Coinbase Calls for Bitcoin to Prepare for Quantum Computer Threats

Cryptocurrency exchange Coinbase, which holds 5% of all Bitcoin, urges preparation for the quantum threat now. According to the company, flexible addresses, a reserve post-quantum key, and a separate discussion on the fate of lost coins are needed.

The discussion is about a quantum computer that could compute a private key from a public one and empty vulnerable wallets. According to Google's researchers, such a machine could appear by 2029. Currently, blockchain uses ECDSA and Schnorr signatures, which are secure until a sufficiently powerful quantum computer emerges.

Coinbase recommends four directions: flexible post-quantum signatures, phased implementation, reliable implementations, and support for both private users and organizations with multi-party security systems (MPC). The update should protect both old and new funds, fit within Bitcoin's limited data volume, work on regular computers, and consider the fate of coins that may never move.

What is proposed. Separation of transaction format and signature type: the format should support new post-quantum signatures without overhauling the entire system. Coinbase considers P2MR (BIP-360) and P2TRv2 suitable. Phased protection: active wallets can switch to post-quantum or hybrid signatures before Bitcoin finalizes rules for old types. A "1 of 2" option is possible: a coin is spent either with a regular ECDSA or Schnorr key or a post-quantum one.

State tracking: some schemes require remembering used one-time keys. If a wallet is restored from an old copy and does not save the record, the key may be reused, allowing an attacker to forge a signature. Such signatures are more compact and faster, but easier to misuse. Coinbase believes that alongside them, schemes without state tracking are needed.

Reliable implementations and MPC: evaluation should prioritize software that works consistently across different platforms, does not leak secrets through timing, and is secure against random number generator failures. Post-quantum schemes should also work well with MPC, which is important for exchanges and custodians that do not rely on a single key.

Late migration and forgotten wallets. If Bitcoin restricts spending with ECDSA and Schnorr, some funds will remain in old formats. Coinbase considers it useful to decide in advance how such users can transfer funds to quantum-safe outputs. This issue should be discussed separately so as not to delay technical work.

A separate problem is long-dormant wallets, some of which belong to people who have lost keys, as well as addresses with exposed public keys. Coinbase fears that someone could quietly build a quantum machine and start withdrawing coins "before the public knows." The company has not taken a side in the debate over the fate of these coins but insists: any rescue must be quantum-safe, otherwise, attackers will exploit the rescue method itself.