Mentioned in This Article
1. A proposal that turns quantum theft into a gamble
On November 4, Bitcoin developer Cory Fields published a post on the Bitcoin development mailing list proposing "quantum landmines" and two auction mechanisms. Under the quantum computing Bitcoin scenario he describes, anyone who used a future quantum machine to spend exposed coins would first have to put up their own Bitcoin as collateral, and could lose it to the rightful owner.
Fields described the ideas as "thought experiments" rather than a finished upgrade. No part of the design exists in Bitcoin today, and no activation schedule or detailed implementation has been published. The proposal is nonetheless a notable entry in the long-running debate over how the network should respond if quantum computers ever become capable of breaking its cryptography.
Instead of trying to block every vulnerable coin from moving, the approach tries to change the economics of an attack. A thief who cannot be sure whether a given wallet is booby-trapped, and who must risk a sum equal to the loot, faces a bet that may no longer be worth placing.
2. Why do quantum computers threaten Bitcoin wallets?
Quantum computers threaten Bitcoin because a sufficiently powerful machine running Shor's algorithm could work out a private key from the matching public key. Today's conventional computers cannot realistically do this, which is the foundation of Bitcoin's security model.
Ownership on the network rests on a pair of keys. The private key is a secret that authorizes a transaction, while the public key lets every other participant check the resulting signature without learning the secret. If a quantum machine could recover the private key from the public one, a thief could sign a spending transaction that the network would accept as genuine, as though the owner had issued it.
Exposure is uneven. Some older output types already reveal the public key on the blockchain, and certain newer formats do too. Other address types keep the public key hidden until the owner spends from them, which leaves them less exposed until that moment. Which coins are at risk therefore depends on how and when each wallet was created and used.
Researchers refer to the hypothetical day when such a machine appears as "Q-Day." No publicly demonstrated quantum computer can steal Bitcoin in this way, and nobody knows when one might emerge. The debate is about preparation, not an attack under way.
3. Why does deterrence matter for Bitcoin's design?
Bitcoin is an open network with no central party that can reverse a transaction or declare a spend illegitimate. Whatever the protocol accepts as valid is final, which is why the question of how it treats signatures from a quantum-capable attacker is so consequential. A valid signature is, by definition, proof of ownership in the eyes of every node.
That property is what makes quantum computing a distinctive concern for the asset. Many security failures in finance can be remedied by a bank, a court or an administrator. On Bitcoin, if a signature can be forged by a machine that recovers private keys, the network has no built-in way to ask who the real owner was. Fields' idea tries to give the protocol a way to ask that question after the fact, using evidence the owner prepared in advance.
The approach also reflects a practical reality about adversaries. An attacker with a quantum computer would presumably be motivated by profit. If the expected return from attacking exposed wallets can be pushed below the expected cost, the rational choice is to leave them alone, even if the technical ability to attack remains.
4. How does a quantum landmine work?
A quantum landmine is a hidden proof, created before Q-Day, that lets a legitimate owner reclaim coins after a thief has moved them. Fields illustrates it with an owner who holds 1 BTC in an old wallet that could become vulnerable.
Ahead of Q-Day, while theft is still impossible, that owner creates a small, separate output protected by quantum-safe rules. Inside it sits concealed evidence that the owner controlled the original private key at a time when nobody else could have. Fields compares it to a sealed receipt of ownership. Outside observers can see the small output on the blockchain but cannot read the evidence or tell that it is a trap.
Now suppose a future attacker recovers the old key and tries to spend the 1 BTC. Under the proposed rules, the attacker must add 1 BTC of their own, drawn from a quantum-safe wallet, as collateral. Both amounts, 2 BTC in total, move into a restricted output rather than straight into the thief's hands.
