Quantum

Security

Bitcoin

<p>Bitcoin does not face an imminent quantum break, by Coinbase’s own account. The company says the most advanced quantum machines have fewer than 1,000 qubits, far short of the fault-tolerant capability needed to break Bitcoin’s elliptic-curve cryptography. Yet Coinbase estimates that a change to Bitcoin’s signature system could take as long as seven years to implement.</p>
<p>That gap is the essential point of its post-quantum case. The issue is not whether a <a href="https://cryptodaily.co.uk/glossary/insights-on-the-future-of-quantum-computing-a-transformative-technology" rel="noopener noreferrer nofollow">quantum computer</a> can steal bitcoin today. It is whether Bitcoin can agree on, build and deploy a migration before a future machine makes the question urgent. Coinbase argues that preparation must begin beforehand, because the transition would involve developers, custodians, wallet providers, hardware-wallet makers and institutions rather than a single software activation.</p>
<p>The harder question is not simply which cryptography to use. It is what Bitcoin should do about coins that cannot, or will not, migrate—particularly holdings already exposed to a future quantum attacker.</p>
<h2 id="a-seven-year-migration-window-changes-the-threshold-for-action">A seven-year migration window changes the threshold for action</h2>
<p>Security upgrades are often judged against an immediate threat. That is a poor fit for an infrastructure change whose implementation may itself consume much of the period before the threat arrives. <a href="https://www.coinbase.com/institutional/research-insights/research/market-intelligence/market-intelligence-the-quantum-threat" rel="noopener noreferrer nofollow">Coinbase Institutional Research</a> puts the present hardware constraint plainly: quantum machines remain well below the level needed to compromise Bitcoin’s current elliptic-curve protections. But it also places a potential Bitcoin signature migration on a timetable of up to seven years.</p>
<p>That estimate changes the relevant planning horizon. A network-wide migration would require software support, operational planning by companies that hold bitcoin for clients, and action by users holding their own keys. In Coinbase’s framing, the work is a multi-year process involving many distinct actors, not an event that can be safely deferred until hardware capability is obvious.</p>
<p>Independent research offers a reason to take that sequencing seriously without claiming a near-term emergency. A 2026 paper estimates roughly a one-in-six chance that a cryptographically relevant quantum computer exists by 2035, rising to about 60% by 2050. Those are scenario estimates, not a schedule for quantum development. Still, the paper’s conclusion that governance could be the binding constraint aligns with Coinbase’s practical concern: technical risk may arrive faster than a decentralised ecosystem can settle a contentious response.</p>
<p>The implication is not that Bitcoin must rush an untested consensus change. Starting the design and coordination process early is different from activating it early. Indeed, a long runway is most valuable when it allows debate over trade-offs before those trade-offs are forced by an active attacker.</p>
<h2 id="1-7-million-btc-makes-legacy-exposure-a-governance-problem-not-only-a-cryptographic-one">1.7 million BTC makes legacy exposure a governance problem, not only a cryptographic one</h2>
<p>Coinbase’s Quantum Advisory Council estimates that roughly 1.7 million BTC sit in legacy pay-to-public-key (P2PK) addresses with <a href="https://cryptodaily.co.uk/glossary/public-key-essentials-role-uses-and-faqs-explained" rel="noopener noreferrer nofollow">fully exposed public keys</a>. If quantum capability can derive private keys from that public information, those holdings would be directly vulnerable.</p>
<p>For owners who can still act, the basic response is to move the coins to a safer output type before the old protection fails. But some coins may belong to owners who are lost, inactive or unwilling to migrate. Coinbase’s advisory council leaves unresolved whether permanently unmigrated coins should be burned, preserved or handled through another governance mechanism.</p>
<p>That unresolved question turns a cryptographic upgrade into a dispute over value and control. <a href="https://github.com/bitcoin/bips/blob/master/bip-0361.mediawiki" rel="noopener noreferrer nofollow">BIP-361</a> identifies a redistribution conflict if quantum recovery reaches abandoned or exposed coins. Its possible approaches include allowing the first capable actor to take them, throttling recovery or preventing it altogether.</p>
<p>Those choices distribute risk differently: unrestricted recovery could reward the first capable actor, while restricting or preventing recovery would make Bitcoin’s rules more interventionist where ownership evidence has become unreliable. An independent 2026 analysis finds that most exposed bitcoin may be migratable, but governance—not hardware alone—could remain the binding constraint. No post-quantum signature algorithm settles how abandoned or unmigrated coins should be treated.</p>
<h2 id="bip-360-and-bip-361-show-the-phased-mechanism-coinbase-is-advocating">BIP-360 and BIP-361 show the phased mechanism Coinbase is advocating</h2>
<p>Bitcoin has two draft proposals for a phased post-quantum migration, not an adopted consensus rule. <a href="https://github.com/bitcoin/bips/blob/master/bip-0360.mediawiki" rel="noopener noreferrer nofollow">BIP-360</a> would keep the post-quantum public key hidden until spending in a quantum-resistant output design, reducing the exposure associated with older P2PK outputs.</p>
<p>BIP-361 would first prohibit new payments to vulnerable address types and later retire legacy ECDSA and Schnorr signatures. That gives wallets, services and holders time to direct new funds to safer outputs and migrate existing balances.</p>
<p>The remaining decisions are consequential: which address types to restrict, when to retire the old signatures, and how to handle unmigrated or abandoned coins. The BIPs describe a possible route, but Bitcoin has not selected or adopted it.</p>
<h2 id="standardized-post-quantum-tools-do-not-settle-bitcoin-s-consensus-choice">Standardized post-quantum tools do not settle Bitcoin’s consensus choice</h2>
<p>The underlying cryptographic field is no longer waiting for a standard to emerge. The US National Institute of Standards and Technology finalized ML-KEM, ML-DSA and SLH-DSA in August 2024, and has said organisations should begin migration. Its broader transition planning targets the removal of quantum-vulnerable algorithms from relevant standards by 2035.</p>
<p>Those standards give Bitcoin a more mature set of building blocks than it would have had only a few years ago. They do not choose Bitcoin’s output format, determine how keys should be exposed during a transaction, or resolve the consequences for old coins. A standard can establish a cryptographic primitive’s place in the wider ecosystem. Bitcoin still needs to decide how, and whether, to incorporate a particular construction into its own consensus rules.</p>
<p>That distinction explains why the debate should not be reduced to forecasts about qubit counts. Hardware progress determines when the existing system becomes unsafe. Governance determines whether a replacement is acceptable, deployable and fair enough to gain broad support. The latter may be slow even when the former remains uncertain.</p>
<p>Coinbase’s position is therefore less a declaration that quantum risk has arrived than an argument about lead times. A seven-year migration estimate and an unresolved pool of fully exposed legacy coins leave little room for complacency. The proposals on the table can limit fresh exposure and create time for migration, but they cannot avoid the eventual decision over abandoned balances and the redistribution conflict that follows.</p>
<p>Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.</p>

Coinbase Publishes Its Case for a Phased Bitcoin Post-Quantum Migration

Table of Contents

Crypto Daily™

Other articles published on Oct 16, 2026

Aster DEX vs. Hyperliquid: Why Does Everyone Compare The Two?

Can Stellar Really Help People Without Bank Accounts?

Bitget Got Hacked. Why Is THORChain on Trial?

"Vibe Coding" Meets the Internet Computer: A Plain-English Glossary for the AI App-Building Era

Why Have Nonprofits And NGOs Gravitated Toward Stellar’s Network?

What Makes Ondo Stocks Different From Other Tokenized Stocks?

Join our free newsletter for daily crypto updates!