Will Quantum Computers Break Bitcoin? 7.1M BTC Exposed — the 'Landmine' Plan That Makes Thieves Pay First

7.1 million Bitcoin — roughly 35% of every BTC in existence — sits in wallets that a sufficiently powerful quantum computer could one day crack open: $535 billion at today's prices. This week, a Bitcoin Core developer proposed a plan that turns the attack on its head: to steal 1 BTC, a quantum thief would first have to stake 1 BTC of their own — and risk losing it. The idea is called "quantum landmines" — the most creative answer yet to the question every Bitcoin holder eventually asks: will quantum computers break Bitcoin?

The short answer is no — not today, and not by surprise. No quantum computer in 2026 can run the attack. But the numbers behind the threat got dramatically smaller this year, the exposed coins are already counted, and Bitcoin now has three competing plans to defend itself. This guide explains the threat in plain English, how the landmine plan works, how much Bitcoin is exposed, and the five checks that tell you whether your own coins are at risk.

What Are Quantum Landmines?

On Wednesday, November 4, 2026, Cory Fields — a Bitcoin Core developer at MIT's Digital Currency Initiative — posted a proposal to the bitcoin-dev mailing list. He calls the concept "quantum landmines." CoinDesk first reported it on November 5, the same day Bitcoin fell 6% below $76,000 in a stock-market rout — though this is protocol design, not trading.

The core idea is simple: make quantum theft expensive for the thief. Under Fields' example, stealing 1 BTC would require the attacker to supply another 1 BTC from a quantum-safe wallet as collateral. Both coins would then lock for about 30 days. Before quantum attacks become possible, the owner creates a separate quantum-safe "landmine" containing hidden proof of ownership. If a thief strikes, the owner reveals that proof during the waiting period and claims the attacker's collateral alongside their own coins.

Fields labelled the ideas "thought experiments." They depend on quantum-safe wallets that do not exist yet on Bitcoin and on enforcement rules nobody has written, and the post carries no BIP number or formal status. But it adds a third path to a debate that has so far run between two extremes: do nothing and hope, or freeze vulnerable coins by network decree. Background: Is Bitcoin Safe from Quantum Computers? Coinbase's Post-Quantum Plan Explained.

How a Quantum Landmine Works, Step by Step

The mechanism uses a commit/reveal setup, a bit like a sealed-bid auction: a participant first locks in a commitment without showing their hand, then reveals the details later. Here is how Fields sketched it:

1. Arm the landmine early: While quantum attacks are still impossible, the owner creates a small output in a quantum-safe format, hiding proof they own the coins in the old, exposed address. Nobody else can see what the landmine protects.
2. The thief must pay to play: When a quantum computer can finally derive a private key from an exposed public key, the attacker cannot simply take the coins. The rules would force them to post matching collateral — 1 BTC of their own, held in a quantum-safe wallet — for every 1 BTC they target.
3. Both coins lock for a waiting period: The targeted coins and the attacker's collateral lock together for about 30 days in Fields' example. Nothing moves during that window.
4. The owner springs the trap: During the waiting period, the prepared owner reveals the hidden proof of ownership and claims the attacker's collateral on top of keeping their own coins. The theft attempt becomes a donation to the victim.
5. Unprepared owners lose: If the owner never armed a landmine, the thief keeps the coins after the waiting period — the system rewards preparation, not luck.

The elegance is economic rather than cryptographic: if enough owners arm landmines, the expected value of the attack turns negative — theft becomes self-defeating without freezing a single coin.

How Much Bitcoin Is Actually at Risk?

The threat matters because so much Bitcoin already sits behind exposed keys. A quantum computer does not need to break the network — it works backward from a public key already visible on the blockchain to the private key behind it. Coins in modern addresses that have never spent are not directly exposed; coins in old address types, or in addresses that already spent once, are.

