A valid Bitcoin signature would not distinguish a legitimate owner from a quantum attacker who had recovered the same private key. That verification problem is the starting point for Bitcoin developer Cory Fields’s proposed “quantum landmines”: rules that would make spending vulnerable coins require collateral and expose the transaction to challenges.
In a November 4 post to the Bitcoin development mailing list, reported by Decrypt on November 8, 2026, Fields outlined landmines and two auction mechanisms. He described them as thought experiments, not a completed Bitcoin upgrade. At the time of the report, none of these protections existed in Bitcoin, and Fields had published neither an implementation nor an activation schedule.
What makes a Bitcoin output vulnerable?
Bitcoin owners authorize transactions with a secret private key. The corresponding public key allows the network to verify signatures without learning that secret.
Today’s computers cannot realistically derive the private key from the public key. A sufficiently powerful quantum computer could potentially do so using Shor’s algorithm, allowing an attacker to spend coins with signatures that appear valid.
Exposure varies by output: some older Bitcoin outputs have public keys already visible, and certain newer formats expose them too. Other addresses conceal the public key until a spend occurs. Wallets therefore do not all face identical risks.
Researchers call the hypothetical arrival of a machine capable of such attacks “Q-Day.” At the time of the report, no publicly demonstrated machine could steal Bitcoin this way, and the timing remained unknown.
The landmine: a hidden commitment and matching collateral
Fields’s example begins with an owner holding 1 BTC in an old, potentially vulnerable wallet.
Before Q-Day, the owner would create a small, separate quantum-safe Bitcoin output containing a hidden proof that they controlled the original private key before quantum theft was possible. Outsiders could see the small output, but not its concealed evidence or whether it was a trap.
Under the proposed rules, a future attacker who recovered the old private key could not simply spend the 1 BTC. The attacker would have to contribute another 1 BTC from a quantum-safe wallet as collateral. Both amounts would enter a restricted output holding 2 BTC.
A challenge period would follow—30 days in Fields’s example—before the attacker could spend freely. If the owner noticed the transaction and revealed the earlier proof in time, the network would allow the owner to move the entire 2 BTC to the quantum-safe address committed to beforehand.
The attacker would lose the collateral without being able to identify the hidden landmine in advance. Successfully recovering a private key could therefore produce a 1 BTC loss rather than a profit.
The same rule would burden honest owners: moving their own legacy coin after Q-Day would also require matching collateral. Someone without spare BTC could struggle to move their savings.
Auctions for coins without an active defender
Landmines depend on an owner preparing a commitment before Q-Day and revealing it within the challenge window. They would not protect coins whose keys were already lost, including some early holdings widely believed to be inaccessible.
Fields outlined two other mechanisms:
- Staked auction: Before Q-Day, a participant could lock up quantum-safe Bitcoin and secretly register a bid against a particular old wallet. In the example, an apparently abandoned wallet holds 50 BTC, and an attacker attempting to move it posts another 50 BTC as collateral. A participant with an advance commitment could challenge the attempt during the auction period. A successful challenger would receive part of the attacker’s collateral, while the original vulnerable coins would be destroyed—not returned to a missing owner or awarded to the bidder.
- Sats auction: No advance stake would be required. Spending vulnerable coins would trigger a contest in which the highest bidder receives the coins minus their bid, while the runner-up pays their bid and receives nothing. That structure could encourage escalating bids as participants try to avoid paying for no return, potentially making the contest costlier than the coins an attacker hoped to take.
These are proposed deterrents, not settled payout systems. Fields’s post left auction payouts and even the desired auction outcome unresolved.
The trade-off and implementation gap
An alternative response to quantum risk would restrict spending from outdated wallets after a migration deadline. That could prevent theft but permanently exclude legitimate owners who had not moved their coins.
Fields’s approach instead seeks to keep old coins potentially spendable while making transfers costly and challengeable. The consequences could still be severe: honest owners might need substantial collateral, inactive holders could miss a challenge window, and auction rules might destroy coins belonging to people who were merely offline.
Implementation would first require a quantum-safe way to hold and spend Bitcoin. Wallets would need hidden ownership commitments, and consensus rules would need to enforce collateral, waiting periods, recovery transactions and auctions. Developers would also have to settle activation timing, collateral requirements, losing bids and leftover funds.
Fields believed some mechanics could be introduced through a soft fork, a type of Bitcoin rule change, but had not supplied a detailed design. The proposal therefore remained an exploration of incentives and ownership evidence—not an available protection for Bitcoin holders.
Original reporting: Decrypt, published November 8, 2026, at 22:01:03 UTC+08:00.