pull down to refresh

Cory Fields posted this proposal to the Bitcoin Developers Mailing List:

As soon as a quantum computer is demonstrated to be able to break bitcoin keys, these new rules apply:

  1. Every legacy address must have a thirty day timelock when it is spent
  2. Every legacy address spent must also include an equivalent number of sats from a quantum resistant address as collateral.
  3. If someone can reveal a proof (from before some arbitrary date or blockheight) that they knew the keys to the legacy coins being spent, they get both the legacy coins and the collateral.
  4. If no one reveals such a proof, the legacy coins can be spent as normal after the timelock expires.

I believe the goal here is to create a situation where it becomes dangerous for thieves to try to sweep coins in quantum-vulnerable addresses because they never can be sure that the real owner hasn't hidden a proof of their ownership.

Of course, one question here might be: if we're requiring people to make a transaction hiding a proof of their ownership in a new quantum-resistant address, why don't they just spend all their coins to new quantum resistant-addresses and be done with it?

This scheme is especially interesting because it actually incentivizes Alice to bait a quantum attacker pre-qday in order to double her vulnerable coins later, and thus makes quantum attackers wary of stealing coins as they may be secretly guarded by mines. It also muddies the waters so that on qday, it's not possible to analyze how many coins are vulnerable to theft.

This is the landmine. Often in these discussions about what to do with quantum-vulnerable addresses, the question comes up of what will happen to all the people who don't learn about the issue or for whatever reason don't move their coins. This proposal attempts to create a scenario where it is so risky to steal quantum vulnerable coins that attackers will generally avoid it.

Unfortunately, there is this wrinkle: what happens to someone who doesn't have enough coins in quantum-resistant addresses to make up the collateral? Unless I missed it, there isn't any path to spend for a person who hasn't got equivalent coins in quantum-resistant addresses. This seems like a pretty major flaw, as it still only delivers the freedom to spend quantum-vulnerable coins to people who acted before quantum attackers arrive -- and those are all people who could have just moved their coins anyway.

I like the landmine concept, but I don't think it solves the real problem, at least not in its current iteration. But I like that instead of trying to categorically solve the problem, this proposal think about how to create incentives that make it unprofitable to steal coins with a quantum computer.

Cory Fields also proposes an auction mechanism whereby people could bid on coins that are known to be lost or otherwise remain vulnerable to quantum attackers. It was complicated enough that I didn't quite wrap my head around it.

Thanks for the explanation in laymen's terms. I saw this concept before but didn't understand it till your post

One response to your wrinkle: The quantum landmine collateral doesn't have to be an equal number of coins as you're trying to spend in order to be effective. It just has to be sufficiently deterrent to the potential thief.

If someone has a sufficiently large stash they want to move, they can buy sufficient collateral on the open market and they should be willing to do so if the stack is large

reply

That's a good point, but I still think it means this proposal is weaker than the it otherwise sounds: I think most of the people who will benefit from this proposal are also people who would be able to take some action to quantum proof their coins before qday.

reply

I think that's the open question... to what extent will the risk of a mine actually deter stealing?

I imagine people will still go for the Satoshi coins because even if the risk of a landmine is high elsewhere, most people probably just assume Satoshi isn't active anymore

reply

the actual proposal directly addresses this with an auction/bidding mechanism. I just didn't take the time to understand that because it seemed quite complicated.

reply
2 sats \ 0 replies \ @penny 9 Nov -132 sats

On your "why not just migrate?" question, I think there are two answers, and the second one shows where the scheme is weak.

Why a mine is cheaper than migrating: the "proof from before some date" can be a plain hash commitment, for example H(privkey || new quantum-safe address), timestamped before the cutoff. You don't need an on-chain tx per UTXO for that. One OpenTimestamps-style merkle root can commit to millions of keys, with no fees, no new on-chain footprint and no linking of your coins today. Migrating means one real transaction per UTXO, which costs fees, takes block space and leaks privacy. Mines are a way to protect coins without touching them.

Where it's weak: the deterrent only works through the attacker's uncertainty. With collateral equal to the coins, a rational attacker sweeps a UTXO whenever P(mine) < ~50%. And attackers can estimate P(mine) per UTXO:

  • Untouched 2009-2011 P2PK coins (Satoshi-era, likely lost keys): P(mine) is close to 0. Dead people don't timestamp commitments.
  • Coins that moved recently, or belong to known active entities: P(mine) is high, but those owners could have migrated anyway.

So mines mostly protect the coins that would have been fine anyway. The ~1-2M BTC that drive the whole quantum debate (lost/dormant P2PK) stay exactly as exposed as before. Nobody alive can plant a mine on them, and the attacker knows that.

Two more practical points:

  1. Verifying the reveal needs a new consensus check (does this preimage really correspond to this address's key?). That's a soft fork in itself, on top of the timelock + collateral rules.
  2. The collateral requirement means an honest legacy holder who never heard of any of this has to find matching quantum-safe sats just to spend their own coins after q-day. That's a real usability cost, borne by exactly the least-informed users.

I still think it's clever as a complement to a freeze/sunset proposal: it gives active holders a cheap, private insurance layer. It just doesn't solve the dormant-coin problem by itself.

0 sats \ 0 replies \ @f7e7a5adad 18h freebie -22 sats

Quantum landmines discussion is wild. Separate practical LN notes from my faucet experiments: https://lfnotesivan.substack.com/p/learning-lightning-faucet-nov-10-2026

Tips: wfund99937@coinos.io