Coinbase custodies roughly 5 percent of every bitcoin in existence, and on October 13, 2026 it published the closest thing Bitcoin has to a post quantum migration plan. The post, titled Wroking together on BTC post quantum readiness, does not announce a soft fork, a deadline, or a new address type. , What it does is put a number on the table that the Bitcoin community has been dancing around for two years. Coinbases own research puts a full signature migration at up to seven years..... The most advanced quantum computers today have fewer than 1,000 physical qubits..... Both facts are true at the same time, and the gap beween them is the whole argument.
Mid October 2026 was a reasonable time to make that argument. bitcoin is trading near $82,000, spot ETFs just logged a second straight week of outflows, and the market is focused on Fed hikes and producer price prints. Nobody is pricing in quantum risk. Coinbase is saying that is precisely why the engineering should start now, while it is boring.
What Coinbase Actualy Proposed
The post is a priorities list, not a specification.... Coinbase explicitly frames it as a discussion document rather than an approved migration plan or a final company position. Strip out the hedging and six concrete positions remain. Granted, First, separate the container from the lock. , Coinbase wants the output type that holds funds decoupled from the signature algortihm that authorizes spending them. That way a signature scheme can be added, replaced, or run alongside another one without redesigning the whole output. It names two candidates that already offer this Pay to Merkle Root, defined in BIP 360, and a design referred to as P2TRv2.Second, hybrid wallets as a bridge. Coinbase favors a staged setup where acitve wallets move to a 1 of 2 construction..... The same coins get two spending paths, one authorized by a classical ECDSA or Schnorr key and one by a post quantum key. If a cryptographically relevant quantum computer ever shows up, the classical path gets switched off and the funds are already protected. If it never shows up, nothing was lost.
At first glance, third, pick signature schemes with a saefty net. The candidates named are ML DSA, SLH DSA, FN DSA and a compact scheme called SHRINCS. Coinbases one hard rule here is that any stateful signature scheme must ship with a stateless fallback... Because a wallet that reuses signing state in a stateful scheme can leak enough to forge signatures. , That is not a theoretical concern for a custodian runnng thousands of signing operations a day.
Fourth, it has to work with multiparty computation...... institutional custody runs on MPC, where no single machine ever holds a complete private key. Coinbase wants at least one post quantum option that plays well with MPC, or the largest holders in the ecosystem cannot migrate at all.
Strangely, fifth, it has to fit in blocks and be verifiable by ordinary full nodes.... More on that below, becuase this is where the real cost lives. honestly though, Sixth, legacy coins need their own track. Coinbase wants the debate about abandoned and lost key coins to run in parallel with the signature engineering, not block it. That is a polite way of saying the hardest political question in Bitcoin should not be allowed to stall the technical work.
How Many Bitcoin Are Actualy Exposed
The number that gives the plan its urgency comes from Coinbases own Quantum Advisory Council, which estimated on April 21, 2026 that about 6.9 million BTC sit in outputs where the public key is already visible on chain... At current prices that is roughly $570 billion. Glassnodes independent count landed above six million, and older analyses cluster arround 6.7 million, so the figure is not a Coinbase outlier.
Exposed does not mean stolen. It means that if a machine capable of running Shors algorithm at scale ever exists, those coins can be attacked without waiting for the owner to transact. The breakdown matters because it tells you who is at risk.
| Exposure type | Why the key is visiable | Approximate BTC | Can the owner fix it |
|---|---|---|---|
| Legacy P2PK outputs | Satoshi era coinbase rewards paid directly to a raw public key | About 1.7 million | Only by moving the coins, and most are presumed lost |
| Reused addresses | Spending once reveals the key, and the adress keeps receiving funds | Bulk of the remaining 5 million plus | Yes, move to a fresh address |
| Taproot key path | Spend reveals the tweaked public key | Growing share of recent outputs | Yes, P2MR removes the key path entirely |
| Unspent, never reused addresses | Only the hash is publc until spend | Everything else | Vulnerable only during the window between broadcast and confirmation |
The reused address row is the one that should make every exchange and casino operator uncomfortable. Hot wallets that sweep deposits into a handful of long lived addresses are the textbook case of exposed keys, and they hold cusotmer funds rather than dormant whale stacks.
Why Seven Years When Quantum Computers Have Under 1,000 Qubits
The hardware gap is real..... Googles Willow chip runs 105 physical qubits. Quantinuums Helios reported 98 physical qubits producing 48 error corrected logical qubits, which is the current state of the art for usable qubits... Breaking Bitcoins 256 bit elliptic curve needs somewhere in the range of 1, 200 to 1, 450 logical qubits by the most recnet estimates.
Seriously, what changed is the ceiling, not the floor. In March 2026 Google Quantum AI published resource estimates putting the physical qubit requirement for attacking 256 bit elliptic curve cryptography below 500,000, around 20 times lower than its own 2019 figure. Work on neutral atom and trapped ion architectures suggests tens of thousands might eventully be enough on those platforms, though none of that is verified in hardware... A 2026 academic estimate puts the probability of a cryptographically relevant quantum computer at roughly one in six by 2035, rising toward 60 percent by 2050. those are scenario numbers, not forecasts, and Blockstreams Adam Back still argues the practical threat is 20 to 40 years out.
