Bitcoin’s ‘quantum landmines’ would put thieves’ coins at risk

Under Fields’ proposal, a person trying to move 1 BTC from a vulnerable wallet would also need 1 BTC in a quantum-safe wallet. Both amounts would go into a new output subject to restrictions, potentially including a 30-day waiting period. An original owner who had prepared a hidden ownership commitment in advance could reveal it during that window and reclaim the coins, along with the attacker’s collateral, Fields wrote.

The proposal targets wallets whose public keys are exposed on the blockchain. A sufficiently powerful quantum computer could theoretically use an exposed key to derive its corresponding private key. Some older transaction formats reveal public keys directly, and address reuse can expose other holdings. No publicly demonstrated quantum computer can currently carry out such an attack.

Fields also described auctions for vulnerable coins whose owners may have lost their keys. In one example, participants could prepare hidden bids against a dormant wallet holding 50 BTC. If an attacker tried to spend the coins, an auction could begin after the initial ownership-proof period. Eligible bidders could claim portions of the attacker’s collateral; under the described mechanism, the vulnerable coins would be destroyed if a qualifying bid stopped the attacker from keeping them. Fields discussed other possible recipients for collateral, including miners and designated parties, as well as a design involving penalties for losing bidders, suggested during conversations with MIT Digital Currency Initiative director Neha Narula.

The collateral rule could also hinder legitimate holders: someone with 1 BTC in a vulnerable wallet would need another 1 BTC in a quantum-safe output to move it. Fields said Bitcoin cannot automatically distinguish an owner from an attacker using the same private key. He called the ideas “thought experiments” and said implementation would require quantum-safe outputs and new consensus rules. Collateral ratios, auction deadlines, bid penalties and conditions for destroying coins remain unresolved.