Briefly describe
- Bitcoin developer Cory Fields has proposed a hidden "landmine" mechanism that could allow wallet holders to seize the collateral of quantum thieves.
- Two auction designs will target seemingly abandoned coins, where no one may be present to trigger the mine.
- All remains hypothetical: Bitcoin requires quantum-safe wallets, new consensus rules, and consensus on how to activate these rules.
Bitcoin developer Cory Fields has proposed an unusual approach to counter future quantum thieves: making them risk their own Bitcoin every time they attempt to steal someone else’s.
In a post sent to the Bitcoin developers mailing list on November 4, Fields outlined "quantum mines" and two auction mechanisms designed to turn attacks on vulnerable wallets into costly gambles. He described these ideas as "thought experiments," not finalized Bitcoin upgrade proposals.
Bitcoin holders use a secret private key to authorize transactions. The corresponding public key allows the network to verify the signature without knowing the secret.
If all of this sounds too hard to understand, we’ve generated a video using AI to help you grasp it:
Current computers cannot realistically derive private keys from public keys. However, a sufficiently powerful quantum computer could use a mathematical technique called Shor’s algorithm to accomplish this, potentially allowing thieves to spend the coins as if they owned them.
Some older Bitcoin outputs have exposed public keys, and certain newer formats also expose public keys. Other addresses conceal the key until it is spent, so not every wallet faces the same level of risk.
Researchers refer to the hypothetical moment when a computer capable of carrying out such an attack arrives as "Q Day." No machine has yet been publicly demonstrated that can steal Bitcoin in this way, and no one knows precisely when it will appear.
How do quantum mines work?
Imagine someone deposits 1 BTC into an old, potentially vulnerable wallet. Before day Q, this person creates a small, separate quantum-safe Bitcoin output containing a hidden proof that they controlled the original private key at a time when quantum theft was still impossible.
Think of it as a sealed receipt of ownership. Outsiders can see this small output, but they cannot see the evidence hidden inside, nor even know that it’s a trap.
Now imagine that in the future, a thief uses a quantum computer to recover a user’s old wallet private key. Under Fields’ proposed rule, the thief cannot simply take the 1 BTC; they must first lock up another 1 BTC from a quantum-secure wallet as collateral.
Both coins will be sent to a restricted output with a total of 2 BTC. The thief must first wait out a challenge period—30 days in Fields’ example—before being able to spend them freely.
The wallet holder noticed the transaction and disclosed the proof prior to Day Q. The network then allowed the holder to transfer all 2 BTC to her previously committed quantum-secure address—the original coins plus the thief’s collateral.
Attackers cannot beforehand know which old wallets contain these hidden receipts. Even if they successfully recover the quantum key, it could still result in a transaction that loses 1 BTC.
Wallet holders who wish to initiate the normal post-Q-day migration of their old coins also need matching collateral. If they do not have excess BTC, the same rules designed to deter thieves may also make it difficult for them to transfer their savings.
What happens to lost or abandoned coins?
The bomb is only effective if the holder prepares and discloses it in time before Day Q. It cannot protect coins whose private keys have been lost, including some early Bitcoin holdings widely considered unrecoverable.
Fields proposed a second mechanism called "staking auction." Before Q-day, someone can lock up quantum-safe Bitcoin and secretly submit a bid for an old wallet they expect to be targeted by thieves.
Suppose a seemingly abandoned wallet contains 50 BTC. A future attacker attempts to transfer it out and additionally stakes 50 BTC as collateral; during the auction period, individuals who submitted bids in advance can challenge this theft attempt.
In Fields' example, a successful challenger can claim a portion of the attacker's collateral, while the originally vulnerable coins are destroyed rather than awarded to the bidder. The focus is on depriving the thief of stable gains, not returning the coins to an absent holder.
His third idea is a "sats auction," which doesn't require prior staking. Instead, spending a vulnerable coin triggers a competition: the highest bidder claims the coins but deducts their bid amount, while the second-highest bidder pays their bid but receives nothing.
It’s somewhat like a notorious auction game: two bidders keep raising their bids because neither wants to be the one who ends up losing money for nothing. The thief might avoid initiating a contest that could cost them more than the coins they intend to steal.
Why not directly freeze the risky bitcoins?
One proposed approach to mitigate quantum risk is to restrict spending from old wallets after the migration deadline. This might prevent theft, but it could also permanently exclude legitimate holders who never migrated their coins.
Fields is exploring another trade-off: allowing old coins to still be spent, but making attempts to transfer them expensive and challengeable. If both can generate equally valid signatures, Bitcoin cannot distinguish between honest holders and quantum thieves.
This trade-off is quite severe, as honest holders may need to lock up large collateral, long-term inactive holders might miss opportunities to object, and auction rules could also destroy coins belonging to individuals who are still alive but simply offline.
What is required to achieve this?
Bitcoin first requires a quantum-secure method for holding and spending funds. Subsequently, wallets must support hidden ownership commitments, and Bitcoin’s consensus rules must enforce collateral, waiting periods, special recovery transactions, and auctions.
Developers still need to agree on when the new rules will activate, how much collateral is required, and how lost bids or remaining funds will be handled. Fields believes some mechanisms could be introduced via a soft fork—a method of changing Bitcoin’s rules—but he did not provide a detailed design.
These protections do not currently exist in Bitcoin. Fields has not yet released any implementation details or activation schedule, and his original post did not specify the payment method for the auction or clarify what the intended outcome of the auction should be.