Coinbase's Plan for a Quantum-Safe Bitcoin

What it is

Coinbase's October 2026 proposal for making Bitcoin quantum-safe, as summarised by Bankless. Coinbase frames it as a contribution to an open discussion, not a blueprint, and endorses no final outcome. It follows a January 2026 quantum advisory board (including Scott Aaronson, Dan Boneh and Justin Drake) and the July 2026 Bitcoin Security Consortium, which pledged $15 million over three years with BlackRock, Fidelity and Strategy.

Design points the summary leaves out

• Hybrid addresses stay exposed. While the old signature path is still valid, the funds remain vulnerable to quantum attack. Hybrids ease the transition but are not a permanent fix.
• BIP-360 (P2MR) is incomplete. It would still need further upgrades before it could carry quantum-safe signatures. Neither it nor P2TRv2 is a full solution alone.
• Signature evaluation criteria: security, cost, speed, hardware wallet compatibility, and the time needed to migrate vulnerable BTC.
• Stateful key reuse can happen through a stale backup. Restoring an outdated wallet backup could reuse a signing key and let someone forge a signature. Coinbase argues Bitcoin should also support stateless signatures, even though stateful ones are smaller and keep fees lower.
• Custody fit. Coinbase wants signatures that work with multiparty signing, where a private key is split across machines. Bankless says certain lattice-based approaches may suit this better, and notes that Coinbase, as a large custodian, has a business interest in that outcome.

Dormant coins

Coinbase does not advocate freezing, rescuing or leaving them alone. It asks that the debate be kept separate from the signature upgrade so it does not delay protection for everyone else. Any recovery mechanism must meet two conditions:

1. It must be quantum-safe, so a holder of only an exposed public key cannot steal coins through it.
2. It must handle edge cases: owners who lost recovery information, demand the system cannot handle, and missed deadlines.

Caveats

The migration stages are options to evaluate, including how non-upgraded wallets and nodes would behave. They are not commitments. The page gives no timeline, no signature sizes and no specification text. It says agreement across the ecosystem may prove harder than the cryptography.