Coinbase published on October 13, 2026, what it needs from the post-quantum signature schemes and transaction output types that Bitcoin developers are designing. The company, one of the largest custodians of bitcoin, asked that Bitcoin’s options include at least one scheme suited to multi-party computation (MPC) signing. It also asked that any stateful scheme, in which the signer must keep track of the one-time keys it has used, come with a stateless signing mode.
With MPC, several parties produce a signature without any one of them holding the whole private key. Coinbase uses it to protect most of the assets in its custody. Jeff Lunglhofer, Coinbase’s chief information security officer, said in July that full MPC support for lattice-based post-quantum signatures would take two to three more years of research.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is an advisor to Project Eleven, which works on post-quantum security for digital assets.
The requests
Shashank Agrawal, who leads protocol security for Coinbase’s on-chain development, wrote the post, titled “Working Together on Bitcoin’s Post-Quantum Readiness.” He described it as input to an open discussion, “not a set of instructions or a final Coinbase position,” and named candidate schemes without choosing among them.
Coinbase asked that work begin well ahead of any cryptographically relevant quantum computer, because Bitcoin consensus changes and migrations can take years. It asked for an output type that lets developers add or replace signature schemes without redesigning the output. It named P2MR, defined in Bitcoin Improvement Proposal 360, and a design called P2TRv2 as candidates.
The company also asked for staged protection, so that active wallets can use post-quantum or hybrid outputs before Bitcoin settles its policy on legacy signatures. One example it gave is a 1-of-2 construction in which the same coins can be spent with either a classical key or a post-quantum key. Coins locked that way stay open to a quantum attacker until the classical key’s spending path is disabled, since either key alone can move them. For evaluations, it asked for strong weight on deterministic verification across platforms, constant-time code, and resistance to failures of the random-number generator used for signing.
Coinbase proposed criteria for comparing candidate schemes, including signature and key sizes, signing and verification time, throughput for a mass migration, and feasibility on hardware security modules (HSMs), hardware wallets, and MPC or threshold signing. It asked for a Bitcoin-specific evaluation of ML-DSA and SLH-DSA, the NIST standards derived from CRYSTALS-Dilithium and SPHINCS+, of FN-DSA (Falcon) once standardized, and of more compact candidates.
Signer state
Coinbase named SHRINCS, a hash-based scheme drafted by a group of Bitcoin developers, as a good fit for the Bitcoin-specific evaluation. SHRINCS pairs a compact stateful signing path with a stateless fallback.
Coinbase called the pairing an attractive trade-off between size and verification cost but wrote that adopters would face central questions about signer state, recovery, and implementation assurance. A stateful signer that mismanages its record of used one-time keys can enable forgeries.
Coinbase wrote that large exchanges run several signing servers in different zones that operate independently. Under a stateful scheme, each server would need an exclusive lock on a key and its state during signing. The servers could then no longer run independently, and recovery from backups would become difficult.
Coinbase described dormant, lost, and exposed coins, including Satoshi-era holdings and coins on reused addresses, as a separate governance and engineering problem. It said any rescue proposal should show that the rescue path is itself safe against a quantum attacker who knows only an exposed public key.
Coinbase’s own migration work
On July 23, Lunglhofer wrote that the company was building PQ-CoreKMS, a post-quantum version of the MPC-based key-management system that protects about 99.9% of the assets it holds. He said the signing pipeline was due within a year, followed by two to three years of research toward full MPC for lattice-based schemes.
On September 9, Coinbase reported on a closed-door workshop it co-hosted at Stanford University with cryptographer Dan Boneh and Localhost Research.
News reports gave different figures for Coinbase’s share of all bitcoin as a custodian. The Block and Gizmodo reported that the post put it at about 5%. The Quantum Insider reported about 12%.
Bitcoin developers have not chosen a post-quantum signature scheme or an output type, and no activation date has been proposed for either.
