Bitcoin developer Cory Fields has proposed making future quantum theft a financial gamble: anyone attempting to move vulnerable bitcoin would first have to risk bitcoin of their own.
According to the supplied report, Fields outlined “quantum landmines” and two auction mechanisms on the Bitcoin developer mailing list. These are thought experiments—not a finalized upgrade, deployed protection or demonstrated guarantee that attackers would lose money.
Historical source context: the TechFlow article was published on November 9, 2026, at 16:16:03 UTC+8. It credits Jose at Decrypt as the author and Chopper at Foresight News for the Chinese translation.
The threat being considered
Bitcoin transactions use private keys to produce signatures that the network can verify using corresponding public keys. Ordinary computers cannot practically derive those private keys from public keys. A sufficiently capable quantum computer, however, could use Shor’s algorithm to do so, potentially allowing an attacker to spend the affected bitcoin.
Some early bitcoin outputs expose their public keys on-chain; other addresses reveal public keys when their owners spend. Exposure is therefore not uniform across wallets.
The report calls the arrival of a quantum computer capable of breaking Bitcoin’s cryptography “Q-Day.” At the time of the report, no machine had demonstrated that capability, and its arrival date remained unknown.
How a quantum landmine would work
Consider the report’s hypothetical holder of 1 BTC in a quantum-vulnerable output. Before quantum attacks become feasible, the holder would create a small, quantum-resistant output containing a hidden commitment to evidence of prior ownership. Outsiders would not see the concealed evidence or necessarily know a trap existed.
Under the proposed rules, someone later attempting to move that vulnerable 1 BTC would have to post another 1 BTC from quantum-resistant funds as collateral. Both amounts would be locked during a challenge period—30 days is an example, not an agreed parameter.
If the original holder presented the previously committed ownership proof within that window, they could recover the original bitcoin and claim the attacker’s collateral, sending the combined 2 BTC to a prepared quantum-resistant address.
The intended deterrent is uncertainty: deriving an old private key would not tell an attacker whether its funds were protected by a hidden claim.
But the same requirement would apply to legitimate owners moving their old coins after Q-Day. A holder without spare bitcoin for collateral could struggle to move funds they already own.
Auctions for coins whose owners cannot respond
Landmines depend on owners preparing in advance and responding during the challenge window. They would not protect coins whose owners had already lost their keys and could no longer act.
Fields’ other ideas attempt to address the incentive to attack those funds rather than recover them for absent owners.
Staked auctions
Before Q-Day, participants could lock quantum-resistant bitcoin to place concealed bids against vulnerable funds.
In the report’s example, an apparently abandoned wallet contains 50 BTC. A future attacker attempting to move it would have to post 50 BTC in collateral. Participants who had committed funds earlier could then challenge the attempt during an auction window.
A successful challenger would receive part of the attacker’s collateral. The original 50 BTC would be destroyed, not awarded to the challenger. The aim is to undermine the economics of theft, not return lost coins to their owners.
Satoshi auctions
A second auction design would not require funds to be locked in advance. An attempted transfer of vulnerable bitcoin would trigger bidding: the highest bidder would receive the coins minus their bid, while the second-highest bidder would lose their bid and receive nothing.
The report compares this to the classic “dollar auction,” in which participants can keep escalating their bids to avoid accepting a loss. The proposed deterrent is the prospect of an expensive contest. That is an incentive argument, not evidence that every attacker would necessarily be deterred.
The trade-off: no blanket freeze, but no free exit
Another proposed response to quantum risk is a migration deadline, after which old funds could no longer move. That could prevent theft, but it would also permanently lock out legitimate owners who missed the deadline.
Fields’ approach would instead leave a route for old funds to move, subject to collateral requirements and challenges. The underlying problem remains: a valid signature alone would not tell the network whether it came from the original owner or someone who used quantum computing to obtain the key.
The costs are substantial:
- Legitimate owners would also need collateral to move vulnerable funds.
- Holders who were offline could miss their opportunity to challenge a transfer.
- Coins belonging to living but temporarily inactive owners could potentially be destroyed through an auction.
These mechanisms would redistribute risk, not eliminate it.
What remains unresolved
Implementation would first require quantum-safe ways to hold and spend bitcoin. Wallets would need hidden ownership commitments, and consensus rules would need to enforce collateral, waiting periods, special recovery transactions and auctions.
Developers would also have to agree on activation conditions, collateral amounts and the treatment of unsuccessful bids or remaining funds. Fields suggested that some mechanisms might be introduced through a soft fork, but the report says he did not provide a detailed design.
At the time of the article, none of these protections existed on the Bitcoin network. Fields had supplied neither implementation code nor a deployment timetable, and auction payouts and final objectives remained unsettled.
The interesting claim is that economic penalties might supplement cryptographic defenses. The unresolved question is whether those penalties could deter theft without imposing unacceptable costs on legitimate holders.