Coinbase’s head of cryptography has flagged a problem sitting between Bitcoin’s quantum defences and the way institutions hold the asset.
The firm safeguards roughly $250 billion for institutions including BlackRock, and it does so using multi-party computation, which splits a private key into shares held by different parties so the whole key is never assembled anywhere.
Yehuda Lindell’s concern is that the post-quantum fix Bitcoin eventually adopts may not work with that method.
Why Hash-Based Is a Custody Problem
Speaking to host Isabel Foxen Duke on MARA Foundation TV, Lindell said Coinbase is designing its post-quantum custody to be agnostic, because nobody yet knows which signature scheme Bitcoin will adopt. “It’s unlikely that there will be a single signing scheme that everybody will use,” he said. “That means we have to be prepared and ready for the different outcomes on different blockchains.”
Not every post-quantum signature scheme is what cryptographers call MPC-friendly. Hash-based signatures in particular may lack the underlying arithmetic structure that makes key-splitting possible.
That absence is not a flaw. It is the reason they are presumed secure against quantum attack. Schemes built on mathematical structure give a quantum computer something to work on, and hash-based schemes deliberately offer none. The same design choice that protects the coins is what makes them awkward to hold in shares.
“MPC-friendliness or non-MPC-friendliness makes a very big difference,” Lindell said. Running MPC over hash-based signatures was assumed impossible until recently. Cryptographers including Dan Boneh are now researching whether it can be done, work set out in a paper called PRAWNS, but it remains highly experimental and nobody knows whether a workable scheme exists. Ledger’s chief technology officer Charles Guillemet has raised similar concerns.
The Leading Candidate Is Hash-Based
This matters more than it might because of what is actually on the table.
SHRINCS, published on 27 August by Blockstream researchers Jonas Nick and Mikhail Kudinov, is a hash-based scheme resting entirely on SHA-256 and built to work with BIP-39 seed recovery. On throughput it is well ahead of the alternatives, reaching roughly three transactions per second with the SegWit witness discount against about 0.5 for ML-DSA and 0.36 for SPHINCS+, which is six to eight times the capacity.
It carries its own costs. Signing is stateful, so a device has to track which one-time keys it has consumed, restoring a seed to a new device forces a fallback to larger stateless signatures, and reusing state can compromise funds. It has no completed formal security proof and no independent cryptanalysis, though it has run in production on the Liquid sidechain since March. It has not been assigned a BIP number.
“SHRINCS is not intended to be Bitcoin’s final signature scheme, and it is not optimal along every axis,” Nick said.
The Fallback, and the Timeline
If Bitcoin does land on something MPC cannot handle, Coinbase is researching a different architecture built on programmable hardware security modules. Keys would be encrypted with post-quantum cryptography and assembled only inside a physically secured module in a private data centre.
That is a step down in principle. Bringing a whole key together in one place, even briefly, is exactly what MPC exists to avoid. Lindell pointed to physical side-channel protections and strict controls on what code can be loaded as the reason he is comfortable with it.
None of this is close. SHRINCS is not expected to activate before 2028 at the earliest, no soft fork is scheduled, and Coinbase has given no timeline for completing its own work. What has happened is that the largest US custodian has said out loud that the upgrade everyone wants may be incompatible with how it currently holds the money.
