A sufficiently powerful quantum computer could one day derive private keys from exposed public keys on the Bitcoin blockchain, enabling theft of coins that have never been moved to quantum-resistant formats. On November 4, 2026, Bitcoin Core developer Cory Fields, who works at MIT’s Digital Currency Initiative, posted a detailed thought experiment to the bitcoin-dev mailing list titled “Quantum Landmines and Vulnerable Coin Auctions.” The proposal does not attempt to make Bitcoin’s existing cryptography quantum-resistant. Instead, it focuses on changing the economic incentives after what Fields calls “qday,” the point when quantum attacks become practical, by requiring anyone who spends a legacy output to lock up an equal amount of their own Bitcoin as collateral. Fields assumes a quantum-safe output type already exists before Qday and that new validation rules activate afterward.
Under those conditions, every attempt to spend an older, vulnerable coin would create a time-locked output that gives prepared owners or third-party stakers a window to intervene. The ideas remain conceptual; Fields explicitly deferred soft-fork design details to future work and described the post as an introduction of rough ideas rather than a completed specification. The central claim is that Bitcoin’s defense against quantum key recovery does not have to rely solely on freezing coins or forcing a full migration. By attaching a financial penalty to any post-qday spend of exposed outputs and allowing pre-committed proofs or bids to claim that penalty, the network can make quantum theft self-defeating for many coins while leaving lost or abandoned funds to competitive market mechanisms. This approach accepts that some coins will remain vulnerable yet seeks to ensure attackers cannot profit from them without risking their own capital.
Key Takeaways
- Cory Fields proposed quantum landmines on November 4, 2026, requiring matching collateral for any spend of quantum-vulnerable Bitcoin outputs.
- A commit-reveal scheme lets prepared owners reclaim their coins and seize an attacker’s collateral during a waiting period of roughly 30 days.
- Staked and Sats auctions extend the concept to coins whose private keys are believed lost, using competitive bidding to burn or reallocate funds.
- Roughly 6.26 million BTC, or 31.2 percent of supply, currently sit behind already-exposed public keys, according to Glassnode data from October 2026.
- Recent Alice & Bob estimates suggest a machine with about 30,000 physical qubits could derive a Bitcoin private key in roughly 62 minutes, though the figures remain theoretical.
- The mechanisms assume quantum-safe output types and post-qday consensus rules that have not yet been written or activated.
How Quantum Landmines Alter the Cost of Attempting Legacy Coin Theft
Quantum landmines introduce a collateral requirement that forces any spender of a vulnerable output to lock an equal amount of Bitcoin from a quantum-safe wallet. In Fields’ illustrative example, moving 1 BTC from a legacy pay-to-public-key output requires the spender to contribute another 1 BTC as collateral. Both amounts enter a new output subject to special spending conditions that include a time lock. A spender who cannot supply a pre-qday proof of knowledge must wait, for instance, 30 days before the output can be spent freely. During that window, the original owner, if still in possession of the keys, can intervene.
The design deliberately blurs the distinction between legitimate owners and attackers because the blockchain cannot tell them apart once public keys are exposed. Consequently, even an honest holder who wishes to move their own vulnerable coins must post matching collateral under the proposed rules. This friction is accepted as the price of creating uncertainty for potential quantum thieves. Because a landmine appears identical to any ordinary quantum-safe output, an attacker cannot scan the chain in advance to identify which coins are protected. The result is a probabilistic deterrent: every attempted theft carries the risk that the collateral will be claimed by a hidden proof prepared years earlier.
The Commit-Reveal Construction That Lets Owners Seize Attacker Collateral
Before qday, an owner creates a small quantum-safe output that embeds a hidden commitment. In Fields’ description, this can take the form of a taproot-like tree containing a leaf that commits to a new quantum-safe public key and is signed by the legacy private key. The leaf remains unrevealed until it is needed. Once the vulnerable coin is spent together with collateral into the time-locked output, the owner includes the landmine as an input and reveals the proof. The spending conditions then allow the owner to direct the combined funds to the previously committed key, thereby recovering the original coins and taking the attacker’s collateral in the same transaction.
