Coinbase, custodian of approximately 5% of all existing Bitcoin, published post-quantum security recommendations for the Bitcoin protocol on October 13, 2026, authored by Shashank Agrawal. The cryptocurrency exchange outlined proposals for protocol upgrades, institutional custody compatibility, and protections for vulnerable holdings in response to future quantum-computing threats to elliptic-curve digital signatures. With roughly 20 million BTC already mined against Bitcoin's maximum supply of 21 million, Coinbase's custody share represents approximately one million BTC held for clients. The recommendations address the possibility that sufficiently powerful quantum computers could eventually compromise the cryptographic signatures used to authorize Bitcoin transactions, though no quantum computer has publicly demonstrated this capability at the required scale. Coinbase emphasized its proposals contribute to ongoing technical discussion rather than finalized protocol changes.
Coinbase Proposes Flexible Signature Systems and Phased Migration
Coinbase recommended introducing Bitcoin output structures capable of accommodating different quantum-resistant signature algorithms without requiring repeated fundamental protocol redesigns. The company identified Pay-to-Merkle-Root (P2MR), proposed under Bitcoin Improvement Proposal 360, and P2TRv2 as potential approaches offering this flexibility. Coinbase also proposed evaluating hybrid spending mechanisms that would allow transactions to be authorized using either existing ECDSA/Schnorr signatures or post-quantum alternatives during a transition period. Such arrangements could allow users and institutional custodians to prepare their holdings before decisions are finalized about restricting legacy cryptographic signatures.
Coinbase emphasized that selecting replacement algorithms requires evaluating their impact on Bitcoin's limited block space, transaction fees, verification performance, and hardware-wallet compatibility. Among the candidates identified were ML-DSA, SLH-DSA, FN-DSA, and SHRINCS, with the latter combining compact stateful signatures and a stateless fallback. The company cautioned that stateful signature systems introduce operational risks because accidentally reusing signing states can enable forgery. It also emphasized compatibility with multi-party computation, which allows institutions to distribute cryptographic key control rather than relying on a single signing authority.
Dormant Bitcoin and Institutional Custody Complicate Transition
Another significant challenge concerns Bitcoin held in older addresses where public keys are already exposed, alongside funds whose owners have lost access to their private keys. Coinbase's quantum advisory council previously estimated that approximately 6.9 million BTC could face exposure through publicly revealed keys, including around 1.7 million BTC associated with older Pay-to-Public-Key outputs. The company suggested evaluating recovery mechanisms, migration deadlines, and potential restrictions on legacy spending while acknowledging that these approaches raise difficult questions about ownership rights.
Coinbase Develops PQ-CoreKMS Infrastructure with Multi-Year Timeline
Coinbase has already begun developing PQ-CoreKMS, a quantum-resistant version of its institutional key-management infrastructure. In July, the company announced plans for an initial post-quantum signing pipeline within approximately one year, followed by more advanced multi-party computation capabilities over the subsequent two to three years. The exchange has also supported Bitcoin security research through developer collaboration and participation in the Bitcoin Security Consortium. Coinbase argues that preparation should begin before quantum technology becomes available, given the potentially lengthy process of securing consensus, upgrading wallets, and migrating holdings across the Bitcoin network.
FAQ
What did Coinbase publish on October 13, 2026?
Coinbase published post-quantum security recommendations for the Bitcoin protocol on October 13, 2026, authored by Shashank Agrawal. The recommendations outlined proposals for protocol upgrades, institutional custody compatibility, and protections for vulnerable holdings in response to future quantum-computing threats to elliptic-curve digital signatures.
How much Bitcoin does Coinbase hold in custody?
Coinbase holds approximately 5% of all existing Bitcoin in custody, representing approximately one million BTC. With roughly 20 million BTC already mined against Bitcoin's maximum supply of 21 million, this figure reflects assets held in custody for clients rather than Bitcoin owned by the company itself.
What is Coinbase's timeline for post-quantum key management development?
Coinbase announced in July plans for an initial post-quantum signing pipeline within approximately one year, followed by more advanced multi-party computation capabilities over the subsequent two to three years. The company has already begun developing PQ-CoreKMS, a quantum-resistant version of its institutional key-management infrastructure.
