Coinbase published a summary on September 9 of a Post-Quantum Bitcoin Workshop organized with Stanford cryptographer Dan Boneh and Localhost Research.

Bitcoin developers, cryptographers, institutional custodians and hardware-wallet specialists met to examine what a credible post-quantum transition would require before quantum computers become a practical threat.

The group did not select a new signature scheme, and Coinbase explicitly says the risk is not an immediate crisis. Nobody knows the precise date on which a cryptographically relevant quantum computer might arrive.

The problem is that a Bitcoin-wide migration would likely take years even after the technical answer is known.

SHA-256 is not the immediate problem

Quantum discussions around Bitcoin often begin with SHA-256, but mining hashes are not the most direct concern.

The more important target is public-key cryptography. Bitcoin uses elliptic-curve signatures to prove that a spender controls the private key associated with an output. That includes ECDSA and the Schnorr signatures introduced with Taproot, both built around secp256k1.

A sufficiently capable fault-tolerant quantum computer running Shor's algorithm could theoretically solve the discrete logarithm problem efficiently enough to derive a private key from its public key.

Existing quantum computers cannot perform that attack against Bitcoin. It would require a cryptographically relevant machine with enough logical qubits, error correction and reliable runtime to execute an extremely demanding calculation.

Not every Bitcoin output exposes the same quantum attack surface

Some early Pay-to-Public-Key outputs place their public keys directly onchain. That includes many coins created during Bitcoin's earliest mining era.

Those keys are already available to an attacker indefinitely, which makes them candidates for what BIP 360 calls long-exposure attacks.

Taproot outputs also expose a public key through their normal key-path construction, so BIP 360 places P2TR in the long-exposure category as well.

Formats such as P2PKH and P2WPKH generally hide the public key behind a hash until the owner spends the output.

That provides useful protection against an attacker that needs months or years to recover a key, but it is not a complete post-quantum solution. A sufficiently fast quantum computer could theoretically attempt recovery after the public key appears in the mempool and before the transaction confirms.

BIP 360 deliberately removes Taproot's exposed key path

One proposal currently being discussed is BIP 360, Pay-to-Merkle-Root, or P2MR.

P2MR reuses much of Taproot's script-tree design but removes the direct key-path spend. Instead of committing to an internal elliptic-curve key, an output commits to the Merkle root of a script tree.

The proposed mainnet address format uses SegWit version 2 and begins with bc1z.

Because the output itself does not expose an elliptic-curve public key, it can resist long-exposure quantum key-recovery attacks when used appropriately.

The proposal is equally clear about what it does not solve. P2MR is not itself a post-quantum signature algorithm. Public keys revealed during spending can still create a short-exposure attack window.

Full protection probably requires a new signature primitive

A complete migration would eventually need digital signatures believed to remain secure against large-scale quantum computers.

That technology already exists outside Bitcoin. NIST finalized ML-DSA, derived from CRYSTALS-Dilithium, and SLH-DSA, derived from SPHINCS+, as post-quantum digital-signature standards in 2024.

Neither automatically makes a good Bitcoin signature scheme.

Post-quantum keys and signatures are generally much larger than the compact secp256k1 signatures Bitcoin uses today. On a blockchain, every additional byte has to be transmitted, validated and ultimately stored across the network.

A signature format that works perfectly well for an enterprise document can therefore be much less attractive when thousands of signatures have to fit into blocks.

Coinbase says the Stanford workshop compared possible schemes across security, transaction size, hardware performance, key management and migration complexity.

No single option emerged as the final answer.

BIP 361 asks the harder question: what happens to legacy coins?

Introducing a quantum-safe output is only half the problem. Existing holders then have to move their funds.

BIP 361 is a draft proposal describing a phased post-quantum migration after a true post-quantum signature output type exists.

Its first phase would eventually stop users from creating new outputs protected by quantum-vulnerable legacy signatures, reducing the number of new coins entering the old cryptographic system.

Later stages contemplate a sunset for traditional ECDSA and Schnorr spending.

At that point, the problem becomes as much a governance question as a cryptographic one.

Lost bitcoin creates a problem with no clean answer

Some coins belong to people who have lost their keys, died without transferring them or simply never return to migrate their wallets.

If vulnerable cryptography remains valid forever, a future quantum attacker could potentially recover those funds.

If the protocol eventually disables those signatures, the coins become unspendable even if a legitimate owner later returns with the original private key.

Coinbase's Quantum Advisory Council published a separate report on this dilemma in June and deliberately avoided prescribing a single answer.

Allowing quantum recovery effectively redistributes abandoned coins toward whoever first controls the required computing capability. Freezing them permanently changes the historical spending rules.

Cryptography alone cannot decide which outcome is preferable.

Hardware wallets may become one of the migration bottlenecks

Even after Bitcoin developers settle on an algorithm and consensus change, the surrounding ecosystem has to support it.

Hardware wallets run on constrained processors with limited memory and storage. Some post-quantum schemes demand significantly more of all three than secp256k1.

Exchanges and institutional custodians would have to migrate large key estates while preserving backup systems, multisignature policies, HSM integrations and operational controls.

That was one of the workshop's central conclusions: post-quantum Bitcoin is not simply a Bitcoin Core patch.

The entire custody stack has to move with it.

The quantum date is unknown, but migration times are not

NIST is already encouraging conventional computing systems to begin moving toward post-quantum cryptography and has laid out transition planning for eventually retiring several quantum-vulnerable public-key algorithms.

That does not provide a countdown to a Bitcoin-breaking quantum computer.

It reflects a different concern: cryptographic infrastructure takes a long time to replace.

Bitcoin makes that transition particularly difficult because no company can unilaterally deploy a new signature scheme and force every user to adopt it.

BIP 360 and BIP 361 remain drafts. Bitcoin has not activated a post-quantum replacement for ECDSA or Schnorr.

The meaningful shift is therefore not that Bitcoin has suddenly become unsafe. It is that the discussion is moving from whether a migration might someday be necessary to how the network could perform one without breaking two decades of accumulated ownership.