Coinbase urges early planning for Bitcoin’s quantum risk
Bitcoin is not facing an imminent quantum-computing attack. Coinbase’s case for preparing now is practical: developing, testing and coordinating a cryptographic upgrade could take time, and no one knows when a computer capable of threatening today’s systems might arrive.
- Quantum risk depends partly on whether a Bitcoin public key has been exposed.
- BIP-360 is a draft proposal, not an adopted upgrade or a complete post-quantum solution.
- Moving funds could raise difficult questions about coins whose owners never migrate.
Why prepare before an attack is practical?
Bitcoin uses ECDSA and Schnorr signatures to authorize transactions. A sufficiently capable quantum computer running Shor’s algorithm could use an exposed public key to derive its private key, potentially letting an attacker spend the associated funds.
That does not mean every Bitcoin public key is always visible, or that a quantum computer could simply reverse transactions or rewrite the blockchain. Exposure depends on the output type and how it has been used. A Taproot output, for example, reveals a public key on-chain. Some other output types conceal the key behind a hash until the owner spends from them.
Coinbase’s Independent Advisory Board on Quantum Computing and Blockchain says the threat is not imminent, but there is no reliable date for when a fault-tolerant quantum computer capable of breaking current cryptography might exist. That reflects uncertainty. It is not a forecast that Bitcoin will be attacked on a particular timeline.
Coinbase argues that uncertainty is a reason to start the work early. A change to Bitcoin would need technical development and testing, then broad acceptance among developers, wallet providers, node operators, miners and users. In a soft fork, upgraded participants enforce new rules while older nodes may keep operating without enforcing them. No central authority can order every participant to upgrade.
Coinbase says it plans to convene Bitcoin developer discussions, contribute engineering resources to open-source security work and support funding for Bitcoin developers working on quantum-related issues. These steps are preparation, not a Bitcoin-wide migration plan or a choice of replacement signature technology.
What BIP-360 does and does not do
BIP-360, dated December 18, 2024, proposes a new Bitcoin output type called Pay-to-Merkle-Root, or P2MR. The Bitcoin Improvement Proposal repository lists it as a draft, not an adopted network upgrade.
P2MR is designed to retain features associated with Taproot’s script trees while removing Taproot’s key-path spending option. The proposal aims to reduce what it calls long exposure, when an attacker has extended time to target public keys already visible on the blockchain.
It does not fully address short exposure attacks, in which an attacker tries to derive a key while a transaction is visible in the mempool but has not yet been confirmed. BIP-360 says protection against this risk may require post-quantum signatures. It does not specify a complete post-quantum signature system or a full migration plan.
Calling BIP-360 “the quantum fix for Bitcoin” would overstate what it covers. It is one proposal in a broader discussion, not a finished solution.
Coinbase is also preparing its own systems
Coinbase says it has begun building PQ-CoreKMS, a post-quantum version of its key-management system. The company says its existing CoreKMS secures keys associated with about 99.9% of the assets it custodies. That figure comes from Coinbase and has not been independently verified.
Coinbase said it aimed to deliver an automated signing pipeline within a year of its announcement, followed by fuller multi-party computation capabilities over the next two to three years. Those are company targets, not confirmation that the milestones have been completed.
Hardening an exchange’s custody systems is different from changing Bitcoin itself. Coinbase can update infrastructure it controls. A network-wide Bitcoin upgrade depends on open development and broad agreement.
What Google’s estimates show and what they don’t
Google researchers have estimated the resources a hypothetical quantum computer might need to attack 256-bit elliptic-curve cryptography, the category used by cryptocurrency signature systems. Their published research estimates that an attack could require either fewer than 1, 200 logical qubits and 90 million Toffoli gates, or fewer than 1, 450 logical qubits and 70 million Toffoli gates.
A logical qubit is a more reliable unit of computation built from physical quantum hardware. A Toffoli gate is an operation used in quantum circuits. Under stated hardware assumptions, Google estimates the circuits could run on a superconducting quantum computer with fewer than 500, 000 physical qubits in a few minutes.
These figures estimate the resources a future attack might require. They are not evidence that a machine capable of carrying it out exists today. The results depend on assumptions about hardware and error correction, and they do not establish when such a computer will be built. Google’s 2029 timeline concerns its own planned migration to post-quantum cryptography, not a prediction that Bitcoin will be broken by 2029.
Dormant coins raise a hard technical and human question
Older wallets and inactive coins are not automatically vulnerable. Risk depends on the output type and whether the relevant public key has been exposed. A coin sitting untouched in a wallet is not, by itself, more exposed than an actively held coin.
Still, a migration could leave some users behind. Owners may have lost their keys, become unreachable or chosen not to move their funds. BIP-360 does not specify what should happen to coins that are never migrated.
Freezing those coins, changing the conditions under which they can be spent or leaving them under existing rules would each raise difficult questions about ownership and decentralization. These are not minor implementation details. A protocol change affecting dormant funds could trigger a fierce governance dispute, even if participants agree on the underlying security concern.
Key questions about Bitcoin and quantum computing
-
Is Bitcoin facing an immediate quantum attack?
No. Coinbase’s advisory board says the threat is not imminent, and Google’s resource estimates describe a hypothetical future attack, not a capability demonstrated by current machines.
-
Why prepare now?
Coinbase argues that developing and coordinating a Bitcoin upgrade, then helping users move funds, could be difficult. Early planning is a precaution, not proof that an attack is near.
-
Does BIP-360 make Bitcoin quantum-proof?
No. The draft aims to reduce certain long-exposure risks, but it does not fully protect against short-exposure attacks or specify a complete post-quantum signature system.
-
Are dormant coins automatically at risk?
No. Exposure depends on the output type and whether its public key is visible, not simply on how long a wallet has been inactive. What to do with coins that are never migrated remains unresolved.
-
When could quantum computers threaten Bitcoin?
No reliable date is established. Google’s estimates concern the resources a hypothetical attack might require. They do not predict when a capable machine will exist.
Coinbase’s warning is a call to test options and tackle migration questions before they become urgent. Quantum computers have not broken Bitcoin. Early preparation gives developers and users more room to make careful decisions, and less reason to confuse a technical deadline with a governance strategy.
