Last month I sat in a co-working space in Yaba, watching a developer named Tunde try to explain public-key cryptography to a room of fifteen traders. He drew an elliptic curve on a whiteboard, erased it, drew it again. Someone asked the obvious question: 'If the key is public, can't someone just... take the money?' Tunde paused for four seconds. 'Not yet,' he said. 'That's the whole answer. Not yet.'
That pause is where Coinbase has now planted a flag. The exchange recently published its position on Bitcoin's quantum exposure, framing it as a long-horizon engineering problem rather than an emergency—and pointing toward BIP-360 as the kind of proposal the network will eventually need to examine. It is a sober statement. It is also, read carefully, one of the most consequential things a major custodian has said about Bitcoin's technical future in years, precisely because of what it leaves unsaid.
Let me establish what this actually is. Bitcoin's ownership model rests on digital signatures—ECDSA for legacy addresses, Schnorr for Taproot spends. A sufficiently capable quantum computer running Shor's algorithm could derive a private key from an exposed public key. The threat is not theoretical in the abstract; it is theoretical in the timeline. BIP-360, in its current form, proposes a new output type constructed to be post-quantum resistant, built on the assumption that hash functions survive where elliptic curve discrete logarithms do not. It is a draft. It has not been activated. It has not been merged into consensus rules. The single most important sentence anyone can write about BIP-360 is that it changes nothing today—and that this is exactly why the conversation is happening now.
Here is where my audit experience pulls me in a different direction than the press release. Most coverage frames the quantum threat as a problem of 'future transactions.' That framing is comfortable and wrong. Addresses generated under P2PKH, P2WPKH, and P2TR reveal nothing about the public key until the moment of spend, which means those coins can, in principle, be migrated offline, quietly, without any attacker ever seeing a key. But P2PK outputs—the format Satoshi's early miners used—broadcast the public key to the chain at creation and leave it there forever. So do any addresses that have been reused across multiple transactions. So does every transaction that has been signed, broadcast, and then stuck unreplaced in the mempool.
For that cohort of coins, the attack model is not 'break a key in real time.' It is record now, forge later: an adversary with a cryptographically relevant quantum machine in 2035 can take a snapshot of exposed public keys from 2011 blocks and work backward at leisure. The coins do not need to move. They were already surrendered the moment they were mined.
I spent the 2022 bear market writing fifty deep-dives on why exchange collapses happen, and the pattern I kept finding was the same: the risk was always visible in the architecture, and always dismissed because the failure had not yet occurred. Coinbase's mention of 'older unspent coins' is a single clause. It deserves a chapter. The dormancy question is not a footnote to the quantum debate—it is the debate, and it lands immediately in governance territory that Bitcoin has never resolved: if a protocol change could freeze or force-migrate a set of coins, who holds the authority to do it? There is no precedent. There is no legal framework. Under most jurisdictions the takings question alone would take a decade to litigate, and that is assuming anyone could even identify the rightful owner of a P2PK output whose key has been lost since 2010.
Now the part the optimists will not enjoy. Bitcoin's deliberate pace is its greatest virtue and, in this specific scenario, its structural liability. SegWit took years to activate. Taproot took years more. Both were changes with clear, immediate, developer-visible benefits. A post-quantum migration offers none—it degrades block space, inflates signature sizes by orders of magnitude, fragments address formats, and demands that hardware wallet manufacturers, custody HSMs, and Lightning's MuSig2 channel stacks all ship compatible firmware in sync. Hardware security certification cycles run twelve to twenty-four months on their own. The real migration window is not the protocol layer's estimate; it is the protocol layer's estimate plus two years of silicon, plus however long it takes the wallet ecosystem to care.
And here is the contrarian edge that the bull market will not price. Post-quantum signature schemes carry their own unexploded ordnance. NIST's standardization process has already seen candidate schemes fall—Rainbow in 2022, SIKE shortly after—both under classical cryptanalysis, not quantum attack. Locking a monetary system's ownership security to a signature family that is ten years old and still under active review is a different kind of debt. We may be trading a known, well-understood, twenty-year-old curve for a newer one whose failure modes we have not yet mapped. The designers know this. The marketing does not.
I do not doubt Coinbase's sincerity here. As a listed custodian, it has a genuine operational need for multi-year planning horizons, and its technical framing—distinguishing signature systems from hash functions—suggests the statement came out of an engineering team, not a communications desk. That distinction matters. It means the threat grading was done.
But sincerity is not the same as leverage. Coinbase does not write BIPs. It cannot activate soft forks. What it can do is create commercial demand: the moment a major ETF custodian or a regulated auditor requires attestable post-quantum controls over client assets, the wallet ecosystem will find its motivation far faster than any mailing list thread could generate it. That is the accelerator nobody is modeling—regulatory pressure transmitted through custodians, not through the community.
Trust the process, but verify the code. The process here is a multi-year argument among miners, node operators, wallet providers, and a hardware industry that has not yet been invited. The code is a draft BIP that protects no one until it does. Neither the quantum machine nor the protocol is the bottleneck. The bottleneck is a consensus culture that was built to say no, being asked to say yes to something with no upside except survival—and doing it on a clock it did not set, for a threat that will not knock politely when it arrives.
