Bitcoin developer Cory Fields has outlined a way to make hypothetical quantum theft a costly gamble: require anyone moving vulnerable coins to put up Bitcoin of their own, then give prepared owners a chance to claim that collateral.
In a November 4 post to the Bitcoin development mailing list, Fields described “quantum landmines” and two auction mechanisms. These are thought experiments, not a completed upgrade. As Decrypt reported on November 8, 2026, none of the protections existed in Bitcoin, and Fields had published neither an implementation nor an activation schedule.
The threat—and what remains hypothetical
Bitcoin transactions rely on a secret private key and a corresponding public key that lets the network verify signatures. A sufficiently powerful quantum computer could use Shor’s algorithm to derive the private key from the public one, potentially allowing an attacker to spend someone else’s coins.
Exposure varies. Some older Bitcoin outputs have public keys exposed, as do certain newer formats. Other addresses conceal the public key until funds are spent.
The hypothetical arrival of a computer capable of such attacks is often called “Q-Day.” No publicly demonstrated machine could steal Bitcoin this way at the time of the report, and the timing of that capability remained unknown.
How a quantum landmine would work
Fields’s example starts with someone holding 1 BTC in a potentially vulnerable wallet. Before Q-Day, the owner would create a small, separate quantum-safe output containing a hidden commitment proving they controlled the original private key before quantum theft became possible.
A future attacker recovering that key would have to supply 1 BTC of their own from a quantum-safe wallet. The original coin and the attacker’s collateral would enter a restricted output holding 2 BTC, subject to a challenge period—30 days in Fields’s example.
If the owner revealed their earlier proof in time, they could move the full 2 BTC to the quantum-safe address committed to beforehand. The attacker would lose their collateral.
The deterrent depends on uncertainty: outsiders would not know which vulnerable wallets had these hidden ownership receipts.
But the burden would also fall on legitimate holders. An owner making a normal post-Q-Day transfer of their legacy coin would need matching collateral too. Someone without spare BTC could struggle to move their savings.
Two auctions for vulnerable coins
Landmines require an owner to prepare before Q-Day and respond within the challenge period. They cannot protect coins whose keys are already lost.
Fields’s staked auction would let someone lock up quantum-safe Bitcoin before Q-Day and secretly register a bid against a particular old wallet. In his example, an attacker trying to move an apparently abandoned 50 BTC balance would post another 50 BTC as collateral. A bidder who committed in advance could challenge the attempt.
A successful challenger would receive part of the attacker’s collateral, while the original vulnerable coins would be destroyed. The aim is to deny thieves a reliable payout—not recover funds for a missing owner.
A separate sats auction would require no advance stake. Spending vulnerable coins would trigger a contest: the highest bidder would receive the coins minus their bid, while the runner-up would pay their bid and receive nothing. That structure could encourage escalating bids as participants try to avoid paying for no reward, potentially making an attempted theft more expensive than its proceeds.
The difficult trade-off
Freezing outdated wallets after a migration deadline could prevent theft, but also permanently exclude legitimate owners who failed to move their funds. Fields’s alternatives would keep old coins potentially spendable while making transfers costly and contestable.
The underlying problem remains: Bitcoin cannot distinguish an owner from a quantum thief when both can produce the same valid signature. Collateral requirements could burden honest holders, inactive owners could miss challenges, and auctions could destroy coins belonging to people who are simply offline.
Implementation would first require quantum-safe custody and spending, wallet support for hidden commitments, and consensus rules governing collateral, waiting periods, recovery transactions and auctions. Developers would also need agreement on activation and payout details.
Fields believes some mechanics could be introduced through a soft fork, but has not supplied a detailed design. Auction payouts—and even the desired auction outcome—remain unresolved in his original post.
Original reporting: Decrypt, published November 8, 2026, at 22:01:03 UTC+8.