Coinbase’s preparations for a possible shift to quantum-resistant Bitcoin signatures are drawing attention to a practical trade-off: preserving the ability to sign after a wallet recovery or server failure may require transactions carrying signatures several times larger than current compact options.
The issue was highlighted after Coinbase chief executive Brian Armstrong called on the crypto industry on October 20 to prepare and cooperate on quantum-resistance work. Operational requirements were detailed in an October 13 Coinbase article by Shashank Agrawal. According to CryptoSlate, the discussion centers on how future signature systems would work with ordinary wallets, backup procedures and custody infrastructure operated across separate servers.
Recovery can trigger the larger signature path
One draft candidate, called SHRINCS, combines a compact, stateful signature with a larger stateless alternative. The compact option depends on maintaining a trustworthy record of which one-time signing slots have already been used. If that record is missing or cannot be trusted, the system must reject stateful signing and use the fallback instead.
The current SHRINCS specification lists a 48-byte public key. Its stateful signatures range from 548 bytes to 4,619 bytes, while the stateless signature is 5,777 bytes. That makes the fallback more than ten times the size of the smallest stateful signature.
The distinction matters because the “state” is not simply the private key. It is a changing record of signing slots used by the key. SHRINCS’ compact XMSS component depends on avoiding reuse of those slots; using the same slot to sign different messages could allow an observer to forge signatures.
A static backup may restore the long-term secret without restoring a reliable record of every signature made after the backup was created. Under the draft’s current rules, that uncertainty requires the signer to use the stateless path. The fallback is based on SLH-DSA, a hash-based signature standard, but uses a parameter set outside those standardized in FIPS 205.
The design therefore preserves a route to signing for a user who can recover the secret, but only by accepting a much larger signature. It also prohibits simply backing up and restoring the mutable counter, or importing it into another program. An old counter cannot safely be treated as the current starting point for compact signatures.
Exchanges face a state-management challenge
The same problem extends beyond individual wallets. Large exchanges commonly operate signing servers independently across different zones to support availability and low latency. Stateful signing would require exclusive access to a key and its current signing state while a signature is being produced, adding operational complexity.
For example, if a server generates a signature but the system cannot determine whether its counter update was successfully recorded, a replacement server needs a reliable way to identify unused signing slots. Restoring an older counter would not provide that assurance.
The draft requires that concurrent signing with the same key state be prevented. It also requires the counter increment to be persistently recorded before the signature is returned to the caller. The counter must never move backward, and its storage must be protected from unauthorized modification and rollback.
These restrictions do not mean an exchange would have to halt activity for every key whenever one key is being used. Agrawal’s discussion presents SHRINCS as a candidate for evaluation and emphasizes the value of a stateless-only operating mode when reliable state cannot be maintained. Coinbase says its custody business covers approximately 12% of all BTC in existence, underscoring why recovery and signing-server procedures are material considerations for large custodians.
Larger signatures affect transaction weight, not automatically the fee
The 5,777-byte fallback does not translate directly into a transaction fee that is 10 times higher. Bitcoin transactions include additional information, and witness data is treated differently from other transaction bytes under the network’s accounting rules.
Under BIP 141, transaction weight equals three times the stripped transaction size plus the total transaction size. Virtual size is the weight divided by four, rounded up. A byte in the signature’s witness data contributes one weight unit, while prefixes and other serialization elements also count.
In a deliberately simplified one-signature example, all other data is held at 400 weight units and the fee rate is fixed at 10 satoshis per virtual byte. Comparing the draft’s signature sizes, the stateless fallback adds 13,080 satoshis relative to the 548-byte minimum stateful signature, or 2,900 satoshis relative to the 4,619-byte maximum stateful signature.
Those figures are only the hypothetical calculation described in the source material, not a projected Bitcoin fee. Actual costs would depend on deployment rules, transaction design and the fee market at the time. A self-custody user recovering a wallet would need to account for the added weight when constructing a transaction. A custodian would face both the cost of maintaining reliable signing state and the additional weight of transactions using the fallback.
Whether such costs would be absorbed by a service provider or passed to customers has not been established.
Partitioning could reduce coordination risks
Stateful signing does not necessarily require one universally shared counter. Informational RFC 10033, published in September, describes approaches including sectorization, reserved intervals and controlled transfers of key and state material.
Sectorization divides the available signing space into nonoverlapping sections that can be managed by separate devices. This could permit parallel signing without requiring every device to coordinate each signature with all others. For Bitcoin custody systems, such designs offer an engineering route that can be assessed alongside stateless-only operation.
SHRINCS remains a draft. Its security proof and fully optimized implementation are still unfinished, so the practical consequences of deploying it have not been settled. Armstrong’s call renewed attention to the issue, while Coinbase’s operational requirements provide tests for future designs, including interrupted writes, server replacement and wallet restoration.
The current fallback makes the central trade-off clear: when trustworthy state is unavailable, signing capability is preserved through a larger signature. Retaining the compact option requires confidence that ordinary failures will not cause signing-slot reuse.
Current Bitcoin market picture
Moneyiar data at 11:14 on October 21, 2026, shows Bitcoin at $83,343.13, up 2.29% over 24 hours and down 0.05% over seven days. Bitcoin is ranked No. 1 by market capitalization. Quant was at $200.55, up 3.48% over 24 hours and down 3.44% over seven days; Compound stood at $25.62, up 8.75% and 12.49%, respectively; and Nexus was $0.0000006829, up 2.69% over 24 hours and down 10.79% over seven days.
