Coinbase, the Nasdaq-listed exchange that holds roughly 5% of all bitcoin in existence for clients including banks, asset managers and hedge funds, has urged Bitcoin's developer community to begin quantum-resistant upgrades now rather than wait for the threat to materialize.

In a blog post published this week, the company laid out a technical roadmap for protecting Bitcoin against a cryptographically relevant quantum computer, or CRQC — a machine capable of deriving private keys from public keys and draining vulnerable wallets. Google researchers have projected such a machine could exist by 2029. No CRQC exists today.

"Bitcoin consensus changes, and ecosystem migrations can take years," Coinbase wrote, arguing that work must start "well ahead of any CRQC announcement."

Why quantum computing threatens Bitcoin's locks

Bitcoin currently relies on two signature schemes, ECDSA and Schnorr, to authorize transactions. Conventional computers cannot break the math behind these schemes and reverse-engineer a private key. A sufficiently powerful quantum computer could.

The proposed remedy is post-quantum, or PQ, cryptography: new signature methods designed to withstand quantum attacks. Coinbase contends that selecting a new algorithm alone is insufficient. Any viable upgrade must secure both old and new funds, fit within Bitcoin's limited block space, and remain verifiable by ordinary computers.

What does Coinbase propose?

The exchange outlined six measures:

• Flexible transaction formats. Bitcoin should separate the transaction "container" from the signature so new PQ signature types can be added without rebuilding the system. Coinbase cited two proposals, P2MR (BIP-360) and P2TRv2, as offering this flexibility.
• Staged protection. Active wallets should be able to adopt quantum-resistant hybrid signatures before Bitcoin finalizes rules for older types. A "1-of-2" setup would let the same bitcoin be spent with either a traditional ECDSA/Schnorr key or a post-quantum key, avoiding a forced, simultaneous switch.
• Stateful and stateless options. Some PQ schemes require wallets to track which one-time signing keys have been used; restoring from an old backup could cause key reuse and enable forged signatures. Coinbase says Bitcoin should support stateless alternatives that carry no such record-keeping risk.
• Robust implementations. The evaluation process should favor software that verifies consistently across platforms, avoids leaking secrets through timing side channels, and remains safe if the random-number generator fails during signing.
• MPC compatibility. Post-quantum schemes must work with multi-party computation, which protects private keys from theft and underpins security for exchanges, custodians and large institutions.
• A path for late migrators. If Bitcoin eventually restricts ECDSA and Schnorr spending, users holding funds in older formats should have a route to move them to quantum-safe outputs.

What happens to dormant coins?

The most contentious question — what to do with long-dormant wallets and coins in old address types with exposed public keys — Coinbase left unresolved. Some of those wallets belong to people who have lost their keys entirely.

The exchange warned that an attacker could build a quantum machine quietly and begin draining these wallets "before the public learns." It declined to take a position on how such coins should be handled, but argued the debate should run separately from the technical work so it does not delay protections for everyone else.

Coinbase stressed one condition: any rescue mechanism must itself be quantum-safe, or thieves could exploit the rescue method.

Bitcoin's decentralized governance, often cited as an advantage over centralized institutions, is precisely what makes coordinated change slow. Developers are already weighing quantum-defense proposals, and the BIP-360 process gives the community a concrete vehicle for the container-versus-signature separation Coinbase endorses.

With Google researchers placing a possible CRQC horizon at 2029, and consensus changes historically taking years from proposal to activation, the effective window for staging hybrid signatures begins well before any credible quantum milestone is announced.