Microsoft has halved its previous timeline, now projecting a scalable quantum computer by 2029.
Consensus estimate: Industry and academic estimates place the credible threat window between 2029 and 2035, with "Q-Day" — the moment a quantum machine can break elliptic-curve cryptography in practice — requiring approximately 2,330 stable logical qubits. Current machines operate orders of magnitude below this threshold, but the gap is narrowing faster than previously modeled.
The implication is straightforward: if Bitcoin's migration requires 3-5 years of development, testing, and activation, the process must begin now to stay ahead of a 2029-2035 threat window.
BIP-360 (Pay-to-Merkle-Root): Merged into Bitcoin's official repository on February 11, 2026, BIP-360 introduces P2MR, a soft-fork transaction output type derived from Taproot architecture. The key difference: P2MR removes the quantum-vulnerable key-path spend, storing only a hash on-chain rather than a bare public key. This provides forward compatibility — the Merkle structure can accommodate whichever post-quantum signature scheme the community eventually selects.
BIP-361 (Legacy Signature Sunset): Proposed on April 15, 2026, by Bitcoin contributor Jameson Lopp and collaborating cryptographers, BIP-361 outlines a three-phase deprecation:
BIP-361 has drawn significant opposition. The proposal's implication — that legacy coins could eventually become unspendable via traditional signatures — challenges Bitcoin's foundational premise that private key ownership confers unconditional access. Approximately 1.7 million BTC in P2PK addresses, including Satoshi's estimated holdings, would be directly affected. The Coinbase advisory board documented the divide: one camp argues for freezing vulnerable coins to prevent systemic theft; the other holds that owners have the right to accept quantum risk on their own holdings.
NIST finalized three post-quantum cryptographic standards on August 13, 2024, after an eight-year evaluation:
| Algorithm | NIST Standard | Signature Size | Basis | |---|---|---|---| | ML-DSA | FIPS 204 | 2,420–4,595 bytes | Module-LWE/SIS | | SLH-DSA | FIPS 205 | 7,856–49,856 bytes | Hash functions | | ML-KEM | FIPS 203 | 800–1,568 bytes (keys) | Module-LWE |
The Coinbase paper also evaluates FN-DSA (pending NIST standardization) and SHRINCS, a compact hash-based candidate. The core challenge for Bitcoin: post-quantum signatures are substantially larger than current ECDSA signatures (64 bytes). ML-DSA signatures at 2,420 bytes minimum represent a 38x increase. SLH-DSA at 7,856 bytes represents a 123x increase. This directly impacts transaction fees, block space, and the ability of nodes to verify transactions independently.
Coinbase's preference for hybrid wallets reflects this constraint. By supporting both legacy and post-quantum signatures in a 1-of-2 construction, the network can migrate incrementally while the community optimizes for size and computational cost.
Ethereum's response is more structured. In August 2026, Vitalik Buterin published an updated roadmap — the "Strawmap" — targeting quantum resistance across the execution layer, consensus layer, and data layer by December 2029. The Ethereum Foundation's Protocol Cluster has described this date as intentionally aggressive, assuming quantum machines with cryptographic capabilities could emerge as early as 2030.
On October 7, 2026, Buterin issued an additional warning: artificial intelligence could accelerate mathematical research sufficiently to weaken lattice-based cryptography (the foundation of ML-DSA and ML-KEM) within two years, while urging users to avoid rushed wallet migrations. This introduces a second-order risk — the post-quantum algorithms themselves may face threats from AI-accelerated cryptanalysis before they are fully deployed.
Beyond Ethereum, Solana, Algorand, Aptos, and Optimism have announced post-quantum transition initiatives, according to the Coinbase paper. However, no top-20 blockchain by market capitalization has post-quantum algorithms live on mainnet as of October 2026.
The most politically fraught element of any quantum migration is dormant coins. Approximately 2.3 million BTC are both quantum-vulnerable (exposed public keys) and dormant (unmoved for five or more years). A subset of these — Satoshi's estimated 1.1 million BTC — sit in P2PK addresses that cannot be protected without active intervention from a private key holder who may not exist.
The Coinbase paper acknowledges this without prescribing a solution, noting it as an "unresolved question." BIP-361's Phase C proposes zero-knowledge proof-based recovery, but this remains theoretical. The alternatives range from doing nothing (accepting that quantum-capable adversaries will eventually drain these addresses) to freezing the coins (violating property rights established by Bitcoin's protocol rules).
At current prices, the 2.3 million dormant and exposed BTC represent approximately $191 billion in value at risk. This figure alone explains why Coinbase — holding 5% of supply in custody — is pressing for early action.
The Coinbase paper does not claim to have answers. It claims to have the right questions — and the institutional weight to demand the Bitcoin community address them. With 5% of supply in custody and an advisory board spanning Stanford, the Ethereum Foundation, and top quantum research institutions, Coinbase is positioning itself as a convening force rather than a protocol developer.
The economic logic is clear: a 30.2% exposed supply represents hundreds of billions in potential losses if quantum capability arrives before migration completes. The engineering challenge is equally clear: post-quantum signatures are orders of magnitude larger than current ones, and any migration must preserve Bitcoin's decentralized verification properties.
The question is no longer whether Bitcoin needs quantum resistance. It is whether the community can execute a coordinated cryptographic migration — across millions of addresses, multiple custodians, and a protocol governed by rough consensus — within a window that may be as narrow as three years.