Cory Fields Wants Quantum Thieves to Post Bitcoin as Collateral

Bitcoin Core developer Cory Fields published a proposal to the Bitcoin Development mailing list on November 4 that approaches the quantum threat from the incentive side rather than from the cryptography side: after a quantum break, anyone spending an old bitcoin output would first have to lock up bitcoin of their own, and could lose that collateral to whoever proves a better claim to the coins.

The post, Quantum Landmines and Vulnerable Coin Auctions, sets out three mechanisms: Quantum Landmines, Staked Auction and Sats Auction. None of them makes bitcoin quantum-resistant. All three assume a quantum-safe output type exists before what Fields calls qday, and that new consensus rules switch on afterwards. What they add is a price for stealing, paid in the attacker’s own coins.

That reframing changes how the industry counts the problem. Most post-quantum work, including the BIP-360 output type now in draft, tries to make keys unbreakable or to shorten the window in which a public key is exposed. Fields’ proposal accepts that a large set of old outputs will be breakable and asks what a rational attacker does when the payout is time-locked, contestable and collateralised.

The Four Conditions Underneath the Proposal

Fields is direct about the status of the work. He describes it as rough ideas discussed with a handful of people over the preceding week, and he defers the soft-fork mechanics to “a future exercise”. The four premises are stated up front: a new quantum-safe output type exists before qday; new validation rules are activated after qday, “something like Tripwire and/or manually”; every legacy output spend post-qday must be fully collateralised; and every such spend must produce outputs that meet certain conditions, including time locks and alternate spend paths.

He notes that the last two requirements resemble vault or covenant constructions, with one difference: their behaviour would be enforced implicitly by consensus rules rather than by a script the owner writes. That distinction carries the whole idea. If the rule sits in consensus, it applies to an attacker’s transaction whether or not the attacker wants it to.

“The purpose of this post is just to introduce the ideas as thought experiments.”

Quantum Landmines: One Bitcoin Needs One Bitcoin Behind It

The first mechanism is a commit and reveal scheme. Alice holds three outputs: 1 BTC in a legacy type such as p2pk, 1 BTC in a quantum-safe output, and a trivial amount of bitcoin in a second quantum-safe output that acts as the landmine. When she funded the landmine before qday, she embedded a proof of knowledge in it, for example through a taproot-like tree holding a leaf that commits to a new quantum-safe public key and is signed by her legacy private key. The leaf stays hidden until someone needs it.

Post-qday, spending her legacy coin requires full collateralisation, so she spends both 1 BTC inputs into a single 2 BTC quantum-safe output. That output carries three implicit conditions: a re-spend inside a set window, 30 days in the example, needs only a proof of pre-qday knowledge of the private key; if that proof is used, the output’s public key must match the one the proof committed to; and after the timeout, no proof is required at all.

Now run the same scenario with an attacker who has recovered her private key. The attacker spends their own 1 BTC as collateral alongside Alice’s vulnerable 1 BTC into a 2 BTC output with the same conditions. Without a pre-qday proof, the attacker cannot re-spend for 30 days. Alice spots the transaction in that window, spends the in-limbo output to her committed key, reveals the landmine, and in the same move takes the attacker’s collateral.

“This scheme is especially interesting because it actually incentivizes Alice to bait a quantum attacker pre-qday in order to double her vulnerable coins later, and thus makes quantum attackers wary of stealing coins as they may be secretly guarded by mines.”

Fields also flags the informational side effect: because a landmine looks like any other quantum-safe output, nobody can analyse how many coins are actually vulnerable on qday.

Staked Auction: Third Parties Bid for the Attacker’s Collateral

Landmines only cover coins whose owners still hold their keys, and Fields says plainly why that is not enough: “The obvious problem with relying on landmines alone is that the associated private keys for many vulnerable outputs are believed to be lost, thus a quantum attacker could reasonably assume that they are not guarded by landmines.”

The second mechanism adds a third spending path to legacy outputs. Before the initial landmine timeout, a proof of pre-qday knowledge of the private key is enough to spend. After that timeout but before an auction timeout, a bid is enough. After the auction timeout, the output can be spent as usual with no proof.

The worked example uses a 50 BTC legacy output that Bob suspects has no landmine. Before qday, Bob creates a quantum-safe output of 50 BTC with a secret leaf that commits to the vulnerable output, a bid of 40 BTC and a new public key. That unspent transaction is a staked bid: 50 BTC parked to contest one specific 50 BTC output if it ever moves.

After qday an attacker recovers the key, spends the vulnerable 50 BTC plus 50 BTC of their own as required collateral, and creates an output worth 95 BTC. Fields describes that as a bid of 45 BTC. No landmine fires, the first timeout passes, and the auction opens. Bob reveals his staked output with a 40 BTC bid and takes 40 BTC of the attacker’s collateral. Carol then reveals a staked 50 BTC output with a 30 BTC bid. The stolen coins are burned rather than returned, and the attacker keeps losing collateral with each contested bid.

