A Bitcoin developer has proposed a set of hypothetical mechanisms intended to make future quantum attacks on vulnerable wallets expensive for the attacker, according to a November 4 post on the Bitcoin development mailing list.
Cory Fields outlined "quantum landmines" and two types of auctions designed to turn theft attempts into costly gambles. He described the ideas as "thought experiments" rather than a completed Bitcoin upgrade.
The quantum threat
Bitcoin owners authorize transactions with a secret private key, while a matching public key lets the network verify signatures without learning the secret. Today's computers cannot realistically derive the private key from the public one, but a sufficiently powerful quantum computer could use Shor's algorithm to do so, potentially allowing a thief to spend coins as if they owned them.
Some older Bitcoin outputs have exposed public keys, and certain newer formats reveal them as well. Other addresses hide the key until someone spends, so the risk is not identical for every wallet. Researchers refer to the hypothetical arrival of such a machine as "Q-Day." No publicly demonstrated machine can steal Bitcoin this way today, and it is unknown when one might exist.
How a landmine would work
Under Fields's example, an owner of 1 BTC in an old, potentially vulnerable wallet would create a small, separate quantum-safe output before Q-Day. That output would contain a hidden proof that they controlled the original private key while quantum theft was still impossible—a sealed ownership receipt that outsiders cannot see inside.
If a future thief used a quantum computer to recover the old private key, the proposed rules would require the attacker to add 1 BTC of their own from a quantum-safe wallet as collateral. Both coins would enter a restricted output worth 2 BTC, and the thief would have to wait through a challenge period—30 days in Fields's example—before spending it freely.
If the owner notices the transaction and reveals the pre-Q-Day proof, the network would allow them to move the full 2 BTC to the quantum-safe address they committed to earlier: their original coin plus the thief's collateral. Because an attacker could not know in advance which old wallets contain these hidden receipts, even a successful key recovery could become a loss.
The owner would also need matching collateral to initiate a normal post-Q-Day move of their own legacy coin. Without spare BTC, the same rule intended to hurt thieves could make moving their savings difficult.
Auctions for abandoned coins
Landmines only work when an owner prepares one before Q-Day and reveals it in time. They cannot protect coins whose keys are already lost, including some early Bitcoin holdings widely believed to be inaccessible.
Fields proposed a second mechanism, a staked auction, in which someone could lock up quantum-safe Bitcoin before Q-Day and secretly register a bid against a specific old wallet they expect thieves to target. If an attacker tried to move an apparently abandoned wallet holding 50 BTC and posted another 50 BTC as collateral, a pre-registered bidder could challenge the attempt during the auction period.
In Fields's example, a successful challenger claims part of the attacker's collateral, while the original vulnerable coins are destroyed rather than awarded to the bidder. The aim is to deprive thieves of a reliable payday, not to return coins to a missing owner.
A third idea, a sats auction, would require no advance stake. A vulnerable-coin spend would trigger a contest in which the highest bidder receives the coins minus their bid, while the runner-up pays their bid and receives nothing. That structure resembles a notorious auction game in which bidders keep raising offers to avoid losing money for nothing, potentially deterring a thief from starting a contest that could cost more than the coins they hoped to steal.
Alternatives and trade-offs
One proposed response to quantum risk is to restrict spending from outdated wallets after a migration deadline. That might prevent theft but could also permanently lock out legitimate owners who never moved their coins.
Fields is exploring a different trade-off: keep old coins potentially spendable, but make attempted transfers costly and open to challenges. Bitcoin cannot distinguish an honest owner from a quantum thief if both can produce the same valid signature.
The trade-offs are severe. Honest owners might need large collateral deposits, inactive holders could miss their chance to object, and auction rules might burn coins belonging to people who are still alive and simply offline.
What implementation would require
Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would need to support hidden ownership commitments, and Bitcoin's consensus rules would have to enforce collateral, waiting periods, special recovery transactions, and auctions.
Developers would also need to agree on when new rules activate, how much collateral is required, and what happens to losing bids or leftover funds. Fields believes some mechanics could be introduced through a soft fork, a type of Bitcoin rule change, but has not supplied a detailed design.
None of these protections exists in Bitcoin today. Fields has published no implementation or activation schedule, and his post leaves the auction payouts and even the desired outcome of an auction unresolved.
