Bitcoin’s ability to preserve value depends partly on whether holders can retain control of their coins. A thought experiment from Bitcoin developer Cory Fields explores how economic penalties might deter future quantum theft—but also shows how those defenses could burden legitimate owners.
The report, published on November 9, 2026, at 16:16:03 UTC+8, describes “quantum landmines” and two auction mechanisms discussed by Fields on the Bitcoin developer mailing list. These are exploratory ideas, not a finalized upgrade proposal. The protections described are not currently part of Bitcoin, and Fields supplied neither implementation code nor a deployment timetable.
The threat: a valid signature might no longer establish ownership
Bitcoin holders authorize transactions with private keys. Corresponding public keys allow the network to verify signatures without revealing those private keys. Deriving a private key from a public key is practically infeasible for ordinary computers, but a sufficiently powerful quantum computer could do so using Shor’s algorithm.
Exposure differs across coins. Some early Bitcoin outputs reveal public keys directly on-chain; other addresses expose them when their owners first spend. That means not every wallet faces the same quantum risk.
The hypothetical arrival of a computer capable of breaking Bitcoin’s cryptography is often called “Q-Day.” According to the report, no machine has yet demonstrated that capability, and its arrival date is unknown.
The underlying custody problem is straightforward: once an attacker can derive a private key, the network cannot distinguish the attacker’s valid signature from the owner’s.
How a ‘quantum landmine’ would work
Fields’s proposed defense would let an owner prepare concealed evidence of ownership before quantum attacks become feasible.
Consider the report’s example of an owner with 1 BTC in a vulnerable older output:
- Before Q-Day, the owner creates a small quantum-resistant output containing a hidden commitment that establishes their prior ownership. Outsiders cannot see the evidence or necessarily recognize it as a trap.
- After Q-Day, anyone attempting to move the vulnerable 1 BTC must post another 1 BTC as collateral from quantum-resistant funds.
- The original coin and collateral are locked together for a challenge period—30 days is an illustrative example, not a settled parameter.
- If the owner presents the previously committed proof during that window, they can recover the full 2 BTC into a prepared quantum-resistant address: their original coin plus the attacker’s collateral.
An attacker would not know in advance which vulnerable outputs contain these concealed defenses. Successfully deriving a private key could therefore lead to a loss rather than a profitable theft.
But the same rule would apply to an honest owner moving their own old coins after Q-Day. Someone without an additional 1 BTC available for collateral could struggle to move the original 1 BTC. The mechanism also depends on the owner preparing the proof in advance and responding within the challenge window.
Auctions for coins whose owners cannot respond
Quantum landmines would not protect coins whose private keys were already lost or whose owners could no longer participate. Fields therefore also explored two auction mechanisms.
A collateral auction
Before Q-Day, participants could lock quantum-resistant bitcoin to place concealed bids associated with vulnerable outputs.
In the report’s example, an apparently abandoned wallet holds 50 BTC. A future attacker attempting to move those coins would have to post 50 BTC in collateral. Participants who had committed funds beforehand could then challenge the attempted transfer during an auction window.
A successful challenger would receive part of the attacker’s collateral. The original 50 BTC would be destroyed, rather than awarded to the challenger. This would not recover funds for an absent owner; its purpose would be to undermine the incentive to steal them.
A “satoshi auction”
The third mechanism would require no advance locking of funds. An attempt to move vulnerable coins would trigger bidding automatically.
Under the outline reported, the highest bidder would receive the coins minus their bid, while the second-highest bidder would lose their bid and receive nothing. Fields’s idea draws on the “dollar auction,” in which participants may keep raising their offers to avoid accepting a loss.
The intended deterrent is the prospect of costly competition. However, the report says the auction’s final objectives and allocation of funds were not settled. These mechanisms should therefore be read as proposed incentive structures, not demonstrated guarantees that attacks would be unprofitable.
Keeping old coins movable comes with trade-offs
An alternative response would impose a migration deadline and prohibit spending from older wallets afterward. That could prevent theft, but it would also permanently lock out genuine owners who failed to migrate in time.
Fields’s approach instead attempts to keep old coins spendable while making transfers subject to collateral requirements and challenges. That avoids a blanket freeze, but introduces other risks:
- Legitimate owners would need substantial additional collateral.
- Holders who remain offline could miss the recovery window.
- Coins belonging to living but temporarily inactive owners could be destroyed through an auction.
For Bitcoin’s store-of-value role, the distinction matters: deterring theft is not the same as ensuring that every owner can retain practical access to their savings.
What implementation would require
The proposal first depends on a quantum-safe way to hold and spend bitcoin. Wallets would need to support hidden ownership commitments, while consensus rules would have to enforce collateral, waiting periods, special recovery transactions and auctions.
Developers would also need agreement on activation conditions, collateral amounts, and the treatment of unsuccessful bids or remaining funds. Fields suggested that some mechanisms might be introduced through a soft fork, but did not provide a detailed design.
The central question remains unresolved: could economic penalties discourage quantum attacks without imposing unacceptable costs on legitimate holders? Fields’s thought experiment explores that trade-off; it does not establish that Bitcoin already has a working quantum defense.
Source: Original article published by TechFlow, November 9, 2026, 16:16:03 UTC+8. The supplied article credits Jose of Decrypt as author and Chopper of Foresight News for the Chinese translation.