Bitcoin Developer Outlines Three Cost-Imposing Responses to Quantum Theft

Three concepts aimed at raising the cost of quantum theft

Cory Fields, a Bitcoin software developer at MIT’s Digital Currency Initiative, has outlined three possible ways to deter future quantum-enabled theft of Bitcoin. Shared on the Bitcoin development mailing list, the concepts seek to make an attacker risk their own BTC when targeting coins that remain vulnerable to quantum attacks. They rely on collateral, time-locks or auctions rather than simply assuming that vulnerable funds can be protected by their owners.

Fields presented the mechanisms as thought experiments, not as finalized changes to Bitcoin. He said implementation through a soft fork could be possible, but that does not establish that any proposal will be adopted or specify how it would work in practice. The central design premise is to make a theft attempt carry a financial cost for the attacker, potentially giving legitimate holders a way to recover value if someone tries to spend their vulnerable coins.

The ideas distinguish among holders who can prepare a cryptographic proof in advance, owners of vulnerable funds whose keys may be lost, and legacy Bitcoin spends that could be subjected to an auction. That separation matters because the concepts do not offer one uniform defense for every coin. Each assigns risk and potential recovery differently, while leaving substantial details to be resolved before any implementation could be assessed.

Quantum Landmines would put collateral at risk

The first idea, called Quantum Landmines, begins before quantum computers can break existing cryptography. A Bitcoin holder would secretly attach a cryptographic proof to a small quantum-safe output. The proof is intended to establish prior knowledge of the private key associated with a vulnerable output, creating a way for the legitimate owner to demonstrate a claim later if an attacker attempts to take those coins.

If someone later steals a vulnerable output, the proposed post-quantum spending rules would require the coins to move together with an equivalent amount of the attacker’s own quantum-safe BTC, posted as collateral. The resulting output would be locked for a specified period, with 30 days given as an example. The delay would create a window for a person with the committed proof to make a claim.

The lock would not automatically establish who owns the disputed coins. Under the concept, the legitimate owner would reveal the proof committed earlier and could claim the attacker’s collateral. This reverses the usual assumption that a thief can simply move stolen funds away: a targeted spend would expose some of the attacker’s own BTC to loss. The proposal’s practical reach therefore depends on proof and spending rules that are not yet specified.

Two auction models address different vulnerabilities

Fields’ Staked Auction is aimed at vulnerable holdings whose private keys may be lost, leaving no owner able to provide the advance proof used by Quantum Landmines. Participants would stake quantum-safe BTC before a quantum threat materializes. Their stakes act as advance bids on vulnerable outputs, offering a different route for claims where the original key holder cannot use the landmine mechanism.

If an attacker tries to steal one of those targeted holdings, the model would require matching collateral. After an initial waiting period, stakers could reveal their bids and claim portions of that collateral. The design also allows other participants to submit bids that are lower or higher, with the outcome determined by auction rules. In contrast to a pre-committed owner proof, the process relies on stake and competition among participants.

This structure raises practical questions about who is eligible to stake, how bids relate to particular vulnerable outputs and how the auction determines each participant’s share. The source account does not supply answers, and Fields lists auction rules and collateral ratios among unresolved design issues. As a result, the idea describes an incentive model, not a settled method for identifying rightful claimants or distributing an attacker’s funds.

Technical promise meets unresolved questions

The third concept, Sats Auction, would not require users to stake coins in advance. Instead, an attempted spend of legacy Bitcoin would trigger an auction after an initial time-lock period. The highest bidder would receive the coins, minus their bid, while the second-highest bidder would lose their bid without receiving anything. The approach thus makes the attempted spend a point at which participants can compete.

Fields’ stated rationale is that this structure could make repeated participation increasingly expensive for attackers and might discourage theft attempts. That is a proposed deterrent, not evidence that the mechanism would prevent attacks or reliably identify legitimate owners. Its effects would depend on the auction rules, the bids participants make and how the process treats losing bids—all details that remain open in the account of the proposal.

The broader quantum threat is also contested in the supplied background. Alice & Bob estimated last month that a quantum computer using 29,588 cat qubits could crack a Bitcoin private key in about 62 minutes. Earlier this year, on-chain analyst James Check argued that even theft and sale of Satoshi-era coins would not threaten Bitcoin’s survival. The competing views leave the scale and consequences of the threat uncertain, while Fields’ three concepts remain exploratory.

Source: CryptoPotato