To steal coins, one must first stake Bitcoin; failure will result in the forfeiture of the margin.

Written by: Jose

Translated by: Chopper, Foresight News

Bitcoin developer Cory Fields came up with a very unique method to tackle future quantum hackers: if hackers want to steal someone else's Bitcoin, they must first stake their own Bitcoin as a wager.

He posted in the Bitcoin developer mailing list proposing the concept of "Quantum Mines" along with two auction mechanisms. The design idea is to make attacking wallets with vulnerabilities a potentially losing endeavor. He specifically mentioned that this is just a thought experiment and not a finalized Bitcoin upgrade proposal.

Bitcoin users initiate transactions by signing with a private key, and the corresponding public key can be used to verify the signature on the network without revealing the private key. Current ordinary computers find it nearly impossible to reverse-engineer the private key from the public key. However, a sufficiently powerful quantum computer could use Shor's algorithm to compute the private key, enabling hackers to directly transfer the coins.

Some early Bitcoin addresses have their public keys directly exposed on the blockchain; others reveal the public key during the user's first transfer. Thus, not all wallets face the same risk of quantum attacks. The day when "quantum computers capable of breaking Bitcoin encryption are revealed" is referred to as Q-Day (Quantum Doomsday). Currently, no machine has achieved this, and no one knows exactly when it will happen.

How do Quantum Mines work?

Suppose you have 1 BTC in your wallet, which belongs to an old type that is easy to be broken by quantum computers. Before the arrival of Q-Day, you create a new, small, quantum-resistant Bitcoin output, secretly storing proof inside: a proof asserting that when quantum attacks are not yet feasible, this coin already belongs to you. You can think of it as a sealed "certificate of ownership." Outsiders can only see this small record and cannot access the hidden evidence, even unaware that it is a trap.

When hackers eventually use quantum computers to calculate your old private key and attempt to transfer your 1 BTC, according to this new rule, they cannot simply take the coins; they must stake 1 BTC from their quantum-resistant wallet as collateral.

Your 1 BTC + the hacker’s 1 BTC as collateral will be bundled together and locked, entering a waiting period for appeals, such as 30 days. During this time, the hacker cannot freely transfer the coins. If you discover that someone is attempting to steal coins, you can present the previously hidden certificate of ownership. The Bitcoin network will determine that you can transfer both coins to your pre-prepared quantum-resistant address — including the coin that originally belonged to you and the hacker's collateral.

The hacker has no idea which old wallet has such a trap buried. Even if they successfully calculate the private key, they might still end up losing 1 BTC. However, this plan also has a cost: if the coin's owner wants to normally transfer their old coin after Q-Day, they will also need to provide equivalent collateral. If they don’t have extra BTC, this rule meant to prevent hackers will actually make it difficult for them to transfer their own coins.

What about Bitcoins for which the private keys are lost and no one manages them?

Quantum Mines have a prerequisite: the coin's owner must bury the trap in advance and provide evidence during the appeal window. If the private key has long been lost and the owner can no longer go online, this plan will not protect those coins, including many early Bitcoins generally believed to be completely lost.

To address this, Cory Fields proposed a second mechanism: staking auctions. Before Q-Day, anyone can lock in a portion of quantum-resistant Bitcoins and quietly bid on an old wallet that is easily targeted. For example, an old wallet that seems abandoned by the owner contains 50 BTC. In the future, if hackers try to transfer it, they must stake 50 BTC as collateral. During the auction window, prior bidders can stand up to challenge this theft attempt. According to his idea: a successful challenger can take a portion of the hacker’s collateral; the original 50 risky Bitcoins will be destroyed and not awarded to the challenger. Its purpose is not to help the missing owner reclaim the coins but to ensure that hackers cannot easily steal the coins, removing the incentive for attacks.

The third scheme is called "Smart Auctions," which does not require locking of coins in advance. As soon as someone tries to transfer high-risk coins, an auction will automatically commence. The highest bidder will take the coins (minus their own bid), and the second-highest bidder will lose their money entirely. This is somewhat like the classic "Dollar Auction Game": two people continuously raise bids for an item, neither wanting to lose money for nothing. The hacker may weigh this and simply refrain from initiating a bidding war that would likely result in greater losses.

Why not simply freeze high-risk Bitcoins?

One proposed countermeasure is to set a migration deadline; after it expires, all coins in old wallets are prohibited from being transferred. This can indeed prevent theft, but the downside is that genuine holders who forget to transfer or cannot take action will permanently lose access to their coins.

Cory Fields takes a different approach. Old coins can still be transferred, but any attempt to transfer must incur a cost and face challenges from others. The Bitcoin network itself cannot differentiate whether the one who can provide a valid signature is the true owner or a quantum hacker. The cost of this compromise is very clear: legitimate holders must also prepare substantial collateral to transfer coins; long-term inactive holders may miss opportunities to appeal; and some holders may still be alive but temporarily offline, and their coins might be destroyed in an auction.

If implemented, what changes are needed?

Bitcoin needs a quantum-safe method for holding and using funds. Wallets must support hidden ownership commitments, while Bitcoin’s consensus rules must enforce collateral, waiting times, special recovery transactions, and auction mechanisms.

Developers also need to agree on when the new rules will take effect, the required collateral amounts, and how to handle failed bids or remaining funds. Fields believes that some mechanisms can be introduced through soft forks, but he has not provided detailed design proposals.

Currently, all these protective mechanisms do not exist in the Bitcoin network. Fields has not provided code implementations, timelines, or final targets for the distribution of auction funds, all of which remain undecided in the original text.