Different analysts count the exposure differently, but every estimate lands in the same range:

Source	Exposed Bitcoin	Share of supply	Date
Crypto Briefing	~7.1 million BTC	~35%	November 2026
Citi analysis	~6.9 million BTC	~35%	May 2026
Europol EC3	6 to 6.9 million BTC	~30%	October 2026
Deloitte analysis	~4 million BTC	~25%	2026
Glassnode / Lopp et al.	Over 34% of supply had revealed a public key	~34%	March 2026

At Bitcoin's current price near $75,500, the top estimate represents roughly $535 billion behind keys a future machine could derive. The most famous exposed stash is also the most untouchable: the roughly 1 million BTC attributed to Satoshi Nakamoto sits in early P2PK addresses with fully exposed public keys. Why those coins have never moved: Who Is Satoshi Nakamoto? Bitcoin's Creator Mystery Explained (2026).

The Three Ways to Save Bitcoin From Quantum Computers

Until Fields' post, the debate had two camps. Now there are three, differing sharply in who pays, who decides, and what happens to coins whose owners never show up.

Plan	How it works	Who pays	Biggest problem
Do nothing, migrate voluntarily	Owners move coins to quantum-safe addresses when ready; network upgrades when standards mature	Each owner, when they choose	Millions of BTC belong to people who will never migrate — lost keys, dead owners, forgotten wallets
Freeze legacy coins	Network decree makes old address types unspendable after a deadline (draft BIP 361)	Owners who miss the deadline lose everything	Confiscates Satoshi's coins and every lost wallet by decree
Quantum landmines (Fields, Nov 2026)	Thieves must stake matching collateral for 30 days; prepared owners claim it	The attacker, when they strike	Only protects owners who still hold their keys; needs quantum-safe wallets and unwritten rules

The landmine plan's advantage is avoiding the freeze plan's hardest question: what to do about coins nobody can claim. Fields sketched a separate sealed-bid auction for those inactive coins, including Satoshi's, but the details are even less developed. The Quantum Alliance's competing proposal takes yet another approach: 6.4 Million Bitcoin at Quantum Risk: The Quantum Alliance's Plan to Protect BTC.

Why Quantum Computers Cannot Just "Hack Bitcoin"

Most coverage gets one thing wrong: a quantum computer would not "hack the blockchain." The threat is narrow and split in two halves — and one half is essentially safe.

The vulnerable half is signatures. Bitcoin signs transactions with ECDSA over the secp256k1 curve; Shor's algorithm, run on a powerful enough quantum computer, can calculate a wallet's secret spending key from its public key. That is the whole attack: derive the key, sign a transaction the owner never approved.

The safe half is mining. Bitcoin's proof-of-work is a SHA-256 search, and the only quantum attack on it is Grover's algorithm, which gives a square-root speedup that specialized ASIC miners outpace. Europol's European Cybercrime Centre reached the same conclusion in reports published on October 7, 2026: "Cryptocurrencies will not collapse due to quantum computing." The agency called wallets the "primary point of exposure" and described SHA-256 as largely resistant to quantum attacks.

The other number that changed in 2026 is the size of the machine required. A March 2026 paper from Google Quantum AI — co-authored by Craig Gidney, Justin Drake of the Ethereum Foundation, and Stanford's Dan Boneh — showed breaking 256-bit elliptic-curve cryptography could theoretically take roughly 1,200 logical qubits, 90 million Toffoli gates, and under 20 minutes, on 500,000 physical qubits: twenty times smaller than earlier estimates. A September 2026 IonQ preprint put a secp256k1 key break at 19,397 physical qubits and 25.7 days per attempt, with at least a 40.7% success rate. No such machine exists — but a public "quantum doomsday clock" puts a 5–10% probability on one appearing by March 2028. Deeper technical detail: Lamarr Labs' Bitcoin and Blockchain Quantum Risk field guide and Rootcrak's 2026 guide to quantum computers and crypto wallets.

