A sufficiently powerful quantum computer could let an attacker derive a Bitcoin private key from an exposed public key. Bitcoin developer Cory Fields has explored a different line of defense: make attempts to spend vulnerable coins financially risky, even after their keys can be cracked.
His “quantum landmines” concept and two auction mechanisms are thought experiments—not a finalized Bitcoin upgrade. Their central trade-off is that costs imposed on attackers would also fall on legitimate holders.
This account follows an article published by TechFlow on November 9, 2026, at 16:16:03 UTC+8, credited to Jose of Decrypt and translated by Chopper of Foresight News.
What would a quantum attacker gain?
Bitcoin users authorize transactions with private-key signatures. The corresponding public keys allow the network to verify those signatures. Ordinary computers cannot practically derive the private key from the public key, but a sufficiently capable quantum computer could do so using Shor’s algorithm.
Exposure is not uniform. Some early Bitcoin addresses have public keys visible on-chain; other addresses reveal them when their owners first spend. The source uses “Q-Day” for the point at which a quantum computer can break Bitcoin’s cryptography. At the time of the report, no machine had demonstrated that capability, and its arrival remained uncertain.
A quantum landmine: collateral before withdrawal
Fields’ proposed defense would let a holder prepare a hidden ownership commitment before quantum attacks become feasible. That commitment would provide evidence that the holder controlled the vulnerable coins before an attacker could derive their private key.
Illustrative example from the source: A holder has 1 BTC in a vulnerable output. Before Q-Day, they create a small quantum-resistant output containing a concealed ownership proof. Outsiders cannot see the evidence or necessarily tell that a landmine exists.
Under the proposed rules, someone later trying to move that vulnerable 1 BTC would have to post another 1 BTC as collateral from quantum-resistant funds. Both amounts would be locked during a challenge period—30 days is given as an example, not a settled parameter.
If the original holder submitted the earlier proof in time, they could recover their own 1 BTC and claim the attacker’s 1 BTC collateral, moving the total to a prepared quantum-resistant address.
The deterrent is uncertainty: cracking a key would not reveal whether the coins were protected by a hidden commitment. A successful cryptographic attack could therefore end in a financial loss.
But the same rule would apply to the real owner. Moving that old 1 BTC after Q-Day would also require 1 BTC in collateral. Without spare funds, a legitimate holder could struggle to access their coins.
What about coins whose owners cannot respond?
A landmine depends on advance preparation and a timely challenge. It cannot protect a holder who lost their private key long ago and can no longer participate.
Fields also explored two auction mechanisms aimed at making attacks on such coins less attractive.
Collateral auctions
Before Q-Day, participants could lock quantum-resistant bitcoin and secretly bid against a vulnerable wallet. In the source’s example, an apparently abandoned wallet holds 50 BTC. A future attacker attempting to move those coins would have to post 50 BTC in collateral.
During an auction window, an earlier bidder could challenge the attempt. A successful challenger would receive part of the attacker’s collateral, while the vulnerable 50 BTC would be destroyed rather than awarded to the challenger.
This would not recover funds for an absent owner. Its purpose would be to undermine the attacker’s expected payoff.
Satoshi auctions
A second auction design would not require funds to be locked in advance. An attempt to move high-risk coins would trigger bidding. The highest bidder would receive the coins, less their bid; the second-highest bidder would lose their bid and receive nothing.
The source compares this to the “dollar auction,” in which bidders may keep raising their offers to avoid accepting a loss. The intended deterrent is the risk of entering a costly bidding contest—not a demonstrated guarantee that every attacker would lose money.
Why not simply freeze vulnerable coins?
A migration deadline followed by a blanket freeze could stop quantum theft from old wallets. It would also permanently lock out genuine holders who missed the deadline.
Fields’ approach instead keeps a conditional route to spending: provide collateral and accept the possibility of a challenge. That addresses a basic identification problem. A valid signature alone would not tell the network whether the spender was the original owner or a quantum attacker.
The costs remain substantial. Genuine owners would need collateral. Holders who stayed offline could miss a challenge window. Some coins could be destroyed through an auction even if their owners were alive but temporarily absent.
What would implementation require?
Bitcoin would first need a quantum-safe way to hold and spend funds. Wallets would need to support hidden ownership commitments, and consensus rules would have to enforce collateral, waiting periods, special recovery transactions and auctions.
Developers would also need agreement on activation conditions, collateral amounts, and the treatment of losing bids and remaining funds. Fields suggested that parts of the design might be introduced through a soft fork, but supplied no detailed implementation plan.
At the time of the report, none of these protections existed on Bitcoin. There was no code implementation or launch timetable, and auction payouts and final objectives remained unsettled.
The proposal’s durable question is whether economic penalties could supplement cryptographic defenses. Its limitation is equally clear: making vulnerable coins expensive to steal can also make them expensive—or impossible—for their rightful owners to move.