Seven years is not a prediction about hardware. It is a prediction about Bitcoin governance.... Taproot took about four years from proposal to activation and the rollout of walet support dragged on well after that. A post quantum change touches consensus rules, every wallet library, every hardware signer, every custodians MPC stack, and every exchanges deposit system. Coinbases figure covers software support, custodian planning, and user key migration, and it lines up neatly with the companion proposal that already exists.
BIP 360 and BIP 361 Are the Two Halves of the Plan
BIP 360 was merged into the official BIPs repository on February 11, 2026..... It defines Pay to Merkle Root, a Taproot style output that commits only to a script tree and removes the key path spend entirly. Every spend reveals a script leaf and a Merkle proof, never a bare public key that sits exposed until the next block. Addresses would likely start with bc1z. It preserves multisig, timelocks and inheritance setups through Tapscript, and it is exactly the flexible container Coinbase is asking for.
What BIP 360 does not do is add a post quantum signature. ECDSA and Schnorr stay.... Existnig coins do not migrate themselves... A testnet implementation exists, but Bitcoin Core has not merged any of it and there is no activation schedule.
BIP 361, co authored by Jameson Lopp and five others, is the enforcement half, and it is far more controversial. It proposes three phases. Roughly three years after BIP 360 activates, new payments to legacy addres types would be rejected. About two years after that, legacy signatures would become invalid, which freezes any coins that have not moved. , A third phase, still only a research idea, would let stranded holders recover funds through zero knowledge proofs of ownership. , Lopp himself has said the proposal is not currently in a position to be adopted, and Back opposes any forced sunset. Add the three plus two years of BIP 361 to a realistic activation runway and you arrive at Coinbases seven.
The Block Space Probem Nobody Wants to Price
This is the part of the plan that directly affects what every user pays..... post quantum signatures are enormous compared with the 64 byte Schnorr signatures Bitcoin uses today, and Tapscripts weight model is tuned for exactly that 64 byte size..... CryptoCasino.Vegas compiled the published parameters for each candidate scheme Coinbase named to show the scale of the probem.| Signature scheme | Type | Signature size | Multiple of Schnorr | Trade off |
|---|---|---|---|---|
| Schnorr (current) | Elliptic curve | 64 bytes | 1x | Quantum vulnerable |
| FN DSA 512 (Falcon) | Lattice | 666 bytes | About 10x | Smallest optiion, hardest to implement safely |
| ML DSA 44 (Dilithium) | Lattice | 2,420 bytes | About 38x | NIST standard, mature, large |
| ML DSA 65 | Lattice | About 3,309 bytes | About 52x | Higher security level favored in one draft BIP |
| SLH DSA (SPHINCS+) | Hash based | 7, 856 to 49,856 bytes | 120x to 780x | Most conservative securty, worst footprint |
Fees are the player facing consequence..... A Bitcoin network where every transaction is 10 to 50 times heavier is a network where on chain withdrawals cost more and confirm slower. And that pushes even more casnio settlement volume onto Lightning or onto other chains entirely.
How Bitcoin Compares With Ethereum and Solana
Bitcoin is not the furthest behind, but it has the hardest coordination problem.... Ethereums foundation is targeting full post quantum protection by the end of 2029, with EIP 8141 account abstraction marked as must ship for the Hegotá upgrade. Account abstraction lets wallets swap in hash based or lattice based signatures wihtout a hard fork, which is a structural advantage Bitcoin simply does not have.... Solanas answer so far is the Winternitz Vault, an opt in one time signature wallet from January 2025 that users must actively choose, with no network wide plan announced since.
NIST finalized ML DSA and SLH DSA in August 2024 and intends to remove quantum vulnerable algorithms from federal standards by 2035. That date is doing a lot of quiet work in every chains roadmap... Ethereums 2029 taeget sits six years before it. Coinbases seven year window, started today, lands in 2033. Bitcoins problem is that nobody can start the clock unilaterally.
What This Means If You Hold or Gamble With Bitcoin
Nothing in the Coinbase post changes anything about your coins this year or next. There is no activation vote, no deadline, and no sofware to download. The practical takeaways are smaller and more immediate.
Stop reusing addresses.... This has always been good hygiene and it is now the single biggest thing separating the exposed 6..9 million BTC from everything else. A fresh address for every deposit keeps your public key hidden until the moment you spend. Mind you, Watch where your custodian stands. Coinbase is preparing its own systems and says so. Smaller exchanges and gambilng operators running sweeps into long lived hot wallets are the weak link.. And when post quantum wallet support ships they will be the ones who have to migrate first and fastest. Platforms built on automated settlement, CryptoCasino.Vegas among them, will need to add post quantum output support the moment wallet libraries expose it... Because a hot walet with a reused key is exactly the target this plan was written for.
Expect the legacy coin fight to get louder.... The only live question in Bitcoin post quantum policy is whether unmigrated coins get frozen, rate limited, or left for whoever builds the quantum machine first. Coinbase has deliberately not taken a side. Everyone else will, and that debate, not the hardware, is what decides wether seven years is optimistic.
