Bitcoin's Quantum Trap: Make the Thief Pay You

I read the bitcoin-dev mailing list most mornings. Usually it's BIP nitpicking and relay policy arguments. On November 4, Cory Fields dropped something different.

His pitch, roughly: what if a hacker who stole your Bitcoin ended up paying you for the privilege? Not a metaphor. An actual on-chain transfer flowing back to the victim.

Anon, let me explain.

The Trap, Mechanically

Here's the setup. Bitcoin's signatures rely on ECDSA. A quantum computer running Shor's algorithm breaks that by deriving a private key from a public key. The catch is you need the public key exposed. Most modern addresses hide it until you spend. Two categories don't.

Old pay-to-public-key outputs have their keys sitting in the clear, forever. Reused addresses do too, the moment you broadcast one transaction. Estimates on that pool run from about 1.7 million BTC on the conservative end to nearly 4 million on the loose end. Satoshi's early coins live in there.

Fields' idea, as I read it, is to change the payoff math. Build a defensive structure where an attacker who goes after those coins has to expose something, forfeit something, or route value back to the original owner. Make the heist cost more than it earns. He's calling it a trap because that's exactly what it's. Bait with a hook in it.

The details are still being hashed out on the list. But the framing alone is worth the read.

This Is Bigger Than People Realize

The headline risk everyone talks about is stolen coins. That's not the real problem.

The real problem is the gap. If a few million BTC become claimable by anyone with a quantum rig, the market doesn't reprice that gradually. It gaps. Spot ETFs alone hold well over a million BTC now. Their custodians can't rotate keys for coins they don't control, and they can't exactly explain a 30% drawdown to allocators by pointing at a physics paper.

Timelines are a mess. Jameson Lopp and others put Q-Day roughly a decade out. Some researchers say less. Plenty say never. But Bitcoin moves slower than all of them. SegWit took years. Taproot took years. A signature migration that requires every holder to move coins will take longer than either, and it can't touch the coins whose owners are gone.

That's the part nobody wants to say out loud. Roughly a fifth of supply may have no living keyholder.

My Honest Take

Real talk: this proposal isn't the fix. It's a pressure test. The actual fix is a post-quantum signature scheme plus a migration path, and there's plenty of work on that front already.

But here's my strong opinion. Core developers have been treating quantum risk like a 2035 problem since 2016. It's not. Coordination is the bottleneck, not cryptography, and coordination starts the day people admit the clock is running.

A trap that punishes thieves is clever. Cleverness doesn't move 4 million dormant coins.

So what do you actually do with this? Watch three things. Whether Fields' idea picks up a BIP number. Whether the mailing list thread turns into a real working group. And whether any major custodian publishes a post-quantum migration timeline in the next twelve months. That last one is the alpha. If BlackRock or Fidelity starts talking about key rotation, the market will front-run it hard.

The chain doesn't lie. Right now it's telling us nobody's in a hurry. That's the signal I'd worry about.