A little while back, @benthecarman posted about the concern that in the case of a cryptographically relevant quantum computer, miners would continually 51% attack the network in an attempt to get Satoshi's coins, reorging out previous transactions that may have moved Satoshi's coins (#1476783).

Earlier today on X, @lopp referenced a 2024 MIT paper about a similar dynamic (not involving quantum attack, but thinking through how miners might behave in a world with some transactions that have dramatically higher fee value than others).

The paper (linked above) is by Claire Bao with mentorship from Neha Narula and Tadge Dryja:

Our research found that the blockchain is safe from undercutting attacks when the block size limit is small relative to the number of transactions, but the blockchain becomes more susceptible to undercutting attacks if transactions with much higher fees enter the mempool infrequently even for smaller block size limits. Moreover, we extend the logic of undercutting attacks from the original paper to show that, if the mempool dynamics are such that the undercutting occurs long-term, the tangible impact on users is that very little progress will be made as fully rational miners will end up only including one transaction per block, regardless of the total amount of available transactions.

If miner rewards for some blocks are dramatically higher than for other blocks, it seems like we would see attempts by miners to reorganize the chain to build on a block in which they mine a particularly valuable transaction rather than building on a competing miner's block containing that valuable transaction.

if a fee gradient exists and high fee transactions with significantly higher fees enter the mempool infrequently, then undercutting occurs and is profitable long-term.

It seems likely that in the potential world where someone controls a cryptographically relevant quantum computer, they will work closely with a large miner or offer very a transaction with a very large fee to move some large pile of quantum vulnerable coins.

Bao models this behavior out and concludes:

By extending the reasoning from the original paper, we explained that the blockchain will end up being long chains of blocks with the minimum possible transactions and values as miners attempt to avoid having their own blocks undercut, thereby resulting in very slow chain progress and very few of the user transactions being confirmed. In other words, if the transaction fee dynamics result in undercutting attacks being profitable and frequent long-term, the blockchain’s progress, in terms of transactions being confirmed in each block, will slow down drastically and hurt the overall stability and usability of Bitcoin.

The paper suggests that Carman's concerns about the risks of not confiscating Satoshi's coins should be investigated further.

I'm still not sure how to think about this. Especially if we figure that coalitions of miners might form. It also feels to me like we would need to be much more certain that this chaotic mining environment would actually materialize and that it would last for a significant period before we entertain the concept of confiscating coins in order to avoid it.