That output carries a challenge period before it can be spent freely, and Fields uses 30 days in his example. During the window, the owner can notice the transaction and reveal the pre-Q-Day proof. The network would then allow the owner to send the full 2 BTC to the quantum-safe address committed to earlier. Because attackers cannot see which wallets hold such receipts, even a successful key recovery could end as a 1 BTC loss for the thief.
The design has an evident cost. An owner who simply wants to move legacy coins after Q-Day in the ordinary way would also need matching collateral. Without spare Bitcoin, the very rule meant to deter thieves could make it hard for people to move their own savings.
5. What about lost or abandoned coins?
Landmines cannot help coins whose owners are gone, because they work only if the owner prepares one before Q-Day and reveals it in time. They offer no protection for coins whose keys are already lost, including some early holdings widely believed to be inaccessible.
For those coins Fields sketched two auction designs. The first, a staked auction, begins before Q-Day. Someone locks up quantum-safe Bitcoin and privately registers a bid against a specific old wallet that they expect thieves to target.
Fields' example is an apparently abandoned wallet holding 50 BTC. An attacker who wants to move it must post 50 BTC as collateral. During the auction period, a pre-registered bidder can challenge the theft, and a successful challenger claims part of the attacker's collateral. The original coins are destroyed instead of being handed to the bidder. The purpose is to strip the thief of a reliable payoff, not to return funds to an owner who may no longer exist.
The second design, the sats auction, needs no advance stake. Spending vulnerable coins sets off a contest in which the highest bidder receives the coins minus the amount bid, while the runner-up pays their own bid and receives nothing. Fields likens the structure to a familiar auction game in which bidders keep raising offers to avoid finishing second. A thief might decline to start a contest that could cost more than the coins they hoped to take.
6. Why not just freeze vulnerable Bitcoin?
Freezing is the most direct alternative: set a migration deadline, then restrict spending from outdated wallets once it passes. That would stop quantum theft, but it could permanently lock out legitimate owners who never moved their coins in time.
Fields proposes a different path, in which old coins remain potentially spendable but any attempt to move them becomes costly and open to challenge. The underlying difficulty is that Bitcoin cannot tell an honest owner from a thief who can produce the same valid signature. Both look identical to the protocol, so the rules must shift incentives rather than judge intent.
The trade-offs are significant. Honest owners may need large collateral to move their own funds, inactive holders could miss the chance to object, and the auction rules might destroy the coins of living people who are merely offline when a contest begins. Each of these costs would have to be weighed against the risk of doing nothing.
7. What would it take to implement?
Putting any of this into practice would require several building blocks that Bitcoin lacks today. The network would first need a quantum-safe way to hold and spend funds. Wallets would then have to support hidden ownership commitments of the kind the landmine relies on.
Consensus rules would also need to enforce collateral requirements, waiting periods, special recovery transactions and the auctions themselves. Developers would have to agree on activation timing, the size of collateral, and how losing bids and leftover funds are treated.
A soft fork tightens the rules in a way that nodes running older software still accept, which makes it generally easier to coordinate than a change that splits the network. Even so, any change affecting how coins can be spent is among the most sensitive kinds of upgrade, because it touches the rules that protect every holder's funds.
Fields thinks some portions could be introduced as a soft fork, a backward-compatible type of rule change, but he has not published a detailed design. His original post leaves auction payouts, and the intended auction outcome, unresolved.
8. What happens next?
For now the proposal remains a discussion item on the developer mailing list. No implementation, activation schedule or formal Bitcoin improvement proposal has been put forward, and none of the protections described exists on the network.
The wider quantum debate also continues on other fronts, including work on signature schemes designed to resist quantum attacks. The landmine and auction concepts are meant to complement, not replace, any such migration, by addressing the coins that owners fail to move in time or can no longer reach.
Any move toward adoption would begin with the groundwork of quantum-safe wallets and an agreed design for the collateral and challenge rules. Until then, the landmine and auction ideas serve mainly as a way to test whether deterrence, rather than prohibition, can be a credible answer to the quantum threat.