Bitcoin developer Cory Fields has an unusual idea for dealing with future quantum thieves: make them risk their own Bitcoin every time they try to steal someone else’s.

In a November 4 post to the Bitcoin development mailing list, Fields outlined “quantum landmines” and two types of auctions designed to turn attacks on vulnerable wallets into expensive gambles. He called the ideas “thought experiments,” not a completed Bitcoin upgrade. The mailing-list setting places the ideas at the earliest stage of Bitcoin’s open change process, where other developers can probe the mechanics long before any formal proposal or code exists. The auction designs would target apparently abandoned coins, where nobody may be around to spring a landmine. Everything remains hypothetical: Bitcoin would need quantum-safe wallets, new consensus rules, and agreement on how to activate them.

Why quantum computers threaten some wallets

Bitcoin owners use a secret private key to authorize transactions. A matching public key lets the network check signatures without learning the secret. Today’s computers cannot realistically calculate a private key from its public counterpart, but a sufficiently powerful quantum computer could use a mathematical technique called Shor’s algorithm to do it—potentially letting a thief spend coins as if they owned them.

Some older Bitcoin outputs have exposed public keys, and certain newer formats reveal them too. Other address types hide the key until someone spends, so the risk is not identical for every wallet. Researchers call the hypothetical arrival of a computer capable of these attacks “Q-Day.” No publicly demonstrated machine can steal Bitcoin this way today, and nobody knows exactly when one might exist.

How a quantum landmine works

Imagine someone owns 1 BTC in an old, potentially vulnerable wallet. Before Q-Day, the owner creates a tiny, separate quantum-safe Bitcoin output containing a hidden proof that they controlled the original private key while quantum theft was still impossible. Think of it as a sealed ownership receipt. Outsiders can see the small output, but not the evidence tucked inside it—or even that it is a trap.

Now imagine a future thief uses a quantum computer to recover that private key. Under Fields’s suggested rules, the thief cannot simply take the 1 BTC: they must add 1 BTC of their own, from a quantum-safe wallet, as collateral. Both coins enter a restricted output worth 2 BTC, and the thief must wait through a challenge period—30 days in Fields’s example—before spending it freely.

If the wallet owner notices the transaction, they reveal the pre-Q-Day proof. The network then allows the owner to move the full 2 BTC to the quantum-safe address they committed to earlier: their original coin, plus the thief’s collateral. Because an attacker has no way to know in advance which old wallets contain these hidden receipts, even a successful quantum key recovery could become a 1 BTC loss.

The design burdens honest holders as well. The owner would also need matching collateral to initiate a normal post-Q-Day move of their own legacy coin. Without spare BTC, the same rule intended to hurt thieves could make moving one’s savings difficult.

What about lost or abandoned coins?

Landmines only work when an owner prepares one before Q-Day and reveals it in time. That advance-preparation requirement runs through every mechanism in the proposal, and it is where the stakes concentrate for holders: once a machine capable of these attacks exists, there is no later moment to prove pre-Q-Day ownership, plant a landmine, or register a bid. They cannot protect coins whose keys are already lost, including some of the early Bitcoin holdings widely believed to be inaccessible.

Fields proposes a second mechanism called a staked auction. Before Q-Day, someone could lock up quantum-safe Bitcoin and secretly register a bid against a specific old wallet they expect thieves to target. Suppose an apparently abandoned wallet holds 50 BTC. A future attacker tries to move it and posts another 50 BTC as collateral; during the auction period, a participant who committed a bid in advance can challenge the attempted theft.

In Fields’s example, a successful challenger claims part of the attacker’s collateral, while the original vulnerable coins are destroyed rather than awarded to the bidder. The point is to deprive thieves of a reliable payday, not to return the coins to a missing owner.

His third idea, a sats auction, requires no advance stake. Instead, a vulnerable-coin spend would trigger a contest in which the highest bidder gets the coins minus their bid, while the runner-up pays their bid and gets nothing. That resembles a notorious auction game in which two bidders keep raising their offers because neither wants to be the person who loses money for nothing. A thief might therefore avoid starting a contest that could cost more than the coins they hoped to steal.

Why not just freeze vulnerable Bitcoin?

One proposed response to quantum risk is to restrict spending from outdated wallets after a migration deadline. That might prevent theft, but could also permanently lock out legitimate owners who never moved their coins.

Fields is exploring a different trade-off: keep old coins potentially spendable, but make attempted transfers costly and open to challenges. The complication is that Bitcoin cannot tell an honest owner from a quantum thief if both can produce the same valid signature. The trade-off is severe: honest owners might need large collateral deposits, inactive holders could miss their chance to object, and auction rules might burn coins belonging to people who are still alive and simply offline.

What would it take to implement?

Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would then need to support hidden ownership commitments, while Bitcoin’s consensus rules would have to enforce collateral, waiting periods, special recovery transactions, and auctions. Developers would also need to agree on when the new rules activate, how much collateral is required, and what happens to losing bids or leftover funds.

Fields believes some mechanics could be introduced through a soft fork—a type of Bitcoin rule change—but has not supplied the detailed design. None of these protections exists in Bitcoin today. Fields has published no implementation or activation schedule, and his original post leaves the auction payouts, and even the desired outcome of an auction, unresolved. Those open ends double as the signals to watch: a follow-up post settling auction payouts, a draft specification, or visible engagement from other developers on quantum-safe output formats would mark the idea’s move beyond thought experiment, and their absence keeps it there.

Source: Decrypt