Source published November 8, 2026, at 22:01:03 UTC+8. The mechanisms below were thought experiments, not implemented Bitcoin protections.
Could requiring collateral make quantum theft too risky to attempt? In a November 4 post to the Bitcoin development mailing list, developer Cory Fields outlined “quantum landmines” and two auction mechanisms intended to turn attacks on vulnerable coins into costly gambles.
For wallet owners and developers, the key distinction is between a proposed incentive system and an available security tool. As reported by Decrypt, Fields had published no implementation or activation schedule, and important design questions remained unresolved.
What threat would these proposals address?
Bitcoin users authorize transactions with private keys. Public keys allow the network to verify signatures without learning those secrets.
A sufficiently powerful quantum computer could use Shor’s algorithm to derive a private key from its public key, potentially enabling unauthorized spending. Some older Bitcoin outputs expose public keys, as do certain newer formats. Other addresses conceal the public key until spending, so exposure varies.
Researchers call the hypothetical arrival of this capability “Q-Day.” At the time of the source report, no publicly demonstrated machine could steal Bitcoin this way, and its possible arrival date was unknown.
How a quantum landmine would work
Fields’s landmine concept depends on an owner preparing before Q-Day and responding during a later challenge window. The source describes this example:
- Prepare an ownership commitment. An owner with 1 BTC in a vulnerable wallet creates a small, separate quantum-safe output containing a hidden proof that they controlled the original private key before quantum theft became possible. Outsiders cannot see the proof or identify the output as a trap.
- Require collateral for a later transfer. A future attacker who recovers the old private key must supply another 1 BTC from a quantum-safe wallet. The original coin and collateral enter a restricted output totaling 2 BTC.
- Allow time for a challenge. The attacker waits through a challenge period—30 days in Fields’s example—before unrestricted spending becomes possible.
- Reveal the earlier proof. If the owner responds in time, they can move the full 2 BTC to the quantum-safe address committed to earlier, recovering their coin and taking the attacker’s collateral.
The intended deterrent is uncertainty: an attacker would not know which vulnerable wallets had hidden landmines.
But the collateral requirement would also apply to an honest owner moving their own legacy coin after Q-Day. Without spare BTC, that owner could struggle to move their savings. Landmines would not protect owners who failed to prepare or missed the challenge window.
Two auction concepts for vulnerable coins
Staked auction
A participant would lock up quantum-safe Bitcoin before Q-Day and secretly register a bid against a particular vulnerable wallet.
In the source’s example, an apparently abandoned wallet holds 50 BTC. An attacker attempting to spend it supplies another 50 BTC as collateral. A previously committed bidder can then challenge the transfer during the auction period.
A successful challenger would receive part of the attacker’s collateral, while the original vulnerable coins would be destroyed. This would deny the attacker a reliable payout, not restore funds to a missing owner. Unlike landmines, it could address coins whose original keys were already lost.
Sats auction
This alternative would require no advance stake. Spending vulnerable coins would trigger a contest: the highest bidder would receive the coins minus their bid, while the runner-up would pay their bid and receive nothing.
That structure could encourage escalating bids as participants try to avoid paying for nothing. The possibility of losing more than the targeted coins are worth is intended to discourage an attacker from starting the contest.
Why this is not a wallet procedure to follow
These proposals would require a quantum-safe way to hold and spend Bitcoin, wallet support for hidden ownership commitments, and consensus rules enforcing collateral, challenge periods, recovery transactions and auctions.
Developers would also need to settle activation conditions, collateral amounts, losing bids and leftover funds. Fields believed some mechanics might be introduced through a soft fork, but had not supplied a detailed design. Auction payouts and even the desired auction outcome remained unresolved in his original post.
The central trade-off is unavoidable: Bitcoin cannot distinguish an honest owner from a quantum thief when both can produce the same valid signature. Freezing vulnerable coins after a migration deadline could prevent theft but lock out legitimate owners. Fields’s alternatives would keep transfers possible while imposing costs and challenges—potentially burdening honest users or burning coins belonging to people who were simply offline.