Bitcoin developer Cory Fields has outlined a way to make future quantum attacks on vulnerable Bitcoin wallets financially risky: require anyone moving those coins to put their own Bitcoin at stake, then allow prepared owners or auction participants to challenge the transfer.
In a November 4 post to the Bitcoin development mailing list, Fields described “quantum landmines” and two auction mechanisms as thought experiments—not a finished Bitcoin upgrade. Decrypt reported on the ideas on November 8, 2026. None of the proposed protections exists in Bitcoin today, and Fields has published no implementation or activation schedule.
The threat these proposals address
Bitcoin transactions rely on private keys to authorize spending and public keys to verify signatures. Today’s computers cannot realistically derive a private key from its public counterpart. A sufficiently powerful quantum computer could potentially do so using Shor’s algorithm, allowing an attacker to spend someone else’s coins.
Exposure varies. Some older Bitcoin outputs have public keys already visible, as do certain newer formats. Other addresses conceal the public key until the owner spends.
Researchers call the hypothetical arrival of a machine capable of such attacks “Q-Day.” No publicly demonstrated computer can steal Bitcoin this way today, and the timing of any such capability remains unknown.
Quantum landmines: a hidden ownership claim
Fields’s landmine proposal would let an owner prepare evidence of ownership before Q-Day and use it to challenge a later theft attempt.
In the article’s example, someone holding 1 BTC in a vulnerable wallet first creates a small, separate quantum-safe output. It contains a hidden commitment proving that they controlled the original private key before quantum theft became possible. Outsiders would not be able to see the evidence or identify the output as a trap.
Under the proposed rules, a future attacker who recovered the old private key would have to supply another 1 BTC from a quantum-safe wallet as collateral. The original coin and the collateral would enter a restricted output holding 2 BTC, subject to a challenge period—30 days in Fields’s example.
If the owner detected the transfer and revealed the earlier proof in time, they could move the full 2 BTC to the quantum-safe address committed to beforehand. The attacker would lose their collateral, without having known in advance whether the target wallet was protected.
The requirement would also apply to legitimate owners moving their own legacy coins after Q-Day. An owner without enough spare Bitcoin could therefore struggle to move their savings.
Auctions for coins without an active defender
Landmines depend on owners preparing before Q-Day and responding within the challenge window. They cannot protect coins whose keys are already lost, including some early holdings widely believed to be inaccessible.
Fields outlined two other mechanisms:
- Staked auction: Before Q-Day, a participant would lock up quantum-safe Bitcoin and secretly register a bid against a particular old wallet. In an example involving a wallet holding 50 BTC, an attacker attempting to move those coins would post another 50 BTC as collateral. A participant with a prior bid could challenge the transfer during the auction period. A successful challenger would receive part of the attacker’s collateral, while the original vulnerable coins would be destroyed—not returned to a missing owner or awarded to the bidder.
- Sats auction: No advance stake would be required. A vulnerable-coin spend would trigger a contest in which the highest bidder received the coins minus their bid, while the runner-up paid their bid and received nothing. That structure could encourage escalating bids as participants tried to avoid paying for no reward, potentially making an attempted theft cost more than the targeted coins.
These mechanisms aim to undermine the economics of theft. They do not guarantee recovery for an absent owner, and the auction payouts and even the desired auction outcome remain unresolved in Fields’s original post.
The trade-off: deterrence without a blanket freeze
Another proposed response to quantum risk is to restrict spending from outdated wallets after a migration deadline. That could prevent theft, but it could also permanently exclude legitimate owners who failed to migrate.
Fields’s approach explores a different compromise: leave old coins potentially spendable while making transfers costly and open to challenges. The underlying problem remains that Bitcoin cannot distinguish an honest owner from a quantum attacker when both can produce the same valid signature.
The consequences could be substantial. Legitimate owners might need large collateral deposits, inactive holders could miss their opportunity to challenge a transfer, and auctions could destroy coins belonging to people who are still alive but offline.
What implementation would require
Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would need to support hidden ownership commitments, and consensus rules would have to enforce collateral, waiting periods, recovery transactions and auctions.
Developers would also need agreement on activation timing, collateral amounts, losing bids and leftover funds. Fields believes some mechanics could be introduced through a soft fork, but he has not supplied a detailed design.
The proposal’s significance is therefore an exploration of incentives, not an available defense or a settled migration plan. Its deterrent effect would depend on rules and infrastructure that have yet to be specified and adopted.
Original source: Decrypt, published November 8, 2026, at 22:01:03 UTC+08:00. The report discusses Fields’s November 4 mailing-list post.
