If someone were to build a quantum computer fast enough to break the security of your Bitcoin wallet and drain your coins, what then?

This is a growing concern for everyone, as some forecasts suggest that such a quantum machine—though nonexistent today—could emerge within a few years.

Nasdaq-listed crypto exchange Coinbase (COIN), which currently holds approximately 5% of all circulating Bitcoin on behalf of clients including banks, asset management firms, and hedge funds, has shared its perspective in a new blog post. The article outlines what Bitcoin must do to remain secure against the “potential future” threat of quantum computing.

Its first principle: begin preparation now, before the risk materializes, and address the issue of lost coins separately.

To understand this exchange’s recommendations, it helps to first grasp how Bitcoin’s “locks” work—and how quantum computers could break them.

Locks and Keys

Think of a Bitcoin wallet like a mailbox: a narrow horizontal slot at the top allows anyone to drop in mail, while the physical key is held exclusively by the owner. That visible slot—the public key—is where anyone can deposit funds. In contrast, the private key is the actual key used to open the mailbox. Strictly controlled by the owner and never exposed to outsiders, the private key secures the Bitcoin within the wallet.

When a user sends Bitcoin, the wallet generates a digital signature using the private key—equivalent to an unforgeable seal. The network verifies this signature using the user’s public key; if it matches, the transaction is approved.

Bitcoin blockchain employs two methods for generating and verifying these digital signatures: ECDSA and Schnorr. Both are currently extremely secure because existing classical computers lack the computational power to reverse the underlying mathematics—making it impossible to derive a private key from a digital signature or public key.

The Quantum Threat Emerges

A sufficiently powerful quantum computer—one that researchers at Google estimate could appear as early as 2029—would be capable of precisely this: deriving a private key from a public key and emptying the wallet of its Bitcoin holder.

Researchers refer to such machines as “cryptographically relevant quantum computers,” or CRQCs.

The proposed solution is post-quantum (PQ) cryptography: in plain terms, new signature schemes resistant to quantum attacks.

Coinbase argues that simply selecting a new cryptographic method is insufficient. A complete upgrade protecting Bitcoin from quantum threats must simultaneously safeguard both legacy and new funds, fit within Bitcoin’s limited data capacity, allow standard computers to continue running the network, work for both large-scale crypto platforms and individual users, and provide clear pathways for old coins that may never be moved.

Coinbase Urges Immediate Action

This work must begin immediately, largely due to Bitcoin’s decentralized design—a feature often praised as an advantage over centralized institutions—which also makes implementing changes difficult.

As the exchange puts it: “Bitcoin consensus changes and ecosystem migration may take years.” This is why efforts must begin “well before any CRQC announcement.”

Bitcoin developers are already exploring proposals to build quantum-resistant defenses.

Coinbase’s Proposed Measures

Separating “Containers” from Signatures

In simple terms, Bitcoin’s design should enable support for new post-quantum signature types within its transaction format without requiring a full system overhaul. This would make adding, replacing, or combining quantum-resistant signatures easier over time. Coinbase notes that the P2MR (BIP-360) and P2TRv2 proposals appear to offer such flexibility.

Phased Protection

Coinbase supports a scheme allowing active wallets to begin using quantum-resistant or hybrid signatures before the final rules for retiring old signature types are established. A possible transition path is a “1-of-2” setup: the same Bitcoin can be spent using either traditional ECDSA or Schnorr keys, or a post-quantum key. This enables users to protect their funds earlier, without forcing universal simultaneous upgrades or risking sudden loss of access.

Use of “State”

Some post-quantum signature schemes require wallets to record certain information after each signature, known as “state.” These schemes use many one-time signing keys, and the wallet must remember which have been used to prevent reuse. If a wallet is restored from an old backup or fails to preserve this record, it may inadvertently reuse a key.

This could allow attackers to forge valid signatures. Stateful signatures can be smaller and faster but are more prone to misuse. Coinbase believes that if Bitcoin supports stateful signatures, it should also support stateless alternatives that do not require such tracking. This would give users and wallet developers safer options and reduce risks of fund loss or transaction forgery.

Rigorous Implementation

Coinbase emphasizes the need for software evaluation to prioritize robustness: systems that run reliably across platforms, consistently verify signatures everywhere, avoid timing-based leakage of secret information, use clear parameter configurations, and remain secure even if the random number generator fails during signing. This would make quantum-resistant Bitcoin wallets more reliable and reduce vulnerabilities, hacks, or fund loss.

MPC-Friendly Design

For Coinbase and many of its clients, post-quantum solutions must integrate well with multi-party computation (MPC). When properly implemented, MPC helps prevent private key theft and adds a crucial layer of security for large institutions under persistent cyberattacks. This would allow exchanges, custodians, and enterprises to better secure Bitcoin without relying on a single individual or device to hold the key.

Providing a Path for Late Migrators

If Bitcoin eventually restricts or disables ECDSA and Schnorr spending, some users may still hold funds in older wallet formats. Coinbase suggests considering whether and how these users could later migrate their funds to quantum-secure outputs. The right approach and trade-offs remain unresolved. Addressing this will help prevent users from being locked out of their own Bitcoin due to delayed upgrades. This discussion can proceed independently and in parallel with technical work on post-quantum signature support, so it won’t delay the core effort.

Forgotten Coins

Finally, not everyone will promptly upgrade to post-quantum solutions—especially those holding long-dormant wallets. Some of these wallets belong to users who have already lost their keys. Others contain Bitcoin stored in older address types with publicly exposed public keys.

Coinbase fears someone might quietly build a quantum machine and begin siphoning coins from these wallets “before public awareness.”

The exchange has not taken a stance on how to handle these coins, but stresses that this debate should proceed separately to avoid delaying protection for others. It emphasizes that any rescue mechanism must itself be quantum-safe; otherwise, thieves could exploit the rescue process.

Author: Omkar Godbole, Translated by DeepTide TechFlow