Post-quantum crypto security: what exchange users should check

TLDR

On July 23, 2026, Coinbase published one of the clearest exchange-side updates yet on post-quantum preparation. It said its proprietary CoreKMS protects about 99.9% of the assets it custodies, that it has started building a post-quantum version called PQ-CoreKMS, and that it is ranking cryptographic systems across the company by migration priority. That matters because NIST already finalized three post-quantum cryptography standards on August 13, 2024, and Ethereum's official roadmap now openly treats quantum resistance as a long-term engineering program rather than a theoretical footnote. The trust-first conclusion is calm: there is no cited evidence here that mainstream crypto is being broken by quantum computers today, but users should start rewarding platforms that explain their migration path with specifics instead of hype.

Key takeaways

• Coinbase said on July 23, 2026 that it has begun building PQ-CoreKMS, a post-quantum version of its custody key-management stack.
• Coinbase also said CoreKMS currently protects about 99.9% of the assets it custodies.
• NIST finalized FIPS 203, FIPS 204 and FIPS 205 for post-quantum cryptography on August 13, 2024, so the standards layer is no longer purely experimental.
• Ethereum's official roadmap says no quantum computer can break Ethereum today, but it is still building migration paths for signatures, commitments and account security.
• For users, the main risk right now is not a live quantum drain. It is being misled by vague 'quantum-safe' language that does not explain system scope, timing or residual risk.
• CryptoGuide Exchange is an independent research and comparison platform, not an exchange, broker, custodian, investment adviser or legal adviser.

Why this topic matters now

Post-quantum security was easy to ignore when it lived mostly inside academic papers and cryptography conferences. That changed once mainstream crypto companies started describing concrete migration work in public. Coinbase's July 23 update did not promise instant safety or pretend the threat had already arrived. Instead, it described inventory work, custody-stack changes, migration triggers and coordination with external protocol developers. That is a more mature signal than a generic claim that a platform is "future-proof."

The timing also matters because the underlying standards picture is more settled than it was even two years ago. NIST's finalized standards give companies and open-source ecosystems a reference point for what post-quantum preparation can actually build toward. At the same time, Ethereum's current roadmap makes clear that migration is not one button. Different parts of the stack face different problems, and user accounts, validators and zero-knowledge systems do not all move at the same pace.

What changed on the exchange side

Coinbase's post names three concrete workstreams. First, it says the company has begun building PQ-CoreKMS and wants to deliver an automated signing pipeline within the next year that can support post-quantum signature algorithms while keeping strong hardware-backed safeguards. Second, it says Coinbase is completing a company-wide cryptography inventory and ranking systems by criticality, exposure and migration complexity. Third, it says Coinbase is contributing to ecosystem work, including an August 2026 working session with Stanford on Bitcoin migration questions and support for the Bitcoin Security Consortium.

For users, the value of that disclosure is not that it proves Coinbase or any other platform is already quantum-safe. The value is that it gives a checklist for comparison. A serious platform should be able to say what infrastructure is in scope, whether custody systems and customer-data systems are being inventoried, what dependencies sit with underlying chains, and what conditions would trigger a real migration phase.

Who is affected first

The users most affected by this trend are not only institutions. Retail users who keep meaningful balances on exchanges, reuse old wallet addresses, or assume a major brand automatically solves every long-term cryptography risk should pay attention too. Exchange customers are relying on more than one layer at once: the venue's custody setup, the security of the underlying chain, and the wallet or account model that ultimately controls withdrawals.

Self-custody users should also avoid a common shortcut. Moving coins off an exchange does not magically solve every future migration problem if the wallet software, chain rules or signature scheme still need post-quantum upgrades later. The real distinction is between platforms and ecosystems that are mapping the migration path now and those that are not.

