This Bitcoin Developer’s Idea Would Make Quantum Attacks a Losing Bet

Bitcoin developer Cory Fields has an unusual idea for dealing with future quantum thieves: Make them risk their own Bitcoin every time they try to steal someone else’s.

In a November 4 post to the Bitcoin development mailing list, Fields outlined “quantum landmines” and two types of auctions designed to turn attacks on vulnerable wallets into expensive gambles. He called the ideas “thought experiments,” not a completed Bitcoin upgrade.

Bitcoin owners use a secret private key to authorize transactions. A matching public key lets the network check their signatures without learning the secret.

If the whole idea seems too hard to understand, we used AI to generate a video to help you grasp it:

Today’s computers cannot realistically calculate that private key from the public one. A sufficiently powerful quantum computer could use a mathematical technique called Shor’s algorithm to do it, potentially letting a thief spend coins as if they owned them.

Some older Bitcoin outputs have exposed public keys, and certain newer formats reveal them too. Other addresses hide the key until someone spends, so the risk is not identical for every wallet.

Researchers call the hypothetical arrival of a computer capable of these attacks “Q-Day.” No publicly demonstrated machine can steal Bitcoin this way today, and nobody knows exactly when one might exist.

How does a quantum landmine work?

Imagine someone owns 1 BTC in an old, potentially vulnerable wallet. Before Q-Day, this person creates a tiny, separate quantum-safe Bitcoin output containing a hidden proof that they controlled the original private key while quantum theft was still impossible.

Think of it as a sealed ownership receipt. Outsiders can see the small output, but not the evidence tucked inside it, or even that it is a trap.

Now imagine a future thief uses a quantum computer to recover the user’s old private key. Under Fields’s suggested rules, the thief cannot simply take her 1 BTC: They must add 1 BTC of their own from a quantum-safe wallet as collateral.

Both coins enter a restricted output worth 2 BTC. The thief must wait through a challenge period—30 days in Fields’s example—before spending it freely.

The wallet owner notices the transaction and reveals the pre-Q-Day proof. The network then allows the owner to move the full 2 BTC to the quantum-safe address they committed to earlier: their original coin, plus the thief’s collateral.

The attacker has no way to know in advance which old wallets contain these hidden receipts. Even a successful quantum key recovery could become a 1 BTC loss.

The wallet owner would also need matching collateral to initiate a normal post-Q-Day move of her own legacy coin. If they have no spare BTC, the same rule intended to hurt thieves could make moving her savings difficult.

What about lost or abandoned coins?

Landmines only work when an owner prepares one before Q-Day and reveals it in time. They cannot protect coins whose keys are already lost, including some of the early Bitcoin holdings widely believed to be inaccessible.

Fields proposes a second mechanism called a staked auction. Before Q-Day, someone could lock up quantum-safe Bitcoin and secretly register a bid against a specific old wallet they expect thieves to target.

Suppose an apparently abandoned wallet holds 50 BTC. A future attacker tries to move it and posts another 50 BTC as collateral; during the auction period, someone who committed a bid in advance can challenge the attempted theft.

In Fields’s example, a successful challenger claims part of the attacker’s collateral while the original vulnerable coins are destroyed rather than awarded to the bidder. The point is to deprive thieves of a reliable payday, not return the coins to a missing owner.

BitcoinBTC · USD

$76,078−2.45%

24H7D1M1YYTD

Nov 1Nov 3Nov 5Nov 6Nov 8

$80.7k$79.0k$77.3k$75.5k

24h HighHigh$76,106

24h LowLow$75,541

VolVol$372.1M

→

$50$100$500

Buy

His third idea, a sats auction, requires no advance stake. Instead, a vulnerable-coin spend would trigger a contest in which the highest bidder gets the coins minus their bid, while the runner-up pays their bid and gets nothing.

That resembles a notorious auction game where two bidders keep raising their offers because neither wants to be the person who loses money for nothing. A thief might avoid starting a contest that could cost more than the coins they hoped to steal.

Why not just freeze vulnerable Bitcoin?

One proposed response to quantum risk is to restrict spending from outdated wallets after a migration deadline. That might prevent theft, but could also permanently lock out legitimate owners who never moved their coins.

Fields is exploring a different trade-off: Keep old coins potentially spendable, but make attempted transfers costly and open to challenges. Bitcoin cannot tell an honest owner from a quantum thief if both can produce the same valid signature.

The trade-off is severe, considering that honest owners might need large collateral deposits, inactive holders could miss their chance to object, and auction rules might burn coins belonging to people who are still alive and simply offline.

What would it take to implement?

Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would then need to support hidden ownership commitments, while Bitcoin’s consensus rules would have to enforce collateral, waiting periods, special recovery transactions, and auctions.

Developers would also need to agree on when the new rules activate, how much collateral is required, and what happens to losing bids or leftover funds. Fields believes some mechanics could be introduced through a soft fork, a type of Bitcoin rule change, but has not supplied the detailed design.

None of these protections exists in Bitcoin today. Fields has published no implementation or activation schedule, and his original post leaves the auction payouts and even the desired outcome of an auction unresolved.