Historical source: Decrypt, published November 8, 2026, at 22:01:03 UTC+08:00.
Bitcoin’s security depends in part on who can authorize a transfer. A private key lets its holder sign transactions; the corresponding public key lets the network verify those signatures. A sufficiently powerful quantum computer could undermine that distinction by deriving a private key from a public one.
In a November 4 post to the Bitcoin development mailing list, developer Cory Fields explored ways to make such attacks financially dangerous for thieves. His proposals—“quantum landmines” and two auction mechanisms—would require attackers to risk their own Bitcoin or enter potentially costly bidding contests.
Fields described these as thought experiments, not a completed Bitcoin upgrade. At the time of the report, none of the protections existed in Bitcoin, and he had published neither an implementation nor an activation schedule.
The threat: a valid signature may no longer establish ownership
Today’s computers cannot realistically recover a Bitcoin private key from its public key. A sufficiently powerful quantum computer could potentially do so using Shor’s algorithm, allowing an attacker to spend coins as though they were the owner.
Exposure varies. Some older Bitcoin outputs have publicly visible keys, as do certain newer formats. Other addresses conceal the public key until spending occurs.
Researchers call the hypothetical arrival of a computer capable of these attacks “Q-Day.” According to the report, no publicly demonstrated machine could steal Bitcoin this way, and the timing of such a capability remained unknown.
The underlying problem is that Bitcoin cannot distinguish a legitimate owner from a quantum thief if both can produce the same valid signature. Fields’s ideas would add financial stakes and opportunities to challenge transfers rather than rely on signatures alone.
Quantum landmines: a hidden ownership receipt
Under the proposed landmine mechanism, an owner would prepare before Q-Day by creating a small, separate quantum-safe Bitcoin output. It would contain a hidden commitment proving that they controlled the vulnerable private key before quantum theft became possible—a kind of sealed ownership receipt.
In the report’s example:
- An owner holds 1 BTC in a potentially vulnerable wallet.
- A future attacker recovers its private key but must supply 1 BTC of their own, held in a quantum-safe wallet, as collateral to move the targeted coin.
- The combined 2 BTC enters a restricted output, subject to a challenge period—30 days in Fields’s example.
- If the owner reveals the pre-Q-Day proof in time, they can move all 2 BTC to the quantum-safe address committed to earlier.
The attacker would lose their collateral. Crucially, they would not know in advance which vulnerable wallets had hidden landmines.
But the same restriction would apply to an honest owner making a normal post-Q-Day transfer of their legacy coin: they, too, would need matching collateral. Someone without spare Bitcoin could therefore struggle to move their own savings.
Landmines also depend on preparation and attention. An owner must establish the commitment before Q-Day and reveal it within the challenge period. The mechanism cannot protect coins whose keys have already been lost.
Auctions aimed at making theft unprofitable
Fields also outlined two auction mechanisms, including one intended to deter attacks on apparently abandoned holdings.
Staked auction
Before Q-Day, a participant could lock up quantum-safe Bitcoin and secretly register a bid against a particular vulnerable wallet.
For a wallet holding 50 BTC, a future attacker would have to post another 50 BTC as collateral to attempt a transfer. A participant with an advance commitment could then challenge it during the auction period.
In Fields’s example, a successful challenger would receive part of the attacker’s collateral, while the original vulnerable coins would be destroyed. The objective would be to deny thieves a dependable payout—not to restore funds to a missing owner.
Sats auction
The proposed sats auction would require no advance stake. A spend of vulnerable coins would instead trigger a bidding contest:
- The highest bidder would receive the coins, minus their bid.
- The runner-up would pay their bid and receive nothing.
That structure could encourage escalating bids as participants try to avoid paying for no return. The possibility of losing more than the targeted coins are worth might discourage an attacker from initiating the contest.
However, the report noted that Fields’s original post left auction payouts and even the desired auction outcome unresolved.
Preserving access comes with costs
An alternative response to quantum risk would be to restrict spending from outdated wallets after a migration deadline. That might prevent theft, but it could also permanently exclude legitimate owners who had not moved their coins.
Fields’s proposals explore a different compromise: leave old coins potentially spendable, while making transfers costly and contestable.
That is not an uncomplicated safeguard for savings. Honest owners might need substantial collateral; inactive holders could miss a challenge window; and auctions could destroy coins belonging to people who are simply offline rather than deceased or permanently unable to access them.
What implementation would require
Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would need to support hidden ownership commitments, and consensus rules would need to enforce collateral requirements, waiting periods, recovery transactions and auctions.
Developers would also have to settle activation conditions, collateral amounts, losing bids and the treatment of leftover funds. Fields believed some mechanics could be introduced through a soft fork, but had not supplied a detailed design.
For Bitcoin’s store-of-value role, the issue is the durability of ownership and access: whether a holder can retain and transfer coins if the security assumptions behind older keys fail. Fields’s thought experiments expose the trade-offs involved, but do not establish a working solution or a timetable for quantum risk.