Decision checklist before trusting a post-quantum claim

1. Check whether the platform explains which systems are covered: custody keys, customer authentication, internal infrastructure, or only one narrow component.
2. Check whether the company cites recognized standards or protocol roadmaps instead of inventing its own vague terminology.
3. Check whether the platform admits the threat is not immediate today while still explaining why preparation must start early.
4. Check whether the underlying chain or wallet ecosystem has a public migration path for signatures and account security.
5. Check whether the claim includes timing, milestones or trigger thresholds, not only branding language such as quantum-ready or future-proof.
6. Check whether the platform avoids suggesting that exchange balances or wallet funds are already fully protected against a future quantum-capable attacker.

Comparison table: useful signal vs weak signal

What the protocol layer is saying

Ethereum's official roadmap is especially useful because it strips away both complacency and panic. It says no quantum computer can break Ethereum's cryptography today. It also says the ecosystem is already working on four problem areas: consensus signatures, data commitments, account signatures and application-layer zero-knowledge systems. That should remind users that the migration challenge is structural. An exchange cannot honestly claim to solve all of it by itself.

There is an important user-level detail inside that roadmap too. Ethereum notes that ordinary account signatures become more exposed once an account has sent a transaction and revealed its public key onchain. That does not create a present emergency, but it shows why wallet design and signature agility matter. For trust-first users, the right response is not fear. It is to prefer ecosystems that explain how users can migrate when the time eventually comes.

Risk notes

Quantum hype can become a new trust shortcut

Crypto already has too many shorthand badges that users overread: regulated, audited, institution-grade, battle-tested. Quantum-ready can easily become the next one. If a company cannot describe scope and timing, the phrase tells you very little.

Exchange preparation does not equal protocol completion

A venue can improve custody operations without finishing the underlying chain migration problem. That is still useful, but it is not the whole picture. Users should avoid collapsing exchange controls, wallet controls and protocol controls into one story.

Doing nothing early creates pressure later

NIST has already finalized baseline standards, and major crypto infrastructure players are already planning around them. A platform that has no public preparation language at all is not automatically unsafe today, but it does give users less evidence of long-horizon security discipline.

CryptoGuide take

The calm signal to watch is not who uses the scariest quantum headline. It is who can explain migration work with enough precision that a skeptical user can compare it. Coinbase's July 23, 2026 update is worth noting because it names systems, timelines and dependencies while still saying the threat is not imminent. That is the right tone. Users should reward platforms and ecosystems that communicate this way, and discount anyone selling instant quantum safety as if it were a feature toggle.

FAQ

Is quantum computing an immediate threat to crypto exchange users today?

No authoritative source in this article says a cryptographically relevant quantum computer can break mainstream crypto systems today. Coinbase, Ethereum.org and NIST all frame the work as preparation rather than an active theft emergency.

Why does Coinbase's post-quantum update matter if the threat is not immediate?

It matters because it gives users something concrete to compare: custody-key migration planning, cryptography inventory work, trigger thresholds for migration and contribution to open-source protocol work instead of vague marketing.

What should exchange users verify before trusting post-quantum claims?

Verify whether the platform explains what systems are in scope, whether custody and account-security infrastructure are being inventoried or upgraded, whether the chain or wallet ecosystem has a migration path, and whether the message avoids claiming that user funds are already quantum-safe today.

Conclusion

Post-quantum security is becoming a real comparison category, but it is still an early one. As of August 6, 2026, the best user posture is simple: treat detailed migration planning as a positive trust signal, treat vague quantum branding as noise, and remember that CryptoGuide Exchange is here to help users research those differences rather than act as an exchange or custodian itself.

Related pages

• Coinbase July 2026 outage: what exchange users should check
• TrapDoor malware: crypto supply-chain attack explained
• How to store crypto safely
• Wallet safety guides
• Run a trust check

Sources

• Coinbase: What Coinbase is Doing to Prepare for Post-Quantum Cryptography
• NIST: Announcing Approval of Three Federal Information Processing Standards for Post-Quantum Cryptography
• Ethereum.org: Future-proofing Ethereum and crypto quantum security
• Ethereum.org: Post-quantum cryptography on Ethereum
• NIST CSRC: Post-Quantum Cryptography project