Coinbase pushes to start Bitcoin's post-quantum migration, backing BIP-360 and P2TRv2

Coinbase, which custodies roughly 5% of all bitcoin in existence on behalf of banks, asset managers and hedge funds, published a design brief urging Bitcoin to start post-quantum migration now rather than wait for a cryptographically relevant quantum computer. The company's position: "Bitcoin consensus changes and ecosystem migrations can take years, so it is important that we begin this work now." Coverage from CoinDesk and The Block, both citing Coinbase's own blog post, "Working together on BTC post-quantum readiness."

What Coinbase is backing

Coinbase's brief favors two output-type proposals and one staging mechanism:

• BIP-360 (P2MR) — Pay-to-Merkle-Root. Reference site: bip360.org. The proposal separates the output "container" from the signature scheme, so new post-quantum signatures can be swapped in without redefining the output format each time.
• P2TRv2 — a Taproot v2 variant, same separation of output container from signature scheme.
• 1-of-2 construction — a transition path where funds are spendable by either a classical ECDSA/Schnorr key or a post-quantum key, letting holders migrate without a hard cutover and without exposing new UTXOs to legacy-only signatures.

For stateful signature schemes (XMSS, LMS), Coinbase argues each should ship with a stateless fallback, because state mismanagement in stateful schemes is itself a forgery vector.

The threat model Coinbase anchors to

• CRQC (cryptographically relevant quantum computer): the capability that would break ECDSA/Schnorr by Shor's algorithm applied to secp256k1.
• Timeline anchor: Google researchers' estimate of a CRQC emerging by 2029, cited in the CoinDesk piece.
• Scope of risk: exposed UTXOs (any address whose public key is already revealed on-chain, including P2PK and spent P2PKH / spent Taproot), plus new deposits during migration. Coins that never move still need a path.

Coinbase enumerates five constraints for any migration design, per The Block: protect exposed and new funds, fit limited block space, preserve full-node validation, work with institutional custody and ordinary wallets, and address coins that never move.

Coinbase direct quotes

All attributed to Coinbase the company — neither source names an individual author:

• "Bitcoin consensus changes and ecosystem migrations can take years, so it is important that we begin this work now."
• "We believe it is important to begin preparing well ahead of any CRQC."
• "When implemented effectively, MPC can provide strong protection against key theft."
• "Coinbase believes that Bitcoin will continue to be the most trusted cryptocurrency in a post-quantum world."

The MPC line is the one that signals corporate posture: Coinbase is a large MPC-custody operator, and the brief is partly a defence of institutional custody as a bridge during the migration — not just a protocol-change advocacy piece.

Why this matters now

Three facts make the brief hard to shrug off:

• Custody weight: Coinbase sits on ~5% of all BTC. A plan that custodians cannot operationalise is a plan that moves no coins. The brief reads as Coinbase pre-committing the custodian side.
• Design maturity: BIP-360 has an active specification site, press summary and ongoing dev-mailing-list review (see a look at post-quantum proposals for Bitcoin for the comparative read). P2TRv2 is less mature in public but travels the same "output container ≠ signature scheme" path. Coinbase endorsing both is a vote for the pattern, not a specific scheme.
• Containers over schemes: the brief treats the choice of post-quantum signature (ML-DSA, SLH-DSA, FALCON, XMSS) as replaceable inside the output format. That is the only design posture that survives NIST's own post-quantum ratification volatility.

Numbers

• Custody share: Coinbase ~5% of all BTC
• CRQC estimate referenced: Google, 2029
• COIN stock at publication: $181.88 (+0.83%), per CoinDesk
• BIP cited: 360 (P2MR); plus the proposed P2TRv2
• Staging primitive: 1-of-2 classical + post-quantum spending path
• State-handling rule: stateless fallback required alongside any stateful scheme

For protocol watchers

1. Watch the bitcoin-dev mailing list for the two post-brief design threads: BIP-360 revisions, and the P2TRv2 specification draft once it circulates.
2. Watch custodian uptake. Coinbase is the first large US custodian to publish a design brief on PQC migration; whether BitGo, Fidelity Digital Assets, Anchorage and the EU-regulated custodians echo the output-container pattern is the readable signal.
3. Watch the stateless-fallback requirement — if the mailing-list consensus accepts it, XMSS/LMS proposals that lack one effectively drop out of the conversation.

Context

Post-quantum work on Bitcoin has moved from research posture to proposal cadence over 2025–2026. BIP-360 was merged into the Bitcoin Improvement Proposals repository earlier this year; adjacent chains have shipped partial work (NEAR's quantum-safe mainnet upgrade in July 2026, Zcash's PQ-key-hiding plan, Starknet weighing L1 status partly for quantum resistance). Bitcoin's constraint is sharper than any of theirs: the UTXO set is the retirement savings of the asset class, and it cannot be migrated by fiat. Coinbase's brief is the first large-custodian claim that the migration should start before the threat model is urgent, not after.