Bitcoin Core developer Cory Fields has sketched “quantum landmines”: a hypothetical way to make spending certain vulnerable bitcoin costly by putting an attacker’s own funds at risk. It’s a thought experiment, not an active Bitcoin feature. The deterrent could also make it harder for legitimate owners to move their coins.
- A spender might have to provide matching collateral in a quantum-safe output.
- Owners could potentially challenge a spend. Auctions are another proposed response for dormant funds.
- Major details remain unresolved, including how ownership claims would be verified.
- No publicly demonstrated quantum computer can currently carry out the attack described.
How the proposed “landmine” could work
Fields outlined the concept in a Nov. 4 post to the Bitcoin Development Mailing List. He works with MIT’s Digital Currency Initiative. The reporting on the proposal does not specify the year of the post.
“The purpose of this post is just to introduce the ideas as thought experiments, ” Fields wrote.
The idea centers on collateral. Someone spending bitcoin from a vulnerable output would also have to lock up an equal amount in a quantum-safe output. In Fields’ example, moving 1 BTC would require another 1 BTC as collateral.
The vulnerable coins and the collateral could then be placed in a restricted output, potentially with a 30-day waiting period. An owner who had prepared an ownership commitment in advance might reveal it during that window to challenge the spend.
The commitment is intended to show that the owner had claimed the coins before the attempted spend. But the proposal, as described, does not explain how to create or verify such a commitment, or how the network would distinguish the rightful owner from someone else who can demonstrate control of the same key.
That matters. If an attacker had derived a private key, Bitcoin could not simply determine who had the better claim to it. The collateral is meant to make an attack financially risky, not give the network an automatic way to identify the rightful owner.
Auctions for dormant bitcoin
Fields also described auction mechanisms for funds whose owners may be unreachable, have lost access, or left them untouched. One example involves dormant holdings of 50 BTC.
Under the proposed process, participants could prepare bids in advance and reveal them if someone tried to spend the vulnerable coins. Depending on the design, bidders might claim part of the attacker’s collateral. The vulnerable coins could also be destroyed if a qualifying bid stopped the attacker from keeping them.
Fields discussed several ways to distribute collateral, including payments to successful bidders, miners, or other recipients. A second design, suggested during conversations with MIT Digital Currency Initiative director Neha Narula, could impose financial penalties on competing bidders.
These are unsettled ideas, not a defined auction system. An auction might deter a thief or redistribute collateral, but it would not necessarily return coins to their original owner. Someone who has lost the keys, in particular, may be unable to prove ownership or reclaim the funds.
What “quantum-vulnerable” means
Some Bitcoin transaction outputs reveal their public keys directly. Older pay-to-public-key outputs are one example. Other formats, including common hash-based outputs, generally keep the public key hidden until the funds are spent. If an address is reused after a spend reveals its public key, later funds associated with that key may also be exposed. Taproot outputs reveal public keys as well.
A sufficiently powerful quantum computer could theoretically use an exposed public key to derive its associated private key. This is a possible future threat, not evidence that funds are compromised now. No publicly demonstrated quantum computer can currently perform the attack described.
Exposure estimates also need careful reading. A postquantum.com analysis cites estimates of about 4 million BTC in reused addresses and roughly 2 million BTC in older pay-to-public-key outputs. It also cites a River Financial estimate of about 5.9 million BTC. These figures describe holdings in categories considered potentially exposed, not bitcoin already stolen or certain to be lost. Some may belong to inactive owners, while others may be lost. Inactivity alone does not prove a coin has been abandoned.
Avoiding address reuse can reduce exposure in some cases, but it is not the same as using post-quantum cryptography. Long-term protection would require Bitcoin to support different cryptographic methods and give users a way to migrate their funds.
The cost of making theft expensive
Matching collateral is the proposal’s clearest trade-off. A holder with 1 BTC in a vulnerable output might need another 1 BTC in a quantum-safe output to move it. That could raise the cost of an attempted theft, but it could also stop a legitimate holder without matching funds from moving their own coins.
Other questions remain. How would ownership commitments be validated? Who could bid, and how would competing claims be settled? When could vulnerable coins be destroyed? The proposal also leaves open how collateral would be divided and what penalties losing bidders might face.
Implementing the system would require quantum-safe transaction outputs and changes to Bitcoin’s consensus rules, the rules nodes use to decide whether transactions are valid. Fields has not specified the software changes needed, and the proposal does not establish a particular upgrade path.
Other responses to quantum risk have also been discussed. Coinbase has urged preparation for the threat and warned that wallet migration could take several years. A separate BitMEX proposal, as reported, would impose restrictions on older wallets only after evidence of a successful quantum attack. These approaches differ from Fields’ collateral and auction ideas. None is an active Bitcoin rule.
Key questions and answers
-
Can a quantum computer steal Bitcoin today?
No publicly demonstrated quantum computer can currently derive Bitcoin private keys from exposed public keys. This is a possible future threat, not a known wave of quantum theft.
-
Are all Bitcoin public keys exposed?
No. Some output types reveal public keys directly, while others generally reveal them when spent. Reusing an address after its public key has been exposed can put later funds associated with that key at risk in a future quantum scenario.
-
Are quantum landmines part of Bitcoin?
No. Fields presented the idea as a thought experiment. It would require new transaction outputs and changes to consensus rules.
-
Would the proposal guarantee that owners recover their coins?
No. An owner might challenge a spend after preparing a commitment, but the proposal does not guarantee recovery. Auctions could deter an attacker or redistribute collateral without returning funds to the original owner.
-
Could legitimate holders be affected?
Yes. A matching-collateral requirement could stop someone from moving vulnerable funds if they cannot provide the additional bitcoin. The proposal has not resolved how to handle that case.
Fields’ proposal applies a familiar security principle: make an attack costly. But the problem cannot be solved by checking who holds a key. Whether the deterrent could be made fair remains an open question. The rules would need to discourage theft without placing an impossible burden on the people they are meant to protect. Broader debates about Bitcoin’s prospects and institutional views on Bitcoin do not answer the technical and governance questions raised by Fields’ thought experiment.
