Quantum landmines: a Bitcoin developer's plan to punish coin thieves

The threat. Bitcoin uses a key pair: the private key signs a payment, the public key lets others check it. Today's computers cannot work out the private key from the public one. A strong enough quantum computer could, using Shor's algorithm. The day such a machine arrives is called Q-Day. No publicly shown machine can do this today, and nobody knows when one will exist.

How a landmine works. Before Q-Day, the owner of old coins makes a tiny output of a new quantum-safe type. Hidden inside is proof that they held the old key. From outside it looks like any small output. After Q-Day, any spend of old coins needs equal collateral, and the result is locked for 30 days. If a thief moves the coins, the owner reveals the proof and takes everything: their coins and the thief's collateral. The thief cannot tell which wallets hide mines, so theft becomes a gamble.

What about lost keys. Mines cannot protect coins whose owners are long gone. For those, Fields suggests a staked auction: someone who locked coins in advance can outbid the thief and claim part of the thief's collateral, while the vulnerable coins are burned. A third version, with no advance stake, was suggested by researcher Neha Narula. It works like the well-known dollar auction game, where the second-highest bidder pays and gets nothing.

Limits. Fields writes that this could be done with a soft fork, a rule change that does not split the network, but leaves the details for later. There is no answer yet on collateral size or where losing coins go. Decrypt notes the downside: honest owners would also need collateral to move their own old coins.

已确认的事实

• On November 4, 2026, Cory Fields posted "Quantum Landmines and Vulnerable Coin Auctions" to the Bitcoin Development Mailing List.^[1][2]
• Fields calls the ideas thought experiments and says he believes a soft fork could do it, leaving details for later.^[1]
• Under the scheme, after Q-Day any legacy coin spend must be fully collateralized; in his example the owner has 30 days to reveal proof and take the coins plus the thief's collateral.^[1][2]
• For ownerless coins, Fields proposes a staked auction where the vulnerable coins are burned and the winner claims part of the attacker's collateral.^[1][2]
• The dollar-auction version was suggested by Neha Narula.^[1]
• No publicly demonstrated quantum computer can steal Bitcoin today, and none of these protections exist in Bitcoin.^[2]

影响

• 已确认This is an idea for discussion, not a finished Bitcoin upgrade.
• 已确认It would need quantum-safe addresses and new consensus rules that developers must agree on.
• 我们的解读If it gains support, it could become an alternative to freezing old wallets. This is our view.

仍未知

• When a quantum computer able to run this attack will exist
• How big the collateral would be and who gets the losing coins
• Whether other developers will back the idea

影响到谁

Worldwide. Bitcoin holders, especially with coins on old addresses, and anyone tracking quantum risk

来源

1. Bitcoin Development Mailing List: Quantum Landmines and Vulnerable Coin Auctions 2026年11月4日 · 官方
2. Decrypt: This Bitcoin Developer's Idea Would Make Quantum Attacks a Losing Bet 2026年11月8日 · 媒体