Fields noted that the scheme creates an unusual incentive: owners may deliberately leave vulnerable coins in place and prepare landmines to bait an attacker and potentially double their holdings. An attacker who cannot distinguish protected from unprotected coins must treat every target as potentially mined. The mechanism therefore does not require continuous monitoring after qday; the proof is already committed and can be activated when the attack transaction appears on-chain. Because the landmine itself is a standard quantum-safe output of trivial value, preparing it imposes minimal ongoing cost while preserving the option to claim a large collateral windfall.
Staked Auctions That Allow Third Parties to Contest Lost Coins
Landmines protect only coins whose owners still control the private keys. Fields acknowledged that many vulnerable outputs are believed to have permanently lost keys, including early pay-to-public-key coins associated with the Bitcoin creator. For those cases the proposal adds a staked-auction path. Before qday, participants create quantum-safe outputs that secretly commit to a specific vulnerable coin, a bid amount, and a new public key. After the landmine timeout expires without a proof being revealed, an auction period opens during which these pre-staked bids can be revealed.
In the worked example, a 50 BTC vulnerable output is spent with 50 BTC of attacker collateral into a 95 BTC output, representing a 45 BTC bid. A pre-staked participant who bid 40 BTC can then claim that portion of the collateral while the original coins are burned. Subsequent higher or lower bids continue the auction until a final timeout. Design choices remain open: stakers might recover their own capital on a losing bid or face slashing; unused collateral could be burned, paid to the winner, or distributed to miners. The essential property is that an attacker never successfully steals the coins if any landmine or sufficiently competitive staked bid exists. The attacker’s only profitable path is to outbid every prepared participant, which the staking requirement makes capital-intensive.
Dollar-Auction Logic Applied in the Sats Auction Variant
A second auction design, suggested by Neha Narula and labeled the Sats Auction, dispenses with pre-qday staking. Every post-qday spend of a legacy output triggers an open auction after the initial landmine timeout. The highest bidder wins the coins minus the amount of the bid, while the second-highest bidder loses the entire bid and receives nothing. This structure mirrors the classic dollar auction in which participants continue raising bids to avoid finishing in second place and therefore overbid relative to the value of the prize.
Because new bids can be added by anyone after the attack transaction appears, the auction can extend until no further bids arrive. An attacker who initiates the spend must therefore anticipate that rational participants will drive the total bids above the value of the target coins simply to avoid the second-place penalty. Fields observed that the rational strategy for an attacker under these rules is often not to play at all. Original owners remain free to participate and can recover a portion of their coins by outbidding others, even though the chain cannot distinguish them from third-party speculators. Open parameters include the collateral ratio required of the initial spender, minimum and maximum bid sizes, and the treatment of losing bids.
Scale of Currently Exposed Bitcoin Public Keys
Glassnode co-founder Rafael Schultze-Kraft reported on October 8, 2026, that approximately 6.26 million BTC, or 31.2 percent of circulating supply, sit in addresses whose public keys are already visible on-chain. Of that total, roughly 4.33 million BTC are exposed through address reuse, while 1.94 million BTC are exposed by script type, including 1.71 million BTC in early pay-to-public-key outputs and 222,000 BTC in Taproot outputs. Exchange holdings account for about 1.79 million of the exposed coins, representing 57 percent of identified exchange balances under the same methodology.
These figures have risen by 222,000 BTC since Glassnode’s May 2026 estimate of 6.04 million BTC. The increase outpaced new issuance over the same period, with centralized platforms contributing more than half of the additional exposure. While public-key visibility does not imply that the coins can be stolen today, no existing quantum computer can perform the required discrete-logarithm attack; the data quantify the eventual migration or protection problem. Fields’ mechanisms are designed precisely for this set of coins: those whose public keys are already known and therefore permanently vulnerable once a sufficiently powerful quantum computer appears.
Declining Resource Estimates for Quantum Attacks on Bitcoin Keys
In late October 2026, researchers at the quantum-computing firm Alice & Bob published a resource estimate showing that a machine built from approximately 29,588 physical cat qubits could solve the elliptic-curve discrete logarithm problem on the secp256k1 curve in 61.8 minutes. The figure is roughly 17 times lower than Google Quantum AI’s March 2026 upper-bound estimate of fewer than 500,000 physical qubits, although the two studies rely on different hardware architectures and noise assumptions. Alice & Bob’s calculation assumes an effectively infinite bit-flip lifetime on the order of a century and a one-microsecond error-correction cycle.
