Quantum Thieves Could Face Bitcoin “Landmines” in Developer’s Proposal
Bitcoin developer Cory Fields has put forth an unconventional strategy to counter future quantum computing threats: forcing potential quantum thieves to risk their own Bitcoin every time they attempt to steal someone else’s.
In a November 4 post to the Bitcoin development mailing list, Fields detailed concepts for “quantum landmines” and two types of auctions, all designed to transform attacks on vulnerable wallets into costly gambles. He characterized these ideas as “thought experiments” rather than a finalized Bitcoin upgrade.
Bitcoin transactions are authorized using a private key, a secret code known only to the owner. A corresponding public key allows the network to verify these signatures without revealing the private key. Current computers are incapable of deriving the private key from the public one. However, a sufficiently powerful quantum computer could employ Shor’s algorithm, a mathematical technique, to achieve this, potentially enabling a thief to spend coins as if they were their own.
Some older Bitcoin outputs have publicly exposed keys, and certain newer formats also reveal them. Other addresses conceal the key until a transaction is initiated, meaning the risk is not uniform across all wallets. Researchers refer to the hypothetical advent of a computer capable of such attacks as “Q-Day.” No publicly demonstrated machine can currently steal Bitcoin in this manner, and the timeline for their development remains uncertain.
The “Quantum Landmine” Concept
Fields’s proposal envisions a scenario where an individual owns Bitcoin in an older, potentially vulnerable wallet. Before Q-Day, this person could create a small, separate Bitcoin output secured by quantum-resistant cryptography. This output would contain a hidden proof of their ownership of the original private key at a time when quantum theft was not yet feasible. This can be likened to a sealed receipt of ownership. While outsiders can observe the small output, they cannot access the concealed evidence within or discern that it represents a trap.
Under Fields’s proposed rules, if a future thief uses a quantum computer to recover the user’s old private key, they cannot simply seize the original Bitcoin. Instead, they would be required to deposit an equivalent amount of their own Bitcoin from a quantum-safe wallet as collateral. Both the original Bitcoin and the collateral would then be placed into a restricted output totaling twice the original amount. The thief would then face a waiting period, such as 30 days in Fields’s example, before being able to spend the funds freely.
The original wallet owner, upon noticing the transaction, could then reveal their pre-Q-Day proof. The network would subsequently permit the owner to transfer the entire sum—the original Bitcoin plus the thief’s collateral—to a quantum-safe address they had previously designated. This mechanism means that attackers would have no prior knowledge of which older wallets contain these hidden receipts. Even a successful quantum key recovery could result in a loss of 1 BTC for the attacker.
However, the proposal also introduces a potential drawback for legitimate owners. To initiate a standard post-Q-Day transaction of their legacy Bitcoin, the owner would also need to provide matching collateral. If they lack sufficient spare Bitcoin, the same rule intended to deter thieves could impede their ability to move their own savings. Furthermore, these “landmines” are only effective if an owner proactively sets them up before Q-Day and reveals them in a timely manner. They cannot protect coins whose keys are already lost, including a significant portion of early Bitcoin holdings believed to be permanently inaccessible.
Staked and Sats Auctions
Fields also proposes a second mechanism: a staked auction. Before Q-Day, an individual could lock up quantum-safe Bitcoin and secretly register a bid against a specific older wallet they anticipate will be targeted by thieves.
For instance, if an apparently abandoned wallet holds 50 BTC, and a future attacker attempts to move it, they would be required to post an additional 50 BTC as collateral. During the auction period, someone who had previously committed a bid could challenge this attempted theft. In Fields’s example, a successful challenger would claim a portion of the attacker’s collateral, while the original vulnerable coins would be destroyed rather than awarded to the bidder. The objective here is to deny thieves a predictable payout, not necessarily to return the coins to a missing owner.
A third idea, the “sats auction,” requires no advance stake. Instead, an attempt to spend a vulnerable coin would trigger a contest. The highest bidder would receive the coins, minus their bid amount, while the runner-up would forfeit their bid and receive nothing. This resembles a well-known auction game where bidders continuously increase their offers to avoid being the one who loses money without gaining anything. A thief might therefore be deterred from initiating a contest that could prove more costly than the coins they aimed to steal.
A Trade-Off Between Security and Accessibility
One proposed response to the quantum risk involves restricting spending from outdated wallets after a designated migration deadline. While this could prevent theft, it might also permanently lock out legitimate owners who have not moved their coins.
Fields is exploring a different trade-off: maintaining the spendability of older coins while making attempted transfers costly and subject to challenges. The fundamental challenge is that Bitcoin cannot distinguish between an honest owner and a quantum thief if both can produce the same valid signature.
This trade-off presents significant implications. Honest owners might be required to deposit substantial collateral, inactive holders could miss their window to object to a theft, and auction rules could potentially result in the destruction of coins belonging to individuals who are alive but simply offline.
Implementing these proposals would necessitate substantial changes to Bitcoin. The network would first require a quantum-safe method for holding and spending funds. Wallets would need to support hidden ownership commitments, and Bitcoin’s consensus rules would have to enforce collateral requirements, waiting periods, specialized recovery transactions, and auction mechanisms. Developers would also need to reach an agreement on the activation timeline for these new rules, the required collateral amounts, and the disposition of losing bids or any remaining funds. Fields suggests that some of these mechanics could be introduced via a soft fork, a type of Bitcoin rule change, but has not provided a detailed design.
Currently, none of these protective measures exist within Bitcoin. Fields has not published any implementation or activation schedule, and his original post leaves the specifics of auction payouts and even the desired outcome of an auction unresolved.
Leave a Reply