The 2026 Timeline That Changed the Debate

The landmine proposal did not arrive out of nowhere — 2026 was the year the quantum threat stopped being theoretical and started getting dates, budgets, and draft code:

• February 2026: The Ethereum Foundation published a formal post-quantum roadmap, targeting meaningful progress around December 2029.
• Early 2026: Bitcoin merged its first proposal for a quantum-resistant address format, BIP 360 — but consensus-driven change is slow and nothing is activated.
• March 2026: The Google Quantum AI paper slashed the estimated machine needed to break Bitcoin's signature curve to under 500,000 physical qubits — twentyfold smaller than earlier estimates.
• May 2026: A Citi analysis counted roughly 6.9 million BTC in legacy addresses with exposed or potentially exposed keys.
• October 7, 2026: Europol's EC3 published two reports concluding crypto will not collapse from quantum computing — but warning exposed wallets are the real risk, and migrating all Bitcoin UTXOs could take over 76 days.
• October 2026: Galaxy Digital committed $5 million to a bitcoin quantum-readiness funding program, and Nvidia-backed PsiQuantum kept building toward commercial operation.
• November 4, 2026: Cory Fields posted the quantum landmines proposal to the bitcoin-dev mailing list; CoinDesk first reported it on November 5.

Two draft proposals frame Bitcoin's path: BIP 360, the quantum-resistant address format, and BIP 361, a phased migration plan that would block new sends to legacy address types about three years after activation. The US National Institute of Standards and Technology finalized three post-quantum standards in August 2024 (FIPS 203, 204 and 205), with vulnerable algorithms slated for deprecation by 2030 and removal by 2035. The standards exist. Bitcoin's adoption of them does not — yet.

What Most People Get Wrong About Quantum and Bitcoin

Myth 1: "A quantum computer will steal all Bitcoin overnight." Wrong. The attack needs a machine that does not exist, and even then it can only take coins whose public keys are already exposed — roughly a third of supply. Coins in fresh addresses that have never spent are not directly reachable. The threat is a slow bleed of specific wallets, not a sudden network collapse.

Myth 2: "Quantum computers will break Bitcoin mining." Wrong. Mining runs on SHA-256 hashing, which Grover's algorithm only speeds up quadratically. Specialized ASIC miners are so fast that the quantum edge barely matters, and Bitcoin's difficulty adjustment absorbs the rest. The locks are vulnerable; the chain's ordering mechanism is not.

Myth 3: "All coins are equally at risk." Wrong. Risk depends entirely on address type and history. Early P2PK coins and reused P2PKH addresses that have already spent are the exposed group; modern addresses that have never revealed their public key are safe until they spend. Your risk is a property of your wallet history, not of Bitcoin itself.

Myth 4: "Nothing can be done — the coins are doomed." Wrong — and this is the point of the landmine proposal. Three serious paths now exist: voluntary migration, freezing legacy coins, and making theft pay for itself, plus draft BIPs for quantum-resistant addresses. As Europol put it, the only real protection is moving exposed funds to safe wallets before a capable quantum machine arrives, because exposed keys cannot be secured retroactively.

Myth 5: "Quantum is decades away, so I can relax." Partly wrong. Nobody knows the date, but Justin Drake, a co-author of the Google 2026 estimate, put the odds of a quantum computer recovering a Bitcoin key from an exposed public key by 2032 at 10% or higher — his own estimate, not Google's. And the most important attack model needs no quantum computer today: adversaries are assumed to be archiving every transaction, revealed public key, and signature — and waiting. The data a future machine needs is already being collected.

Is Your Bitcoin Exposed? 5 Checks

You do not need a physics degree to work out whether your coins are in the exposed group:

1. Check your address type: Coins in early P2PK addresses (starting with "1", from Bitcoin's first years) or reused legacy P2PKH addresses are the exposed group. Modern SegWit (bc1q) and Taproot (bc1p) addresses that have never spent are far safer.
2. Check whether you have ever spent from the address: Spending reveals the public key. An address that has only ever received coins has never exposed its key; reuse one address for everything and spend from it regularly, and it is exposed.
3. Check whether your coins sit on an exchange: Exchange wallets are the exchange's problem, but their address practices are opaque to you. Self-custody gives you control over the address type. New to self-custody? Start here: What Is a Crypto Wallet? The Complete Beginner's Guide and How to Store Crypto Safely in 2026: Cold Storage, Seed Phrases and Wallet Security.
4. Check your hardware wallet's quantum roadmap: Major wallet makers are already shipping post-quantum features and publishing migration plans. The current options: Best Crypto Wallets for Beginners in 2026: Hot vs Cold Wallets Compared.
5. Check your time horizon: If you plan to hold for a decade, the quantum timeline matters even if Q-Day is years away. If you trade short-term, it is a background risk — but the migration will reward holders who moved early and punish those who waited for a deadline.