Because the modeled runtime exceeds Bitcoin’s average 10-minute block interval, the attack would not reliably intercept unconfirmed transactions. Coins whose public keys are already exposed, however, can be targeted at leisure once the hardware exists. The company noted that its estimates remain theoretical and that further reductions in qubit count or runtime remain possible. The publication nevertheless compressed the timeline debate: earlier projections that placed a cryptographically relevant quantum computer decades away now sit alongside concrete, if still distant, resource numbers measured in the low tens of thousands of physical qubits.
Why Landmines Cannot Protect Permanently Lost Keys
Fields stated directly that reliance on landmines alone is insufficient because “the associated private keys for many vulnerable outputs are believed to be lost; thus, a quantum attacker could reasonably assume that they are not guarded by landmines.” Early pay-to-public-key coins, including those attributed to the Bitcoin creator, fall into this category. Without a living owner who can prepare and later reveal proof, the landmine path never activates. The auction mechanisms therefore exist specifically to cover this residual set of coins by allowing any participant who stakes capital in advance to contest the theft.
The design choice has a secondary effect on chain analysis. Because landmines are indistinguishable from ordinary quantum-safe outputs, observers cannot accurately count how many coins remain unprotected on the day the new rules activate. An attacker therefore faces both known competitive bids and an unknown number of hidden owner proofs. For coins that are genuinely abandoned, the outcome under the staked-auction rules is typically that the original coins are burned and the attacker’s collateral is claimed by the highest-prepared bidder. This outcome prevents a pure windfall to the first quantum attacker while still returning value to participants who committed capital before the threat materialized.
Prerequisites of Quantum-Safe Output Types and Post-QDay Rules
All three mechanisms rest on two prerequisites that do not yet exist in Bitcoin. First, a standardized quantum-safe output type must be available before qday so that owners and stakers can create the necessary commitments. Draft proposals such as BIP-360 (Pay-to-Merkle-Root) have been discussed as possible foundations, but no consensus activation has occurred. Second, new validation rules must activate after qday, through a mechanism where Fields are likened to “Tripwire and/or manually”, that enforce full collateralization of every legacy spend and impose the required time locks and alternate spend paths.
These rules would be enforced implicitly by consensus rather than by ordinary script. The construction is therefore closer to a vault or covenant enforced at the protocol level than to a standard multisig or timelock that users can already deploy today. Because the soft-fork mechanics are left as future work, the proposal does not specify activation thresholds, flag-day timelines, or the precise cryptographic primitives that would constitute a quantum-safe output. Until those elements are designed and accepted, the landmine and auction ideas remain economic sketches rather than implementable consensus changes.
Waiting Periods That Create a Response Window for Owners and Stakers
The illustrative 30-day waiting period serves as the critical interval during which intervention is possible. Once a vulnerable output is spent with collateral, the resulting output cannot be re-spent by the original spender until the timeout expires, unless a valid pre-qday proof is supplied. During those 30 days any party who prepared a landmine or a staked bid can publish the revealing transaction and claim the funds according to the rules. After the timeout, if no such claim has occurred, the output becomes freely spendable by the party that created it.
The length of the period is a free parameter. A shorter window reduces the opportunity for owners to notice and respond; a longer window increases the capital cost for the attacker, who must leave the collateral locked. Fields used 30 days only as an example. In practice, the duration would need to balance the expected time required for a legitimate owner to detect the spend against the liquidity burden imposed on both attackers and honest users who move their own coins. Because the rules apply uniformly, every post-qday movement of exposed coins incurs this temporary lockup, regardless of whether the spender is the true owner or an attacker.
Incentives for Owners to Prepare Landmines Before the Threat Arrives
The landmine design creates a positive expected value for owners who prepare in advance. By embedding a hidden proof, an owner retains the ability both to move the coins later under the new rules and to capture an attacker’s collateral if an attempt occurs. Fields observed that this incentive structure encourages owners to “bait a quantum attacker pre-qday in order to double her vulnerable coins later.” The existence of such bait further deters attackers, because any given target may be protected by an invisible commitment that turns the theft into a loss.
