Quantum Landmines: A New Defense for Bitcoin Wallets

Bitcoin’s theoretical quantum threat and a bold proposal

Bitcoin Core developer Cory Fields has proposed an experimental defense concept he calls "quantum landmines" to discourage future thefts of BTC using sufficiently powerful quantum computers. The idea, published on the Bitcoin Development Mailing List on November 4, outlines a mechanism that would require anyone attempting to move Bitcoin from addresses with exposed public keys to post matching collateral from a quantum-safe output. Fields’ design aims to make attackers risk losing their own funds if they try to spend coins that may be vulnerable to quantum cryptanalysis.

Share

Why this matters: exposed public keys and the quantum risk

Bitcoin’s cryptography rests on elliptic-curve keys: a private key signs transactions and a public key verifies them. For many older transaction formats and addresses — especially early formats that directly reveal public keys (P2PK) and cases of address reuse — those public keys are already visible on-chain. That exposure is not a problem today: no publicly known quantum computer can derive a Bitcoin private key from a public key. But researchers and developers worry that a sufficiently powerful quantum attacker could one day recover private keys from exposed public keys and drain funds.

Security vendors and industry research reports have flagged potentially millions of BTC in older, vulnerable addresses. Companies such as Fireblocks have estimated a material portion of on-chain funds could be at risk if quantum advances accelerate, and exchanges like Coinbase have publicly urged the ecosystem to prepare for migration to quantum-safe addresses.

How quantum landmines would work

Fields’ proposal is a thought experiment intended to explore technical options and policy trade-offs. In his design, when a user tries to spend from a vulnerable output (an output whose public key is exposed), the spending transaction would require the sender to provide collateral from a quantum-safe wallet equal to the amount being moved.

For example, moving 1 BTC from a vulnerable address would also require posting an additional 1 BTC in a new quantum-safe output. Both the moved coins and the collateral would enter a special locked output with spending restrictions and a waiting period (Fields suggested a 30-day example). During that waiting period, a previously prepared ownership proof by the original owner could be revealed to reclaim the coins and seize the attacker’s collateral.

Pre-committed ownership proofs

A key element is that legitimate owners could (before quantum attacks are practical) publish or prepare a hidden ownership commitment proving their prior control of a vulnerable address. If a quantum attacker later succeeds and attempts to spend the coins, the original owner could reveal the commitment during the waiting period and recover their funds while confiscating the attacker’s collateral.

Fields describes this with an illustrative scenario: “However, Alice notices the transaction in the meantime,” Fields wrote, describing how the legitimate owner could reclaim her funds while taking the attacker’s collateral. The attacker would not know whether a commitment exists, which Fields suggests could make theft unattractive — attackers might risk losing more than they gain.

Auctions for long-lost wallets: dealing with truly abandoned coins

Not all vulnerable outputs have owners who can prepare commitments: many old wallets are likely lost forever or inaccessible. To handle those cases, Fields outlined a secondary auction mechanism. Participants could pre-commit hidden bids against a dormant wallet’s funds. If an attacker tries to spend those coins and the ownership-proof window expires without recovery, an auction would enable bidders to reveal bids and claim portions of the attacker’s collateral.

Under one design, a successful bid could result in the vulnerable coins being destroyed (burned) and bidders or other designated recipients receiving collateral payouts. Fields also discussed alternative auction rules proposed in conversations with Neha Narula at MIT’s Digital Currency Initiative that could impose penalties on bidders who attempt to game the system. The auctions are not guaranteed to return coins to their original owners; their main purpose is deterrence — to make quantum theft economically unattractive.

Potential downsides: friction for legitimate users

A major trade-off is usability. Requiring collateral equal to the amount being moved from a vulnerable wallet could create real obstacles for legitimate owners who do not have additional Bitcoin in quantum-safe outputs. For instance, someone with their entire balance in an old wallet would need to acquire extra BTC or migrate funds first — a practical difficulty that could lock up funds.

Fields acknowledges this UX penalty and the underlying problem: Bitcoin alone cannot algorithmically distinguish a legitimate spender from a quantum attacker who has obtained the private key. As he put it in the mailing-list post, “The purpose of this post is just to introduce the ideas as thought experiments,” Fields wrote, noting he had not specified the exact software changes required to implement them.

Implementation hurdles and consensus changes

The quantum landmine approach would require several non-trivial changes to Bitcoin’s rules and infrastructure. First, the network would need formal support for quantum-safe outputs and a way to tag outputs as vulnerable. Then consensus rules would need to be modified to enforce collateral, waiting periods, proof-reveal windows, and auction mechanics. Any such changes would need broad community review, testing, and likely a lengthy deployment roadmap — possibly years.

Developers have explored other quantum-resilience strategies as well. BitMEX proposed activating restrictions on older outputs only after evidence of a successful quantum attack, and major custodians and exchanges have emphasized advancing wallet migration to quantum-safe key schemes well ahead of any practical threat.

Industry context and why it’s still theoretical

At present, no public quantum device is known to have the capability to break Bitcoin’s elliptic-curve signatures at scale. The proposal is therefore speculative and preventative. However, several industry actors — including Coinbase, Fireblocks and academic researchers — argue that migration to quantum-resistant cryptography will take years and should begin proactively.

Fields’ idea contributes to a broader conversation about how blockchain protocols can create economic incentives and technical barriers to reduce risk while balancing user experience and decentralization.

Conclusion: a provocative defensive model that needs debate

"Quantum landmines" are a provocative design: they introduce financial friction and complexity to make future quantum-enabled thefts risky and costly. The proposal highlights familiar trade-offs in blockchain security — deterrence versus convenience, and protocol change versus developer and user burden. Key design choices remain unresolved: collateral ratios, auction deadlines, penalties for losing bids, and the precise conditions that would allow vulnerable coins to be destroyed.

While still hypothetical, Fields’ proposal deepens the community’s discussion about how to prepare Bitcoin for eventual quantum advances. Any real-world adoption would require quantum-safe outputs, carefully drafted consensus changes, wide community review, and long lead times for migration. Until quantum hardware reaches the level required for large-scale cryptographic breaks, these ideas offer a framework for debate and planning rather than immediate protocol changes.

"The purpose of this post is just to introduce the ideas as thought experiments," Fields wrote. The mailing-list discussion is likely to continue as developers, researchers and custodians weigh the costs and benefits of different strategies to harden Bitcoin against a possible quantum future.