Coinbase custodies 5 percent of all Bitcoin and urges a post-quantum switch: what matters now

Coinbase published a position paper on the future of Bitcoin signatures on October 13, 2026. Its central claim is that the move to schemes a quantum computer cannot break has to begin before such a machine exists. Bitcoin is untouched by it at around $81,600 (CoinGecko, October 16). The paper names neither a deadline nor an activation mechanism, and that is precisely its message: the debate is starting, the implementation is not.

Coinbase sets out a position paper on post-quantum migration

The document carries more weight than the usual industry comment, because Coinbase custodies around five percent of all existing Bitcoin according to consistent reports, mostly for banks, asset managers and hedge funds. A firm holding that much of other people's money does not carry migration risk in theory.

The company's reasoning is set down verbatim in the paper: "Bitcoin consensus changes and ecosystem migrations can take years, so it is important that we begin this work now." Elsewhere it states that preparation should start "well ahead of any CRQC". CRQC stands for cryptographically relevant quantum computer, meaning a machine actually strong enough to break today's signatures. No such machine exists so far; the most capable known devices work with fewer than 1,000 qubits.

For the timing, the paper cites an estimate by Google researchers under which a CRQC could emerge around 2029. That number is someone else's forecast, not a commitment by Coinbase, and the expert debate rates it differently.

BIP-360 separates the output type from the signature

Technically the paper rests on one idea that is the real point of the proposal: the container of a Bitcoin output and the signature scheme used to spend it later should be separated from each other.

Pay-to-Merkle-Root as an interchangeable container

Under the name Pay-to-Merkle-Root, or P2MR, BIP-360 describes an output type that is not tied to one particular signature scheme. A Merkle root is the condensed root of a hash tree, under which several possible spending conditions can be hidden without all of them being disclosed. Its advantage during migration is that a new, quantum-safe scheme can be added later without changing the output format again.

P2TRv2 as a second, less mature route

Alongside it the paper names P2TRv2, a second version of Taproot pursuing the same separation. Coinbase publicly rates it as less advanced than BIP-360. Both are drafts so far. BIP-360 has the status of a proposal, P2TRv2 has not been adopted, and no Bitcoin upgrade covering these points has been agreed.

The 1-of-2 wallet avoids a hard cut-off date

For the early phase of the switch, Coinbase proposes a construction the paper calls 1-of-2. A balance can be spent either with the classic key or with an additional, quantum-safe key. Both routes are valid at the same time.

The practical benefit is a network that does not have to flip on a single date. Nor does it create outputs movable only under the old scheme, which would then be stranded when that scheme is switched off. Anyone who has carried a wallet through a format change knows the difference between a transition and a cut.

Stateful schemes such as XMSS and LMS carry a forgery risk of their own

On the choice of the future scheme, Coinbase keeps its distance. Stateful signature schemes such as XMSS and LMS count as small and fast, but they have to remember which part of the key material has already been used. Manage that state wrongly and use a part a second time, and forging a signature becomes immediately possible. Coinbase therefore demands that such schemes ship only together with a stateless fallback.

The paper expressly avoids settling on a particular algorithm. It names no activation mechanism either. Readers expecting a finished upgrade find a description of the problem with guard rails.

Exposed keys sit in P2PK and in already-spent addresses

The part that matters most to holders concerns which balances would be vulnerable at all. The public key of an address is not always visible. With modern address formats the blockchain initially holds only a hash of it, and the key itself becomes public only with the first spend.

How to recognise an exposed address

The paper lists the exposed set along that logic: very old P2PK outputs, where the public key stands in the clear from the start, plus P2PKH and Taproot outputs that have already been spent from, and finally deposits arriving during an ongoing migration. The rule of thumb is therefore this: an address you have already sent Bitcoin from has given up its public key. An address that has only received has not.

How to go through your own holdings on that basis is set out in a separate cryptoticker.io piece on the quantum risk of individual Bitcoin addresses. The size of the affected stock is given differently: Coinbase's own advisory board arrived at around 6.9 million Bitcoin with potentially exposed key material in April 2026, while older analyses name about 6.7 million. Both figures describe an upper bound of what is theoretically exposed, not damage done.

The timeframe stays open and the estimates diverge

Figures on how long the rebuild takes differ, and the paper contributes to that by setting no deadline. Part of the coverage reports an estimate of up to seven years for replacing the signature scheme. Other reports speak generally of several years and note explicitly that Coinbase deliberately fixes no schedule. What holds is therefore only the span from several years up to an estimate of seven, not a single number.

That is less unsatisfying than it sounds. A consensus change in Bitcoin needs agreement among developers, miners, exchanges and wallet providers. A date set by a single company would carry no binding force.

A transfer to a fresh address leaves the German holding period intact

The obvious reaction for many holders would be to move balances to new addresses as a precaution. In tax terms that is uncritical in Germany: in its circular on the income tax treatment of crypto assets, the federal finance ministry does not treat a transfer between your own wallets as a disposal. The one-year holding period under section 23 of the Income Tax Act therefore keeps running when you send Bitcoin from one address of your own to another.

Two points still matter. First, your records have to be right, because a portfolio tracker or a tax tool might otherwise book such a transfer as a sale and a repurchase. Second, every transfer costs a network fee. Against a horizon of years, panic is the worse adviser. How the legislator will handle the holding period is open in the ongoing reform debate.

Anyone thinking about custody anyway will find the models, their setup and their running costs in our hardware wallet comparison. Only one property matters for this article: the device has to be able to add signature schemes by firmware update.

Holding on an exchange hands the migration to the provider

If your Bitcoin sits with an exchange or a broker, what you own is a claim against the company, not a private key. Moving to quantum-safe signatures would then be the custodian's job. Among other things, Coinbase describes multi-party computation in the paper as a building block of its own infrastructure and states: "When implemented effectively, MPC can provide strong protection against key theft." Under MPC a key is never assembled in full in one place but split across several parties.

That creates a division of labour worth knowing. In custody with a provider you carry the counterparty risk but not the technical migration. In self-custody it is the other way round. Both are defensible; the decision should simply be a deliberate one rather than the result of inertia.

Dormant Bitcoin and lost keys remain the open flank

The paper deliberately leaves the thorniest point outside the bracket: a balance that never moves cannot be migrated either. That covers the early holdings from the network's first years and every coin whose keys are lost. Coinbase treats this question as a separate problem and not as a precondition for the rest of the rebuild.

That is a political choice, not a purely technical one. Whether such outputs are eventually frozen, given a deadline or left untouched touches on questions of ownership that the Bitcoin world has argued over for years. Coinbase states its expectation that Bitcoin will "continue to be the most trusted cryptocurrency in a post-quantum world". That is no answer on the dormant holdings.

Post-quantum switch: nothing happens until BIP-360 is activated

As long as no output type is activated, your wallet keeps working exactly as it does today. Three steps make sense, in this order:

1. Look at your address behaviour. Make sure your wallet creates a fresh receiving address for every deposit and that you do not reuse an address. Which programs do that reliably is shown in the software wallet comparison.
2. Choose custody deliberately. Decide which part of your holdings should sit with a provider and which in self-custody. Fees, domicile and custody model of the providers are in the exchange comparison.
3. Keep clean records. Document every transfer between your own wallets so the holding period stays provable. Tools for that are in the comparison of tax and portfolio tools.

The next reliable signal will not come from a corporate release but from the development process: only once BIP-360 leaves draft status and an activation route exists does the paper turn into a roadmap.

Sources on the position paper: The Quantum Insider and crypto.news.

(As of October 16, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)