Quantum Landmines Would Make Bitcoin Thieves Lose Their Own Coins

Quantum landmines are a new idea for Bitcoin: a way to make quantum thieves lose their own coins. Cory Fields posted three ideas to the Bitcoin Development Mailing List on November 5. He calls the quantum landmines and the two auction designs thought experiments, and he has not written the rules to enforce them.

The quantum problem Fields starts from

Some old Bitcoin outputs expose a public key on the blockchain. A computer powerful enough to break that key could sign a spend as the owner. Fields assumes a future "qday" when that becomes possible, and he assumes Bitcoin has by then added a new quantum-safe output type.

His post adds a condition. After qday, every legacy spend would need full collateral. The spender must lock up other coins and wait before the output can move again.

How quantum landmines work

Take Alice, who holds 1 BTC in a legacy output. Before qday she also funds a trivial quantum-safe output that hides a proof she knows her old private key. The hidden proof stays unseen unless she uses it. To a thief it looks like any other output. The post says this also makes it hard to measure how many coins are vulnerable.

After qday a thief steals the legacy coin by pairing it with 1 BTC of their own. The combined output must sit for about 30 days. In that window Alice can reveal her hidden proof, spend the output herself and keep the thief's collateral.

The opening of the mailing list post. Source: Bitcoin Development Mailing List, Cory Fields, November 5, 2026.

Staked auctions for lost keys

Quantum landmines only help owners who still hold their keys. Many vulnerable coins are believed lost, so nobody would plant a landmine for them. The second idea targets those.

Holders would stake quantum-safe coins in advance with a bid attached.

If a thief moves a vulnerable coin, the staked bids compete. The highest bid takes the thief's collateral.

In the post's example a thief steals 50 BTC and adds 50 BTC of collateral, which implies a 45 BTC bid. A holder who staked a 40 BTC bid reveals it and takes 40 BTC of that collateral. The stolen coins are destroyed. The staking requirement caps how much a thief could bid on, and the post lists options for losing bids.

Sats auctions without staking

The third idea, the sats auction, needs no staking. Every legacy spend would open an auction once the first timelock ends. Whoever bids highest wins the coins but pays their bid out of them, while the runner-up loses theirs for nothing. Bidders may add inputs, so a thief could end up paying more than the coin is worth.

The post credits the Dollar Auction game as inspiration, suggested by Neha Narula. The original owner looks identical to a thief, so the owner could start the auction and recover part of the coins.

What is still open

Fields says he believes all three could work through a soft fork. He leaves the mechanics to "a future exercise." Open choices include collateral ratios, what happens to losing bids and who receives burned coins.

He also asks what the ideal outcome even is. Options include stopping every attack, letting thieves win sometimes or spreading coins by lottery. The post suggests the answer may change over time after qday.