Google has achieved a significant milestone in quantum computing research, demonstrating a practical solution that cuts quantum errors by 40-fold on its Willow chip. According to research published in Science this week, Google's magic state cultivation method reached 99.99% fidelity, a record accuracy level that could substantially reduce the size of future quantum computers needed for practical tasks. While Google's current Willow chip has only 105 qubits - far below the estimated 500,000 qubits needed for a Bitcoin-cracking quantum computer, the breakthrough addresses one of quantum computing's most severe resource bottlenecks. This development puts renewed focus on the 6.04 million BTC currently stored in addresses with visible public keys, worth approximately $494 billion at current prices of $81,857 per coin. A Google white paper published in March estimated that breaking Bitcoin's security would require 1,200 to 1,450 logical qubits, while Google's Willow chip has only 105 qubits, with IBM targeting 200 logical qubits by 2029 and 2,000 by 2033.
Coinbase has urged Bitcoin developers to begin preparing for quantum computing threats before a machine capable of breaking its cryptography is announced, warning that the transition will require years of advance preparation. According to the company's latest analysis, protecting Bitcoin will involve more than selecting a new digital signature system, requiring consideration of transaction fees, network capacity, wallet compatibility and independent verification capabilities of Bitcoin nodes. The company, which holds approximately 5% of all existing BTC in custody, emphasized that changes to Bitcoin's shared rules and fund movement across the ecosystem can take years, making advance preparation critical even before the threat becomes certain. Coinbase described the migration as a complex, multiyear undertaking that requires immediate attention from the community, with the company stating 'We believe it is important to begin preparing well ahead of any CRQC announcement'. The timing matters significantly as quantum computing is not currently shown to be breaking Bitcoin's signatures, but the transition itself could take years, creating room to evaluate designs and upgrade infrastructure.
Among the proposed technical approaches, Coinbase identified BIP-360 and P2TRv2 as flexible designs worth considering for Bitcoin's quantum-resistant transition. BIP-360 introduces Pay-to-Merkle-Root (P2MR), a proposed transaction output type derived from Bitcoin's existing Taproot architecture that removes key-path spending options and protects against long-exposure attacks involving public keys. The company suggested a hybrid wallet approach with two alternative spending methods, allowing users to authorize transactions through existing ECDSA or Schnorr signatures while maintaining a separate post-quantum key for quantum-resistant security. Coinbase recommended evaluating post-quantum-only outputs for early adopters and mechanisms to reduce public-key exposure during transactions. A suitable design would conceal public keys until needed, avoid a spending route vulnerable to quantum attacks and allow future signature algorithms to be added without rebuilding the entire structure. The exchange points to P2MR, associated with BIP-360, and P2TRv2 as examples under consideration, with flexible outputs allowing quantum-resistant signatures to be added, replaced, or combined as the technology and security assessment evolve.
Coinbase supports an approach that lets active wallets start using quantum-resistant, or hybrid, signatures before Bitcoin finalises its rules for older signature types. One possible transition would be a "1-of-2" setup: the same bitcoin could be spent using either a traditional ECDSA or Schnorr key, or a post-quantum key. This would let users protect their funds earlier, without forcing everyone to switch at once or risking a sudden loss of access. The company emphasized that separating the 'container' from the signature is crucial, allowing Bitcoin's transaction format to support new post-quantum signature types without needing to rebuild the whole system. Coinbase hopes the evaluation process gives strong weight to software that works reliably across platforms, verifies signatures consistently everywhere, avoids leaking secret information through timing, uses clear settings, and remains safe even if the random-number generator used during signing fails. The immediate development task is not to declare one output type or signature scheme the winner, but to assess flexible designs, implementation risks, and institutional compatibility while keeping the politically difficult legacy-coin debate from becoming a prerequisite for starting the broader upgrade work.
For institutional custody, Coinbase emphasized that new signature systems should remain compatible with multiparty computation (MPC) security techniques, which allows multiple participants to cooperate in signing without placing all signing authority in one location. The company described MPC as an important defense against key theft for organizations facing persistent attacks. Coinbase proposed maintaining stateless signing options if Bitcoin eventually supports stateful post-quantum algorithms, recommending that developers provide clear instructions for managing signing state and recovering safely from failures. The company recommended that designs work only for individual wallets could leave exchanges, custodians, and large businesses with a slower or less practical migration path. For exchanges, the challenge extends to coordinating servers operating independently across different locations, requiring systems that can process signatures quickly and remain available during failures. The implementation quality is another requirement, not a secondary engineering detail, with Coinbase calling for consistent verification across platforms, protection against timing leaks, clear settings, and resilience if the random-number generator used in signing fails.
Coinbase identified several categories of Bitcoin requiring attention, including wallets with permanently exposed public keys, reused keys, dormant holdings still controlled by their owners and funds whose keys or recovery information have been lost. Glassnode estimates that 6.04 million BTC sit in addresses with exposed public keys, representing 30.2% of the mined Bitcoin supply. The research separated exposed holdings into two categories: approximately 1.92 million BTC were classified as structurally exposed because their address formats revealed public keys by design, while another 4.12 million BTC were considered operationally exposed through practices such as address reuse and partial spending. A June study estimated that 2.3 million BTC cannot be moved - they are lost, dormant, or date back to Bitcoin's earliest days. The company warns that a covert attacker with a CRQC could target vulnerable coins before the capability becomes public, with any recovery mechanism requiring quantum-safe implementation. Potential responses discussed include restrictions on older signatures, freezes, limits on spending and mechanisms to rescue funds, though Coinbase emphasized that any rescue mechanism would have to demonstrate it could withstand quantum attacks and could not be exploited by an attacker who knew only an exposed public key.
Coinbase's latest publication did not establish a deadline for Bitcoin users to migrate, endorse a specific final signature algorithm or announce a proposed activation date. The company called for a reproducible evaluation process comparing alternative signature systems under realistic network conditions, stating that no single solution may satisfy Bitcoin's technical limits and the needs of every user, custodian and institution. Coinbase has already begun preparing its own custody systems for post-quantum security, including discussions with Bitcoin researchers, engineering contributions to open-source projects and participation in the Bitcoin Security Consortium. The company is pushing for a quantum-safe custody system, PQ-CoreKMS, by next year and plans to support various PQ signatures. Interestingly, other players such as Project Eleven are also advancing a similar custody platform that can offer a dedicated operational layer despite the evolving and different PQ systems for various blockchains. Coinbase concluded by acknowledging its gratitude to researchers, developers and builders already working on these questions and looking forward to continuing collaboration with the community on Bitcoin's post-quantum future.
