Bitcoin Dev Proposes Quantum Landmines to Trap Attackers With Their Own BTC

Cory Fields' collateral trap proposal would make quantum theft economically self-defeating, without freezing a single coin.

Key takeaways

• Bitcoin Core developer Cory Fields posted a "quantum landmines" proposal to the bitcoin-dev mailing list on November 4, describing a commit/reveal mechanism that forces any quantum attacker to stake matching bitcoin from a quantum-safe wallet before touching a vulnerable target coin.
• Unlike the BIP-361 coin-freeze approach, landmines leave the owner's coins unrestricted and put economic skin-in-the-game on the attacker instead, though Fields himself labeled the design a "thought experiment" with key enforcement rules still unwritten.
• Landmines only protect coins whose owners still control their private keys, leaving an estimated 7.1 million BTC in quantum-exposed wallets (roughly 35% of circulating supply, per Crypto Briefing) and all lost coins, including those attributed to Satoshi Nakamoto, unresolved.

Bitcoin Core developer Cory Fields posted a novel quantum-defense mechanism to the bitcoin-dev mailing list on November 4, proposing "quantum landmines" that would require any would-be attacker to post matching collateral from a quantum-safe wallet before moving a quantum-vulnerable coin. If the true owner still controls their keys, they can reveal a hidden proof of ownership during a waiting period, Fields used 30 days as an illustrative example, and claim the attacker's posted collateral alongside their own coins. First reported by CoinDesk, the proposal adds a third path to a debate that has so far run between doing nothing and freezing coins by network decree.

The mechanism works in two parts. An owner arms a "landmine" by creating a small output in a quantum-safe format, secretly committing to a proof of ownership. If a quantum attacker tries to move the target coin, they must first post collateral at a 1:1 ratio from a quantum-safe wallet, using 1 BTC collateral to steal 1 BTC as Fields' illustrative example, and both coins are locked for the waiting period.

The legitimate owner, seeing the attack, reveals the hidden proof and claims both. Fields proposed a separate auction concept for inactive and lost coins where no owner can arm a landmine, but details on that mechanism remain sparse.

The Property Rights Case Against Coin Freezes

The landmine design matters most for what it avoids. Every prior quantum proposal has required the network to act as an arbiter of ownership. BIP-361's coin-freeze logic would have the protocol restrict unmigrated coins as a defensive posture, putting the burden on the owner to move before an arbitrary deadline or face effective confiscation by inaction. PACTs required timestamp proofs.

Each approach forced the network to decide "whose coins are whose," which is precisely the kind of authority Bitcoin was designed not to have.

Landmines sidestep that entirely. The attacker posts collateral; the owner reveals a proof. The network enforces the lockup and the payout. No freeze, no administrator, no epoch where the protocol seizes dormant funds.

For a sound-money frame, that is the philosophically cleaner design. The sovereign property-rights guarantee stays intact because the trap runs on economic incentive, not protocol-level confiscation.

That distinction has downstream implications for BIP-361. If a credible collateral-trap mechanism can be developed and reviewed, the pressure behind coin-freeze arguments weakens. The community gains an alternative that does not require the network to identify and punish dormant addresses, which is the actual stakes of Fields' thought experiment and why the design is worth taking seriously even before a single line of code ships.

Where the Game Theory Breaks Down

Fields acknowledged the central vulnerability himself: the chain cannot distinguish a quantum thief from the true owner posting collateral to move their own coins. That means any honest holder who wants to migrate a vulnerable coin faces the same 1:1 collateral burden as an attacker. If that burden is non-trivial, the landmine mechanism becomes an economic tax on legitimate ownership, not just on attackers. On those grounds, the proposal is dead before deployment.

The trigger that proves the design viable: enforcement rules must be written that impose the collateral burden specifically on attackers while giving honest movers a path that does not require them to stake matching funds they may not hold in a quantum-safe format. Fields did not provide that mechanism. Until it exists, the game theory does not fully close.

The lost-coins problem is similarly unresolved. Roughly 7.1 million BTC sits in quantum-exposed wallets, per Crypto Briefing, and landmines protect none of the coins whose owners no longer hold keys. The auction fallback Fields sketched for inactive coins lacks any published enforcement detail. Bitcoin's post-quantum clock is tightening, and the fraction of supply that cannot be armed with a landmine remains the largest unresolved exposure on the table.

The broader signal, alongside BIP-360, BIP-361, PACTs, and the recent Quantum Alliance activity, is that Bitcoin's developer culture is treating quantum as a live engineering problem in 2026. That credibility matters for any institution sizing a BTC position against a multi-decade horizon.

What Needs to Happen Next

Fields' post carries no BIP number and no formal proposal status. It is a mailing list thought experiment. The path to any deployment requires at minimum: a finalized quantum-safe wallet standard adopted by the network, enforcement rules that solve the honest-holder collateral problem, and a consensus change.

Developer bandwidth is a real constraint here. Watch for follow-up posts on the bitcoin-dev list that engage the honest-mover problem specifically. That thread is where the proposal either develops teeth or gets set aside.

Sources

• Cory Fields, bitcoin-dev mailing list, November 4, 2026
• First reported by CoinDesk