He lists the design choices left open: whether a staker gets their coins back so a bid carries no risk, or is slashed for a losing bid; whether unused collateral is burned, handed to the winning bidder, given to miners, or pooled for later use; whether staking requirements are 1:1 or some other ratio; and whether the age of the staked coins counts for anything.

The claim for the mechanism is narrow and worth quoting exactly: “Notice that in this design, as long as there is a landmine or a staked lower bid on the vulnerable coins, they are never successfully stolen by the quantum attacker.” The stolen coins are burned, the winner takes the attacker’s collateral, and an attacker who faces no counter-bid is the only one who walks away with the coins. That, Fields argues, pushes an attacker towards a very conservative bid, which is the same as saying it pushes them towards not attacking.

Sats Auction: The Dollar Auction Without Staking

The third mechanism came from Neha Narula, who suggested applying the dollar-auction game. There is no pre-qday staking. Every spend of legacy coins triggers an auction after the landmine timeout. The highest bid wins the coins minus the bid, and the second-highest bid loses its bid and collects nothing, so participants keep bidding to avoid landing in second place.

The consequence is that an attacker trying to move a vulnerable 50 BTC output can lose collateral beyond the value of the coins being moved, because bidders may attach extra inputs to keep the auction running past the prize. Fields points to the logical conclusion of the dollar auction, that the rational move is not to play, and adds a second effect: with no pre-commitment, the original owner, who is outwardly indistinguishable from an attacker, has a chance at partial recovery by starting the auction themselves. The open settings here are the collateral ratio, minimum and maximum bids and bid intervals, and where the losing bids go.

The Arithmetic Inside Fields’ Numbers

The examples are small enough to price out. In the staked-auction case an attacker commits 50 BTC of collateral to reach a 95 BTC output, so the margin on the operation is 45 BTC before anyone contests it. Bob’s 40 BTC bid removes 40 of those 45 BTC, or 88.9% of the margin, at a bid equal to 80% of the 50 BTC being stolen. Carol’s follow-up at 30 BTC is worth two thirds of the original prize, which is more than the 5 BTC of margin left after Bob’s bid. On the post’s own numbers, two counter-bids exhaust the attacker’s collateral while the coins themselves are destroyed rather than recovered.

The landmine case sets a different ratio. Because every legacy spend must be fully collateralised, moving 1 BTC requires locking 1 BTC, so an attacker immobilises one bitcoin of their own for every bitcoin they try to take, and holds it inside a 30-day window during which a pre-qday proof can override them. The gain is only realised if no proof appears. Fields’ own framing of the incentive is that a holder may want to bait an attacker precisely because a successful landmine claim converts a 1 BTC position into 2 BTC at the attacker’s expense.

What the Post Does Not Do

There is no BIP number, no reference implementation, no activation mechanism and no schedule. Fields writes that he does believe a soft-fork description is possible, but leaves those mechanics to later work, and the post closes by admitting the design space is unresolved.

The missing piece is the one everything else leans on: a quantum-safe output type that exists before qday. The closest active proposal is BIP-360, Pay-to-Merkle-Root, currently at version 0.12.1 with Draft status and a dependency on BIP-340, 341 and 342. Its own abstract limits the scope: P2MR removes the key-path spend so script trees resist long-exposure attacks, the kind where a key sits exposed for longer than it takes to confirm a spend, while protection against key recovery from a public key exposed in the mempool, a short-exposure attack, “may require the introduction of post-quantum signatures in Bitcoin”. Fields’ schemes sit on top of that gap rather than closing it. They do not make a key harder to break. They make the proceeds of breaking it expensive to collect.

Why the Coin Count Gets Harder, Not Easier

Landmines are optional and visually identical to ordinary quantum-safe outputs, which means the on-chain census that everyone uses to size the problem stops being readable. Fields states the effect directly: the scheme “muddies the waters so that on qday, it’s not possible to analyze how many coins are vulnerable to theft.”

That collides with the numbers custodians and regulators have been trading. Coinbase, which custodies roughly 5% of all bitcoin, published its post-quantum priorities in October, and nine blockchain firms formed the Quantum Alliance to set post-quantum standards. Both lines of work assume the exposed set can be estimated. A landmine layer makes that estimate unreliable in both directions: an observer cannot tell a guarded output from an unguarded one, so the same ambiguity that deters an attacker also hides how much is really at risk.

The Question Fields Leaves Open

The post ends on the design target rather than the mechanics. It is not clear, he writes, what the most desirable outcome would be: preventing a quantum attacker from ever attempting a theft, encouraging staking through auctions with attackers occasionally winning to keep the process alive, or redistributing coins as randomly as possible through something closer to a lottery where every unspent output is a ticket.

“However, it’s unclear what the best design would be because it’s not even clear to me what the most desirable outcome would be.”

He adds a timing problem on top of the design problem: the desirable outcome may shift after qday, because as time passes the party spending a vulnerable coin is increasingly likely to be an attacker rather than the original owner. Any auction design therefore has to work under two different assumptions about who is bidding.

For now the proposal is a mailing list post with no code behind it. The next step it invites is review of the incentive design, not a client pull request, and nothing in it changes bitcoin’s consensus rules today.