Bitcoin developer Cory Fields has outlined a thought experiment that would make a future quantum attacker put up bitcoin collateral before moving vulnerable coins—and risk losing that collateral to the legitimate owner.
The proposal, described in a report published on November 9, 2026, combines hidden ownership proofs with two auction concepts intended to undermine the economics of quantum theft. Fields presented the ideas on the Bitcoin developer mailing list, but emphasized that they are not a finalized Bitcoin upgrade proposal. No implementation code or rollout timetable was provided.
The threat: exposed public keys
Bitcoin users authorize transactions with private-key signatures, which the network can verify using corresponding public keys. Ordinary computers cannot practically derive those private keys from public keys, but a sufficiently capable quantum computer could do so using Shor’s algorithm.
Some early Bitcoin addresses expose their public keys on-chain. Other addresses reveal them when users first spend, so exposure to a future quantum attack is not uniform across wallets.
The report calls the arrival of a machine capable of breaking Bitcoin’s cryptography “Q-Day.” At the time of the report, no machine had demonstrated that capability, and its arrival date remained unknown.
How a quantum landmine would work
In the report’s example, the owner of 1 BTC in a quantum-vulnerable wallet would prepare a small, quantum-resistant Bitcoin output before Q-Day. That output would contain a hidden commitment establishing ownership before quantum attacks became feasible. Outsiders would not be able to see the concealed evidence or necessarily identify the output as a trap.
Under the proposed rules, someone subsequently trying to move that vulnerable 1 BTC would have to post another 1 BTC from a quantum-resistant wallet as collateral. Both amounts would be locked during a challenge period—30 days in the illustrative example, not a settled parameter.
If the legitimate owner submitted the previously hidden ownership proof within that window, they could recover the original coin and claim the attacker’s collateral, moving 2 BTC in total to a prepared quantum-resistant address.
The intended deterrent is uncertainty: an attacker could derive a vulnerable wallet’s private key without knowing whether its owner had planted a landmine. A technically successful attack could therefore produce a financial loss.
That requirement would also apply to legitimate owners moving their own vulnerable coins after Q-Day. Someone without an equal amount of additional bitcoin could find it difficult to move their holdings.
Auctions for coins whose owners cannot respond
Landmines depend on owners preparing proofs in advance and responding during the challenge window. They would not protect coins whose private keys were already lost and whose owners could no longer participate, including many early coins widely believed to be permanently lost.
Fields described two auction approaches aimed at discouraging attacks on such holdings.
A collateral auction
Before Q-Day, participants could lock quantum-resistant bitcoin and privately bid against a vulnerable wallet. In the report’s example, an apparently abandoned wallet holds 50 BTC. An attacker attempting to move those coins would have to post 50 BTC in collateral.
During the auction window, a participant who had committed funds beforehand could challenge the attempted transfer. A successful challenger could receive part of the attacker’s collateral, while the original 50 BTC would be destroyed, rather than awarded to the challenger.
The objective would be deterrence, not recovery for the absent owner.
A satoshi auction
The other auction concept would not require funds to be locked beforehand. An attempt to move vulnerable coins would trigger bidding. The highest bidder would receive the coins minus their bid, while the second-highest bidder would lose their bid and receive nothing.
The report compares this to the “dollar auction,” in which participants may keep raising bids to avoid accepting a loss. The proposed deterrent is the risk that initiating a theft would lead to an increasingly costly contest—not a demonstrated guarantee that every attack would be unprofitable.
The trade-off versus freezing old coins
An alternative discussed in the report would impose a migration deadline, after which coins in old wallets could no longer move. That could prevent theft, but would also permanently lock out legitimate owners who forgot or failed to migrate in time.
Fields’ approach would instead preserve a route for moving old coins, subject to collateral requirements and challenges. The underlying problem remains that Bitcoin cannot distinguish a legitimate owner from a quantum attacker if both can produce a valid signature.
The costs would be substantial: legitimate owners could need large collateral balances, offline holders could miss challenge windows, and coins belonging to living but temporarily inactive owners could potentially be destroyed through an auction.
What remains unresolved
These mechanisms would first require a quantum-safe way to hold and spend bitcoin. Wallets would need to support hidden ownership commitments, and consensus rules would have to enforce collateral, waiting periods, special recovery transactions and auctions.
Developers would also need agreement on activation timing, collateral amounts, and the treatment of unsuccessful bids and remaining funds. Fields suggested that some mechanisms could be introduced through a soft fork, but did not provide a detailed design.
At the time of the report, none of these protections existed on the Bitcoin network. Auction payouts and final objectives also remained unsettled. The proposal’s significance is therefore conceptual: it explores whether economic penalties could reduce the incentive to exploit quantum-vulnerable coins, while leaving major technical and ownership trade-offs unresolved.
Source: TechFlow’s original article, published November 9, 2026, at 16:16:03 (UTC+8). The supplied article credits Jose of Decrypt as author and Chopper of Foresight News as translator. This is a historical-source rewrite, not a new announcement.
