Bitcoin Quantum Landmines: Thieves Would Have to Risk Their Own Coins

Bitcoin developer Cory Fields has proposed an unusual defense against future quantum thieves, namely to make every attempt to take someone else's coins cost the attacker some of their own. He laid the idea out in a November 4 post to the developer mailing list and calls it a "thought experiment", not a finished upgrade. CoinDesk and Decrypt both covered the "quantum landmines", because the quantum threat has long since left the academic corner.

Why do quantum computers worry Bitcoin holders?

A quick reminder of how wallets work helps here. An owner signs a transaction with a secret private key, and the network checks the signature against a public key without ever seeing the secret. Ordinary computers cannot work out the private key from the public one. A powerful enough quantum computer could, using Shor's algorithm, and a thief would then spend other people's coins as if they were his own.

The risk is uneven across addresses. Some older formats expose the public key on the blockchain right away, while newer ones hide it until the first spend. Researchers call the arrival of such a machine Q-Day. Nobody has shown a working computer that breaks Bitcoin, and nobody knows when one might appear.

The topic is not new to the industry. Coinbase earlier urged the network to prepare Bitcoin for quantum computers, and nine companies formed the Quantum Alliance over the 6 million BTC that could be exposed. Most plans on the table come down to migrating to new address types. Fields's idea stands out because it looks for an answer for coins that nobody will ever move.

How does a quantum landmine work?

Picture an owner with 1 BTC sitting in an old, vulnerable wallet. Before Q-Day, she creates a tiny separate output in a quantum-safe format and hides inside it a proof that she controlled the original private key back when quantum theft was still impossible. From the outside it looks like any small output. No one can see the proof, or even that it is a trap.

• The theft attempt: the attacker recovers the private key and tries to spend the 1 BTC, but the rules require him to add 1 BTC of his own from a quantum-safe wallet as collateral.
• Both amounts land in a restricted output worth 2 BTC, which cannot be spent freely during a challenge period (30 days in Fields's example).
• The owner spots the transaction and reveals the proof. The network lets her move all 2 BTC to the safe address she committed to earlier.
• The thief cannot know which old addresses hold landmines, so even a successful key recovery could end in a 1 BTC loss.

What about abandoned wallets?

A landmine is no use for addresses that look abandoned, because nobody is around to challenge a theft. So Fields sketched two more mechanisms. In a staked auction, someone locks up quantum-safe coins in advance and secretly registers a bid against a specific old wallet. If an attacker tries to move, say, 50 BTC and posts another 50 BTC as collateral, the bidder can challenge the attempt and claim part of that collateral. The vulnerable coins themselves are destroyed rather than handed over, because the aim is to take away the thief's guaranteed payday.

The third idea, a sats auction, needs no advance stake. Spending a vulnerable coin triggers a contest where the highest bidder gets the coins minus their bid, and the runner-up pays their bid and gets nothing. It resembles a well-known game where both players keep raising because neither wants to lose money for nothing. A sensible thief would skip any contest that could cost more than the loot.

Why not just freeze the old wallets?

One alternative is a migration deadline, after which outdated addresses cannot spend at all. That would stop thieves but could lock out legitimate owners who never moved their coins. Fields is exploring a different trade-off. Old coins stay spendable, yet any attempt to move them is expensive and open to challenge. Bitcoin cannot tell an honest owner from a quantum thief when both produce an equally valid signature.

The trade-off has a price. An honest owner will also need collateral to move her own legacy coins after Q-Day, and without spare BTC that becomes a problem. Landmines cannot save keys that are already lost, such as some early wallets widely believed to be inaccessible. Inactive holders may miss their window to object, and the auction rules could burn coins belonging to people who are alive but offline.

Our take is simple. The proposal is useful as a way to think about the problem, but it demands that owners act in advance, and millions of people do not read developer mailing lists.

What would it take to make this real?

Almost everything is still missing. Fields has published no implementation, activation schedule or payout math, and his post leaves open even what a good auction outcome looks like. Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would then have to learn to hide ownership proofs, and consensus rules would have to enforce collateral, waiting periods, special recovery transactions and the auctions themselves. The author believes some of it could arrive through a soft fork, but gave no detailed design.

Developers would also have to agree on an activation date, the collateral size and what happens to losing bids. Even modest changes to Bitcoin's rules usually take years of debate and testing, so ideas of this size must first survive criticism and experimental implementations. Today no Q-Day protection exists in Bitcoin. Anyone who does not want to wait on developers and simply wants to change their position has an ordinary route, namely to exchange Bitcoin for dollars at the best rate among verified exchangers.