What Happens Next

Fields' post carries no BIP number, and no immediate responses had appeared in the discussion thread at publication — the community has not yet weighed in on whether the mechanism holds up. Its practical weight now rests on whether quantum-safe wallet standards arrive before the threat does.

Three things to watch: whether any developer turns the landmine idea into a formal BIP with written enforcement rules — the soft-fork mechanics are unresolved, and the honest-holder collateral problem is unsolved; whether BIP 360's quantum-resistant address format moves toward activation; and whether BIP 361's phased migration and legacy-signature sunset gains support, putting a deadline on the whole debate.

The market is not pricing any of this in. Bitcoin fell to about $75,500 on November 6 after the Nasdaq's 5.5% plunge and more than $1 billion in crypto liquidations — a macro sell-off, not a quantum repricing. But the quantum story gets more concrete every year while the price ignores it. Whether landmines ever ship, Europol's message stands: move exposed coins to safe wallets before the machine arrives, because an exposed key cannot be un-exposed. On whether Bitcoin is worth holding through risks like this, see Is Bitcoin a Good Investment in 2026? An Honest Guide to the Risks, Returns and Smart Allocation and What Is Bitcoin? The Complete Beginner's Guide to How BTC Works in 2026.

FAQs

Will quantum computers break Bitcoin?

Not in 2026. No quantum computer today can run Shor's algorithm at the scale needed — Google's March 2026 estimate says breaking Bitcoin's signature curve would take roughly 1,200 logical qubits and about 500,000 physical qubits. The risk is real but years away, and it affects only coins in wallets with exposed public keys, roughly 30–35% of supply.

What are Bitcoin quantum landmines?

A proposal by Bitcoin Core developer Cory Fields, posted to the bitcoin-dev mailing list on November 4, 2026. It would force anyone trying to steal coins with a quantum computer to first stake matching collateral — 1 BTC of their own for every 1 BTC targeted — locked for 30 days. A prepared owner can reveal hidden proof of ownership in that window and claim the attacker's collateral. It is a thought experiment, not active code.

How much Bitcoin is exposed to quantum computers?

Estimates range from about 4 million BTC (Deloitte, ~25% of supply) to about 7.1 million BTC (Crypto Briefing, ~35%). Citi estimated 6.9 million BTC in May 2026, and Europol 6–6.9 million BTC (~30%) in October 2026 — all agree roughly a quarter to a third of all Bitcoin sits behind exposed public keys.

Can quantum computers break Bitcoin mining?

Effectively no. Mining uses SHA-256 hashing, and the only quantum attack is Grover's algorithm, which gives a square-root speedup that specialized ASIC miners outpace. Bitcoin's difficulty adjustment absorbs the rest. Quantum computers threaten signatures, not mining.

Is my Bitcoin safe if I use a hardware wallet?

A hardware wallet protects your private key from theft today, but it does not change the address type your coins sit in. If your coins are in an old address that has already revealed its public key, they are in the exposed group regardless of the device. Safety comes from the address format and from migrating to quantum-safe addresses when they exist.

What should Bitcoin holders do about the quantum threat now?

Three things: stop reusing addresses that have already spent (spending reveals the public key), prefer modern SegWit or Taproot addresses for new receives, and follow the BIP 360/BIP 361 debate so you move early once quantum-safe addresses activate. No emergency action is needed today — but there is no reason to leave coins in 2011-era address formats for another decade.

Conclusion

The quantum threat to Bitcoin is neither the overnight apocalypse of the headlines nor distant science fiction. It is a counted, dated risk: 7.1 million BTC behind exposed keys, a machine estimate that fell twentyfold in one 2026 paper, and a 10% chance from one of the field's own researchers that a key gets recovered by 2032. Against that, Bitcoin now has something it did not have a week ago — a plan that makes the attacker pay first. Cory Fields' quantum landmines may never ship; the idea is a mailing-list thought experiment with unwritten rules. But it reframes the debate from "how do we save the coins?" to "how do we make stealing them a bad bet?" Check your addresses, stop reusing spent ones, and watch the bitcoin-dev list: the next post there may carry a BIP number.