Preparation cost is low: a trivial-value quantum-safe output is sufficient to hold the commitment. Once created, the landmine requires no further maintenance until it is needed. For large holders who already plan to migrate to quantum-safe formats, the incremental step of also creating a landmine adds an option value without preventing the migration itself. The same logic does not apply to coins whose keys are lost; those owners cannot prepare the proof. The overall effect is therefore concentrated on the subset of exposed coins that still have active, attentive owners capable of acting before qday.
Impact for Bitcoin’s Longer-Term Post-Quantum Migration Path
Fields’ proposal sits alongside other discussions about how Bitcoin should handle the transition once quantum-resistant signature schemes become available. Some earlier suggestions have focused on sunset mechanisms that eventually invalidate legacy signature types, while others have explored recovery protocols for coins whose seeds can still be proven. The landmine and auction approach occupies a middle ground: it does not freeze coins by fiat, nor does it allow the first quantum attacker to claim them unopposed. Instead, it inserts a capital cost and a competitive process that can return value either to the original owner or to pre-committed third parties.
Because the mechanisms activate only after qday and only for spends of legacy outputs, they leave the bulk of the network’s quantum-safe coins unaffected. Users who migrate before the threat materializes, never interact with the new rules. The residual risk is therefore confined to the set of coins that remain in exposed formats. Whether the community ultimately prefers this incentive-based path, a stricter sunset, or a combination of both remains an open governance question. Fields’ contribution is to demonstrate that economic penalties and pre-committed claims can be designed without requiring the network to confiscate or permanently freeze any particular set of coins.
Conclusion
Several parameters in the proposal are deliberately left unspecified. The collateral ratio need not remain 1:1; a higher ratio would further deter attacks but would also raise the cost for legitimate owners. Bid depth in the staked auction could be limited to prevent excessive nesting. Treatment of unused collateral, the precise length of the two successive timeouts, and the rules governing whether stakers recover capital on losing bids are all marked as design choices that would require further analysis. Fields also noted that desirable outcomes may shift over time as the proportion of spends that are genuine attacks increases.
Implementation would further require specifying the exact form of the quantum-safe output type, the activation method for the new validation rules, and the cryptographic format of the hidden commitments. Because the post is framed as a thought experiment, none of these elements have been reduced to a Bitcoin Improvement Proposal or tested against the existing soft-fork design process. Community discussion on the mailing list has so far been limited; the ideas have circulated primarily through secondary reporting that began the day after the original post. Until concrete specifications appear, the practical feasibility of enforcing the required spending conditions at a consensus level remains an open technical question.
FAQs
What exactly did Cory Fields propose on the bitcoin-dev mailing list?
On November 4, 2026, Fields outlined three related mechanisms, quantum landmines, staked auctions, and sats auctions, that would require any post-qday spend of a legacy Bitcoin output to be accompanied by matching collateral from a quantum-safe wallet. Prepared owners or third-party stakers could then claim that collateral by revealing hidden proofs or bids during defined waiting periods. The post presented the ideas as thought experiments and deferred the soft-fork mechanics needed to enforce them.
Would honest users also have to post collateral to move their own coins?
Yes. Because the blockchain cannot distinguish a legitimate owner from an attacker once the public key is exposed, the proposed rules would require every post-qday spend of a legacy output to be fully collateralized. An honest holder who prepared a landmine could later reclaim both the coins and any attacker collateral, but the initial movement would still incur the temporary lockup.
Are these mechanisms already part of Bitcoin’s consensus rules?
No. Fields explicitly described the ideas as thought experiments and stated that soft-fork design details were left for future work. No Bitcoin Improvement Proposal has been published, and no activation parameters have been defined. Realization would require both a standardized quantum-safe output type and new validation rules that enforce collateralization and time locks after qday.
How does the proposal relate to broader post-quantum migration efforts?
The mechanisms are complementary to, rather than a replacement for, migration to quantum-resistant signature schemes. Users who move coins to quantum-safe outputs before qday never interact with the new rules. The landmines and auctions address only the residual coins that remain in exposed formats, attempting to insert an economic cost and a competitive recovery process without freezing those coins by network decree.
Disclaimer: This general market information, possibly from third-party, commercial, or sponsored sources, is provided for reference and educational purposes only and does not constitute financial or investment advice, an offer, solicitation, or guarantee. We disclaim liability for its accuracy, completeness, reliability, and any resulting losses. Investments/trading are risky; past performance doesn’t guarantee future results. Users should research, judge prudently, and take full responsibility.
