Key Highlights:
- Coinbase recommends a phased approach to post-quantum Bitcoin protection, proposing options like a “1-of-2” hybrid output supporting both classical and quantum-resistant spending paths.
- Legacy funds, including exposed pay-to-public-key outputs and Satoshi-era balances, present distinct governance hurdles requiring quantum-safe recovery mechanisms to prevent covert exploitation.
- Institutional custody demands prioritize MPC-friendly signing and constant-time verification while warning against stateful cryptographic schemes that risk forgery and break high-availability systems.
Coinbase Proposes Phased Transition to Post-Quantum Cryptography for Bitcoin
As discussions around the eventual arrival of a cryptographically relevant quantum computer (CRQC) intensify across the digital asset ecosystem, cryptocurrency exchange and custodian Coinbase is advocating for a staged migration pathway for the Bitcoin network. To secure user funds without disrupting ongoing network operations, Coinbase favors staged protection mechanisms. Under one proposed scenario, the network could implement a “1-of-2” hybrid output. This model enables the same pool of funds to maintain two separate spending conditions: one governed by an existing classical ECDSA or Schnorr signature key, and an alternative route protected by a post-quantum cryptographic key. Such an approach enables participants to transact using standard classical signatures today while retaining the capability to pivot seamlessly to quantum-resistant verification whenever the security environment dictates.
When assessing post-quantum signature schemes, Coinbase has highlighted the need for an extensive evaluation framework. The exchange recommends evaluating an array of standardized and in-development cryptographic algorithms, specifically naming ML-DSA, SLH-DSA, and FN-DSA, alongside more compact candidate options like SHRINCS. Crucially, Coinbase cautions the broader developer community against adopting stateful signature schemes. In stateful systems, the inadvertent reuse of an internal signing state creates a critical vulnerability, directly opening the door to catastrophic signature forgery.
Addressing Vulnerable and Dormant Legacy Balances
Beyond integrating advanced cryptography into consensus rules, the transition faces an even more formidable technical and socio-economic obstacle: handling legacy Bitcoin that cannot or will not be actively moved by owners. Coinbase argues that legacy coins should be managed as an independent governance and engineering dilemma, fundamentally distinct from the technical implementation of post-quantum signature schemes. This vulnerable category encompasses unspent transaction outputs (UTXOs) with permanently exposed public keys—such as legacy pay-to-public-key (P2PK) outputs—reused addresses, long-dormant holdings, and historical Satoshi-era coins. Such balances carry heightened vulnerability to covert quantum theft, which could conceivably occur before the broader public or network observers become aware that an operational CRQC has been developed.
This exposure mirrors security warnings previously highlighted by law enforcement bodies like Europol concerning exposed cryptographic wallet keys. In response, Coinbase emphasizes that any potential rescue framework—whether architected around seed knowledge, zero-knowledge proofs, or defensive rate-limiting tripwires—must inherently be quantum-safe from the ground up. Without strictly quantum-safe design, a quantum-equipped adversary possessing only an exposed public key could compromise and drain the recovery mechanism itself. Rather than stalling broader cryptographic development, Coinbase suggests that theoretical and policy discussions on legacy fund recovery should progress in parallel with technical signature upgrades.
Institutional Custody Requirements and the Push for Network Consensus
As an institutional custodian holding roughly 5% of Bitcoin’s supply, Coinbase’s insights reflect complex operational constraints that smaller retail-centric proposals often overlook. The company is actively preparing its own custody architecture, convening core Bitcoin developers, and funding open-source development through the Bitcoin Security Consortium. Institutional operations demand high-integrity standards, including multi-party computation (MPC) compatibility, deterministic and cross-platform verification, and constant-time execution to protect against side-channel vulnerabilities.
These enterprise-grade requirements sharply contradict the operational characteristics of stateful cryptographic proposals. Although stateful schemes often appear lightweight and efficient in academic benchmarks, their operational realities introduce severe points of failure. For a retail self-custody user, failing to track state or inadvertently duplicating it can lead to total fund loss via signature forgery. For an enterprise custodian running geographically dispersed, high-availability signing clusters, stateful signatures would require aggressive exclusive distributed locking, destroying operational redundancy and fault tolerance.
Why This Matters
The broader digital asset industry is shifting from theoretical quantum speculation to concrete engineering roadmaps, highlighted by initiatives like Zcash’s quantum blueprint announced in January. While Coinbase stresses that no functional CRQC exists today—framing its findings as technical considerations rather than definitive mandates—the network must proactively evaluate new standards before quantum hardware becomes a pressing reality. The critical milestone for the Bitcoin ecosystem will be determining whether core developers, wallet builders, enterprise custodians, and full node operators can align around standard implementations, such as P2MR- or P2TRv2-style outputs, matched with a sustainable shortlist of post-quantum algorithms.
Frequently Asked Questions
What is the “1-of-2” hybrid output proposed by Coinbase?
The “1-of-2” hybrid output is a transitional design where Bitcoin transaction outputs support two alternative spending paths: one validated by conventional ECDSA or Schnorr keys and another validated by a post-quantum cryptographic key. This enables users to transact normally today while retaining an immediate, quantum-safe alternative path if classical cryptography is compromised.
Why are stateful signature schemes considered dangerous for Bitcoin?
Stateful signature schemes require strict, sequential tracking of internal signing states. Reusing or desynchronizing a signing state can allow adversaries to forge signatures and steal funds. Furthermore, for institutional custodians managing distributed, multi-region signing environments, stateful mechanisms would force exclusive database locks that cripple high-availability infrastructure.
How does Coinbase propose handling legacy and Satoshi-era Bitcoin?
Coinbase advocates treating legacy UTXOs, exposed P2PK addresses, and Satoshi-era balances as a separate engineering and governance challenge rather than letting them delay post-quantum signature upgrades. Coinbase stresses that any recovery framework designed for these unmigrated funds must itself be fully quantum-safe to prevent malicious actors from using quantum computing to exploit the recovery process.
