Mentioned in This Article
1. A Penalty Aimed at the Thief
Cory Fields, a Bitcoin Core developer who works on Bitcoin software at the Massachusetts Institute of Technology's Digital Currency Initiative, proposed in early November a mechanism he calls quantum landmines. Posted to the bitcoin-dev mailing list, the idea would force anyone who spends vulnerable coins to lock up matching collateral, which a prepared owner could claim by revealing a hidden proof of ownership. Fields describes it as a thought experiment.
The approach differs from most proposals in the quantum computing bitcoin debate. Instead of closing off old coins or demanding that everyone migrate, it tries to change the economics of theft, so that an attacker risks losing money of their own before gaining anyone else's.
Fields is explicit that the concept is early. It presumes that Bitcoin first adopts quantum-safe wallets, and the rules needed to enforce the scheme have not been written. The proposal is best read as a contribution to a long-running argument rather than a plan headed for deployment.
2. Why Does Quantum Computing Threaten Bitcoin?
A sufficiently powerful quantum computer could work backward from a wallet's public key to the secret key that controls the funds. Bitcoin's current signature schemes rely on mathematical problems that are practically unsolvable for ordinary machines but, in theory, within reach of a large quantum system running the right algorithm. No such machine exists today, and the moment one does is often called Q-day.
The risk is not equal across all coins. Some early bitcoin payments exposed public keys directly on the blockchain from the start, which leaves the holders of those outputs more exposed than owners of addresses whose keys have never been revealed. Coins associated with Bitcoin's pseudonymous creator, Satoshi Nakamoto, are among the holdings commonly mentioned as potential targets for that reason.
Whoever controlled a quantum computer of that kind could forge valid signatures and move the funds, and the network would see nothing wrong, because the transaction would carry a signature that checks out. That is the core of the problem: Bitcoin cannot tell a rightful owner from a thief who has derived the key.
3. The Freeze Debate That Came Before
Developers have spent months weighing what to do about coins that quantum machines could eventually reach. One camp supports freezing vulnerable coins, so that no one can spend them once the threat becomes real. The other prefers to leave them spendable by anyone who can produce a valid signature, on the grounds that the protocol should not seize property.
Each option carries a cost. A freeze would stop thieves, but it would also lock out owners who never upgraded their wallets, including people who are alive and still hold their keys. Leaving the coins open avoids that confiscation, yet it would reward whoever builds the first capable machine with a large pool of funds.
Fields's proposal tries to sit between those positions. Coins would stay spendable and nothing would be frozen by decree, but a thief would face a penalty that an owner can arrange in advance.
4. How Would the Landmine Work?
The scheme attaches a financial penalty to attempted theft. In Fields's example, an attacker who wants to take 1 BTC must also supply 1 BTC from a quantum-safe wallet as collateral. Both the stolen coins and the collateral are then locked for a waiting period, such as 30 days, before they can be spent again.
Before quantum attacks become feasible, an owner who wants protection creates a separate quantum-safe output, the landmine, that holds hidden proof the owner controls the vulnerable coins. If a thief later drains those coins, the stolen bitcoin and the thief's collateral are both locked. During the waiting window, the owner can reveal the proof, recover the original bitcoin and keep the collateral as a penalty.
A central feature is that the attacker cannot see which holdings are trapped. A thief has to commit their own money before learning whether a given wallet has been prepared, and that uncertainty is meant to make theft a gamble rather than a guaranteed payout.
The design also gives owners a reason to act early. Fields uses a hypothetical holder named Alice, who could bait a quantum attacker before Q-day. If the attacker succeeds, Alice would effectively double her vulnerable coins, recovering them and collecting the thief's collateral on top.
5. Fields's Own Walkthrough
In a passage from his message, Fields explains the sequence in terms of that example. An attacker who had no pre-Q-day knowledge of Alice's key must wait 30 days before re-spending the stolen coins. In the meantime, Alice notices the transaction and spends the output sitting in limbo to her committed key, using her landmine as an input and revealing the proof.
The result, in his description, is that Alice gets her own coins back and takes the attacker's collateral as well. The delay is what makes this possible, because it gives the true owner a window to respond before the thief can move the funds onward.
The waiting period therefore does most of the work. Without it, a thief could drain a wallet and relocate the proceeds before anyone reacted, and the collateral would offer no protection to the victim.
6. The Limits for Lost Coins and Honest Holders
The proposal has a clear limitation: it only helps owners who still hold their keys. Coins that have been lost, including those believed to belong to Satoshi Nakamoto, cannot be protected by a landmine because nobody remains who can set one or reveal the proof. Earlier estimates of quantum exposure have suggested that as many as 6.9 million BTC could be drained, and much of that would fall outside the scheme's reach.
For that category, Fields sketched a separate design built around an auction for inactive coins. Rival network participants would place hidden bids on a vulnerable wallet in advance. If a quantum thief attacks it, the highest bidder's smart contract would fire automatically, destroying the targeted coins and sending the thief's locked collateral to the winning bidder as a bounty.
The mechanism would also impose costs on honest users. Because the blockchain cannot distinguish a thief from the real owner, moving one's own 1 BTC would require another 1 BTC of collateral under the same rules. An early holder with a large amount in an old wallet would need matching funds just to move it, which could be a significant burden.
7. Why Collateral Changes the Calculation
Theft is normally a one-sided bet for an attacker: the only cost is the effort of the attack, and the reward is whatever the stolen wallet holds. Requiring collateral turns that into a bet with downside. If even a fraction of vulnerable wallets carried a hidden landmine, a rational attacker would have to price in the chance of forfeiting the collateral, and the expected profit from any single theft would shrink.
Because the attacker does not know which wallets are trapped, the deterrent does not depend on every owner participating. It depends on enough owners participating that the risk becomes credible. That property is part of what Fields means by emphasizing economic disincentives over cryptographic upgrades: the protection comes from the incentives around a theft, not from making the stolen signature impossible to forge.
The collateral must also come from a quantum-safe wallet, which means the attacker would need to hold bitcoin in an address type that a quantum machine cannot break. That requirement ties the whole scheme to the earlier adoption of such wallets, and it is the reason Fields frames the design as dependent on infrastructure Bitcoin has not yet built.
8. How This Compares With Cryptographic Upgrades
The more conventional answer to the quantum threat is to move Bitcoin to signature schemes designed to resist quantum attack and to encourage owners to shift their coins to new address types. That route addresses the root cause, but it requires every holder to act, and coins whose owners are absent or have lost access would remain exposed indefinitely.
The landmine idea is not a replacement for that migration. It is aimed at the gap that remains afterward, where some coins are still sitting in vulnerable outputs and a capable attacker might try to take them. In that sense it works as a second layer: owners who are attentive can protect themselves, and the collateral requirement discourages attempts against owners who are not.
Trade-offs remain. The scheme adds complexity to transactions, requires new rules for how locked funds are handled, and raises the price of moving old coins legitimately. Developers evaluating it will have to weigh whether those costs are acceptable against the alternatives of freezing coins or leaving them open to capture.
9. What Happens Next
Fields calls the ideas thought experiments, and they depend on conditions that do not yet exist. Bitcoin would first need quantum-safe wallets, and the specific rules for collateral, waiting periods and enforcement have not been drafted. Any change to Bitcoin's consensus rules would also have to move through the network's careful review process and win broad support from developers, miners and node operators.
For now the proposal stands as one more entry in the discussion about how Bitcoin should defend itself against a threat that is not yet practical but that developers increasingly treat as a long-term planning problem. Readers can expect further responses on the mailing list, where designs of this kind are tested and often revised.