A future quantum computer might let a thief recover a Bitcoin private key from its public key. But what if using that stolen key also meant putting the thief’s own bitcoin at risk?
That is the question behind Bitcoin developer Cory Fields’s proposed “quantum landmines” and two auction mechanisms. In a November 4 post to the Bitcoin development mailing list, Fields described them as thought experiments, not a finished upgrade.
As reported by Decrypt on November 8, 2026, the aim is to make quantum theft an uncertain, potentially costly gamble. None of these protections exists in Bitcoin today.
The problem: a valid signature does not identify the rightful owner
Bitcoin owners authorize transactions with a private key. The matching public key lets the network verify a signature without learning that secret.
Today’s computers cannot realistically recover the private key from the public one. A sufficiently powerful quantum computer could potentially do so using Shor’s algorithm, allowing an attacker to sign transactions as though they owned the coins.
Exposure varies. Some older Bitcoin outputs expose public keys, as do certain newer formats. Other addresses hide the public key until their coins are spent.
Researchers call the hypothetical arrival of a computer capable of such attacks “Q-Day.” No publicly demonstrated machine can steal bitcoin this way today, and nobody knows exactly when one might exist.
The underlying difficulty is that Bitcoin cannot distinguish an honest owner from a quantum thief when both can produce the same valid signature. Fields’s ideas would add financial risks and opportunities to challenge a transfer.
Example: a 1 BTC quantum landmine
Before Q-Day, an owner of 1 BTC in a vulnerable wallet would create a small, separate quantum-safe output. It would contain a hidden commitment proving that they controlled the original private key before quantum theft became possible—a kind of sealed ownership receipt.
Outsiders could see the small output, but not the hidden evidence or that it represented a trap.
Under Fields’s proposed rules, a future thief who recovered the old private key would have to contribute 1 BTC of their own as collateral from a quantum-safe wallet to move the owner’s 1 BTC. Both coins would enter a restricted output worth 2 BTC.
The attacker would then wait through a challenge period—30 days in Fields’s example. If the owner noticed the transfer and revealed the pre-Q-Day proof in time, they could move the full 2 BTC to the quantum-safe address committed to earlier: their original coin plus the attacker’s collateral.
Because the attacker could not identify these hidden receipts in advance, recovering a private key would not guarantee a profit.
The burden would also fall on legitimate owners. An owner making a normal post-Q-Day transfer of their own legacy coin would need matching collateral too. Someone without spare BTC could find it difficult to move their savings.
Auctions for coins without an active defender
Landmines would require owners to prepare before Q-Day and respond within the challenge period. They would not protect coins whose keys were already lost, including some early holdings widely believed to be inaccessible.
Fields’s staked auction explores a different response. Before Q-Day, someone could lock up quantum-safe bitcoin and secretly register a bid against a particular old wallet.
In the reported example, an apparently abandoned wallet holds 50 BTC. A future attacker attempts to move it and supplies another 50 BTC as collateral. A bidder who committed in advance could challenge the transfer during the auction period. A successful challenger would receive part of the attacker’s collateral, while the original vulnerable coins would be destroyed—not returned to a missing owner or awarded to the bidder.
The purpose would be to deny attackers a dependable payoff.
A separate sats auction would require no advance stake. An attempted vulnerable-coin spend would trigger a contest: the highest bidder would receive the coins minus their bid, while the runner-up would pay their bid and receive nothing.
That structure could encourage escalating bids as participants tried to avoid paying for no reward. The possibility of a contest costing more than the targeted coins might deter a thief from starting it. But the auction design remains unresolved.
The trade-off: keeping coins spendable comes at a cost
Another proposed response to quantum risk is to restrict spending from outdated wallets after a migration deadline. That could prevent theft, but it could also permanently lock out legitimate owners who had not moved their coins.
Fields’s approach explores keeping old coins potentially spendable while making transfers costly and open to challenge. That does not remove the difficult choices. Honest owners might need substantial collateral, inactive holders could miss the challenge window, and auctions might destroy coins belonging to people who were merely offline.
Implementation would also require much more than an auction rule. Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would need to support hidden ownership commitments, and consensus rules would need to enforce collateral, waiting periods, recovery transactions and auctions.
Developers would also have to settle activation timing, collateral amounts and the treatment of losing bids or remaining funds. Fields believes some mechanics could be introduced through a soft fork, but has not supplied a detailed design, implementation or activation schedule. His original post leaves auction payouts—and even the desired outcome of an auction—unresolved.
The central idea is to make a stolen key less useful by attaching a possible loss to its use. The limitation is equally important: those same costs and restrictions could fall on rightful owners.
Source: Decrypt’s original article, published November 8, 2026, at 22:01:03 UTC+08:00.