Coinbase's Post-Quantum Problem Is Not Which Signature Bitcoin Picks, It Is That Hash-Based Signatures Break MPC - So the $250B Fallback Is Keys Reassembled Inside an HSM
The setup. Coinbase custodies about $250 billion for institutions including BlackRock, and its Head of Cryptography Yehuda Lindell has said publicly that the firm will not bet on one post-quantum scheme: "It's unlikely that there will be a single signing scheme that everybody will use... we have to be prepared and ready for different outcomes on different blockchains." The stated goal is to be able to say "I can support anything."
The actual engineering problem. Institutional custody today rests on multi-party computation: the private key is never assembled, shares sign jointly. That works because ECDSA and Schnorr have arithmetic structure that lets you split keys and combine partial signatures. Lattice schemes (ML-DSA) are workable in MPC with effort. Hash-based schemes (the SLH-DSA/XMSS family that conservative Bitcoin proposals favour precisely because they rely on nothing but hash security) have no such structure, and Lindell is blunt that "MPC-friendliness or non-MPC-friendliness makes a very big difference." Coinbase points to the PRAWNS paper (co-authored by Dan Boneh) as the research frontier for hash-based signatures inside MPC, and it is not a solved problem.
The fallback, and why it is a step backwards. If a chain adopts a non-MPC-friendly scheme, Coinbase's plan is post-quantum threshold DECRYPTION feeding programmable hardware security modules in its own data centres: key shares are PQ-encrypted, and the full key is reconstituted only inside the HSM at signing time. That preserves quantum resistance but temporarily concentrates the key in one physical device, which is exactly the property MPC was adopted to eliminate. It is a deliberate trade: single-point-of-compromise risk bounded by HSM physical security, in exchange for supporting any signature scheme.
Timeline and governance. Coinbase says it will deliver an automated signing pipeline within roughly a year that can switch to quantum-safe custody as soon as a chain adopts a PQ scheme; it formed an Independent Advisory Board on Quantum Computing and Blockchain earlier in 2026; and it is a founding member of the Bitcoin Security Consortium alongside BlackRock, Fidelity Digital Assets and Block, which funds and staffs open-source work on proposals such as BIP-360 (the output-type proposal that would let coins be locked to post-quantum scripts). No funding amount has been disclosed.
What this means for bitcoin holders. Two things are being conflated in coverage. First, whether Bitcoin will adopt a PQ signature at all is a consensus question with no timeline. Second, whether the largest custodians can operate securely under whichever scheme is chosen is an engineering question, and the answer for hash-based schemes today is "yes, but only by reintroducing single-location key assembly." Neither the $250 billion figure nor the "playbook" language should be read as a claim that any custodied BTC is protected now: no BIP is activated, and there is nothing to migrate to yet.
Sources (4)
AI Research
Key Takeaway
Coinbase's PQ custody plan is scheme-agnostic because hash-based signatures do not split under MPC; its fallback reassembles keys inside programmable HSMs, trading MPC's no-single-point property for the ability to support any scheme Bitcoin picks.
The setup. Coinbase custodies about $250 billion for institutions including BlackRock, and its Head of Cryptography Yehuda Lindell has said publicly that the firm will not bet on one post-quantum scheme: "It's unlikely that there will be a single signing scheme that everybody will use... we have to be prepared and ready for different outcomes on different blockchains." The stated goal is to be able to say "I can support anything."
The actual engineering problem. Institutional custody today rests on multi-party computation: the private key is never assembled, shares sign jointly. That works because ECDSA and Schnorr have arithmetic structure that lets you split keys and combine partial signatures. Lattice schemes (ML-DSA) are workable in MPC with effort. Hash-based schemes (the SLH-DSA/XMSS family that conservative Bitcoin proposals favour precisely because they rely on nothing but hash security) have no such structure, and Lindell is blunt that "MPC-friendliness or non-MPC-friendliness makes a very big difference." Coinbase points to the PRAWNS paper (co-authored by Dan Boneh) as the research frontier for hash-based signatures inside MPC, and it is not a solved problem.
The fallback, and why it is a step backwards. If a chain adopts a non-MPC-friendly scheme, Coinbase's plan is post-quantum threshold DECRYPTION feeding programmable hardware security modules in its own data centres: key shares are PQ-encrypted, and the full key is reconstituted only inside the HSM at signing time. That preserves quantum resistance but temporarily concentrates the key in one physical device, which is exactly the property MPC was adopted to eliminate. It is a deliberate trade: single-point-of-compromise risk bounded by HSM physical security, in exchange for supporting any signature scheme.
Timeline and governance. Coinbase says it will deliver an automated signing pipeline within roughly a year that can switch to quantum-safe custody as soon as a chain adopts a PQ scheme; it formed an Independent Advisory Board on Quantum Computing and Blockchain earlier in 2026; and it is a founding member of the Bitcoin Security Consortium alongside BlackRock, Fidelity Digital Assets and Block, which funds and staffs open-source work on proposals such as BIP-360 (the output-type proposal that would let coins be locked to post-quantum scripts). No funding amount has been disclosed.
What this means for bitcoin holders. Two things are being conflated in coverage. First, whether Bitcoin will adopt a PQ signature at all is a consensus question with no timeline. Second, whether the largest custodians can operate securely under whichever scheme is chosen is an engineering question, and the answer for hash-based schemes today is "yes, but only by reintroducing single-location key assembly." Neither the $250 billion figure nor the "playbook" language should be read as a claim that any custodied BTC is protected now: no BIP is activated, and there is nothing to migrate to yet.