Brief

• Bitcoin developer Cory Fields proposes a hidden "mine" mechanism that could allow wallet holders to confiscate the collateral of quantum thieves.
• Two auction designs will target currencies that seem to have been abandoned, where perhaps no one will come to trigger the “mines” (that is, no one will actively engage with these currencies).
• It's still all hypothetical: Bitcoin requires quantum-safe wallets, new consensus rules, and a consensus on how to activate these rules.

Bitcoin developer Cory Fields has proposed an unusual approach to deal with future quantum thieves: whenever they attempt to steal someone else's bitcoins, they will have to risk their own bitcoins in the process.

In a post sent to the Bitcoin developer mailing list on November 4th, Fields outlined “quantum mines” as well as two auction mechanisms, attempting to turn attacks on vulnerable wallets into costly gambles. He described these ideas as “thought experiments” and not as completed Bitcoin upgrade plans.

Bitcoin holders use a secret private key to authorize transactions. The corresponding public key allows the network to verify the signature without needing to know that secret key.

If all of this sounds too difficult to understand, we have used AI to generate a video to help you grasp it:

Today's computers are still not capable of realistically deriving a private key from a public key. However, a sufficiently powerful quantum computer could use a mathematical technique called Shor to accomplish this, which could potentially allow thieves to spend these coins as if they truly owned them.

Some earlier Bitcoin outputs have exposed the public key, and certain newer formats also expose the public key. Other addresses hide the key until someone spends it, so not every wallet faces the same risk.

Researchers refer to the moment when such hypothetical computers capable of carrying out such attacks arrive as “Q Day.” Currently, there is no machine that has been publicly demonstrated to be able to steal Bitcoin in this way, and no one knows for sure when it will appear.

How do quantum mines work?

Imagine someone keeping 1 BTC in an old wallet that may have vulnerabilities. Before day Q, this person creates a very small, separate quantum-safe Bitcoin output that contains a hidden proof, proving that they once controlled the original private key when quantum theft was still not possible.

You can think of it as a sealed receipt of ownership. Outsiders can see this small output, but they cannot see the evidence hidden inside, and they don't even realize that it is a trap.

Now, imagine that in the future, a thief uses a quantum computer to recover the private key from a user’s old wallet. According to the rules proposed by Fields, the thief cannot simply take that 1 BTC; they must also provide another 1 BTC from a quantum-safe wallet as collateral.

Two coins will enter a restricted output together, with a total amount of 2 BTC. Thieves must first wait for a challenge period – in the example of Fields, it is 30 days – before they can spend them freely.

The wallet holder noticed this transaction and provided proof prior to day Q. Subsequently, the network allowed the holder to transfer all of these 2 BTC to the quantum-safe address she had previously promised: which is her original coin, plus the thief's deposit.

Attackers cannot know in advance which old wallets contain these hidden receipts. Even if they successfully recover the quantum keys, it could still result in a loss of 1 BTC.

If wallet holders wish to initiate their own normal migration of old coins after the Q-day, they also need matching collateral. If they do not have an excess of BTC, the same rules intended to combat thieves may also make it difficult for them to transfer their savings.

What about those coins that are lost or abandoned?

Mines are only effective if the holder prepares them in advance before day Q and is able to disclose them in a timely manner. They cannot protect coins for which the private keys have been lost, including some early Bitcoin holdings that are generally considered unrecoverable.

Fields proposed a second mechanism, known as "pledge auction." Before day Q, someone can lock quantum-safe Bitcoin and secretly place bids for an old wallet that they anticipate thieves will target.

Assume there is 50 BTC in a wallet that seems to have been abandoned. Future attackers attempt to transfer it, and they also put up an additional 50 BTC as collateral; during the auction period, those who submit bids in advance can challenge this attempted theft.

In the example of Fields, successful challengers can take a portion of the attacker's collateral, while the inherently vulnerable coins are destroyed instead of being awarded to the bidder. The focus is on depriving thieves of their stable earnings, rather than returning the coins to a missing holder.

His third idea is “sats auction,” which does not require any upfront collateral. On the contrary, the cost of one fragile coin triggers a competition: the bidder with the highest bid takes those coins, but they have to deduct their own bid amount, while the second-place bidder pays the bid amount without receiving anything in return.

This is a bit like a notorious auction game: two bidders keep raising the price, because no one wants to be the one who loses money for nothing. Thieves might avoid starting a competition that could result in losses greater than the value of the coins they intend to steal.

Why not simply freeze the risky bitcoins?

One proposal to address quantum risks is to restrict spending from old wallets after the migration deadline. This might prevent theft, but it could also permanently exclude legitimate holders who never migrated their coins.

Fields is exploring another trade-off: allowing old coins to still be spent, but making the act of attempting to transfer them expensive and subject to challenge. If both can generate equally valid signatures, Bitcoin will not be able to distinguish between honest holders and quantum thieves.

This trade-off is quite stringent, as honest holders may need to deposit large amounts as collateral, inactive holders might miss the opportunity to file objections, and auction rules could also result in the destruction of coins belonging to people who are still alive but just offline.

What is required to achieve these?

Bitcoin first requires a quantum-safe way to hold and spend funds. Subsequently, wallets also need to support hidden ownership commitments, while Bitcoin's consensus rules must enforce mortgages, waiting periods, special recovery transactions, and auctions.

Developers also need to reach an agreement on when the new rules will be activated, how much collateral is required, and how lost bids or remaining funds will be handled. Fields believes that some mechanisms can be introduced through a soft fork, which is a way to change Bitcoin's rules, but he did not provide a detailed design.

These protective measures currently do not exist in Bitcoin. Fields has not released any implementation plans or an activation timeline yet; his initial post did not specify the payment method for the auction, nor did it clarify what the final outcome of the auction should be.