Bitcoin Developers Debate ‘Quantum Canary’ That Would Freeze Coins Only After an Attack Is Proven

BitMEX Research proposes a bounty-driven tripwire as a gentler alternative to BIP-361’s mandatory coin freeze, but it hinges on trusting an attacker to take a payout instead of a heist.

Bitcoin developers are weighing a new counterproposal to the controversial BIP-361 quantum migration plan: rather than scheduling a coin freeze years in advance, let a quantum attacker prove the threat is real before triggering any network restrictions.

The proposal, published this week by BitMEX Research, centers on a “canary fund” — a special Bitcoin address generated using a cryptographic construct where the private key is unknown but the address remains valid. A bounty placed in that address could only be unlocked by a machine capable of breaking ECDSA, Bitcoin’s current signature scheme. If the funds ever move, a soft fork would automatically activate, freezing vulnerable legacy wallets and publicly confirming the cryptography has been compromised.

This story is an excerpt from the Unchained Daily newsletter.

BIP-361, co-authored by Casa CTO Jameson Lopp and five other developers, would phase out legacy address types over roughly five years and render unmigrated coins permanently unspendable. Lopp has acknowledged he “doesn’t like” his own proposal, describing it as a contingency plan he would rather never need. BIP-361 has generated fierce backlash, with critics arguing that a developer-imposed freeze violates the foundational principle that no external party can restrict access to funds.

The canary design attempts to sidestep that controversy by keeping coins spendable unless a breach is demonstrated. A “safety window” would also retroactively freeze coins sent just before the trigger fires, to deter stealth attacks. The central risk is structural: the design relies on a quantum-capable actor choosing a bounty over what would be among the largest thefts in financial history.

Over 34% of all Bitcoin has an exposed public key on-chain, making those coins theoretically vulnerable, according to a recent Ark Invest paper. A recent Google research paper estimated a sufficiently powerful machine could emerge sooner than many expect, though researchers including Galaxy Digital’s Alex Thorn have cautioned the threat remains manageable for now.