diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 8c0977f08823..d1448691fdb6 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -237,6 +237,7 @@ add_library(bitcoin_node STATIC EXCLUDE_FROM_ALL
   node/minisketchwrapper.cpp
   node/peerman_args.cpp
   node/psbt.cpp
+  node/quantum.cpp
   node/timeoffsets.cpp
   node/transaction.cpp
   node/txdownloadman_impl.cpp
diff --git a/src/common/args.cpp b/src/common/args.cpp
index cfd36e1f6a5a..a26c96b1ce0d 100644
--- a/src/common/args.cpp
+++ b/src/common/args.cpp
@@ -848,6 +848,7 @@ const std::vector<std::string> TEST_OPTIONS_DOC{
     "addrman (use deterministic addrman)",
     "reindex_after_failure_noninteractive_yes (When asked for a reindex after failure interactively, simulate as-if answered with 'yes')",
     "bip94 (enforce BIP94 consensus rules)",
+    "fakenums (use a NUMS point with a known discrete log for the quantum tripwire, so a theft and proof can be simulated)",
 };
 
 bool HasTestOption(const ArgsManager& args, const std::string& test_option)
diff --git a/src/init.cpp b/src/init.cpp
index 0e72443cc338..5dbcbe96cad4 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -65,6 +65,7 @@
 #include <node/mining_args.h>
 #include <node/mining_types.h>
 #include <node/peerman_args.h>
+#include <node/quantum.h>
 #include <policy/feerate.h>
 #include <policy/fees/block_policy_estimator.h>
 #include <policy/fees/block_policy_estimator_args.h>
@@ -1461,6 +1462,17 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
 
     LogInfo("Using at most %i automatic connections (%i file descriptors available)", nMaxConnections, available_fds);
 
+    // The quantum tripwire normally verifies proofs against the real BIP-341
+    // NUMS point (unknown discrete log). On regtest, -test=fakenums switches to a
+    // NUMS point whose discrete log is known, so a theft -- and a verifying proof
+    // -- can be simulated end to end.
+    if (HasTestOption(args, "fakenums")) {
+        node::GetQuantumProofStore().UseFakeNumsPoint();
+        LogInfo("Quantum tripwire using fake NUMS point (known discrete log) for testing");
+    }
+    // Persist the tripwire's activation point here, so it survives a restart.
+    node::GetQuantumProofStore().SetActivationFilePath(args.GetDataDirNet() / "quantum_tripwire.dat");
+
     // Warn about relative -datadir path.
     if (args.IsArgSet("-datadir") && !args.GetPathArg("-datadir").is_absolute()) {
         LogWarning("Relative datadir option '%s' specified, which will be interpreted relative to the "
@@ -1684,6 +1696,11 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
         validation_signals.RegisterValidationInterface(fee_estimator);
     }
 
+    // Watch connected blocks for a published quantum-tripwire proof, so the
+    // "quantum" deployment can activate instantly. Unregistered by
+    // UnregisterAllValidationInterfaces() at shutdown.
+    validation_signals.RegisterValidationInterface(&node::GetQuantumProofStore());
+
     for (const std::string& socket_addr : args.GetArgs("-bind")) {
         std::string host_out;
         uint16_t port_out{0};
@@ -1913,6 +1930,14 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
     ChainstateManager& chainman = *Assert(node.chainman);
     auto& kernel_notifications{*Assert(node.notifications)};
 
+    // Restore the quantum tripwire's activation from its persisted file (if any).
+    // This must run after the headers are loaded from disk (done above, so the
+    // activation block can be looked up) but before the network is started and
+    // new headers are accepted (which could reorg the chain mid-check), to avoid
+    // a race. Blocks connected later, e.g. during reindex/IBD, are handled
+    // incrementally by the registered validation interface.
+    node::GetQuantumProofStore().LoadActivationFromFile(chainman);
+
     assert(!node.peerman);
     node.peerman = PeerManager::make(*node.connman, *node.addrman,
                                      node.banman.get(), chainman,
diff --git a/src/net_processing.cpp b/src/net_processing.cpp
index 61b8a4ecd852..deddc5100fd9 100644
--- a/src/net_processing.cpp
+++ b/src/net_processing.cpp
@@ -33,6 +33,7 @@
 #include <node/blockstorage.h>
 #include <node/connection_types.h>
 #include <node/protocol_version.h>
+#include <node/quantum.h>
 #include <node/timeoffsets.h>
 #include <node/txdownloadman.h>
 #include <node/txorphanage.h>
@@ -539,6 +540,7 @@ class PeerManagerImpl final : public PeerManager
     std::vector<PrivateBroadcast::TxBroadcastInfo> GetPrivateBroadcastInfo() const override EXCLUSIVE_LOCKS_REQUIRED(!m_peer_mutex);
     std::vector<CTransactionRef> AbortPrivateBroadcast(const uint256& id) override EXCLUSIVE_LOCKS_REQUIRED(!m_peer_mutex);
     void SendPings() override EXCLUSIVE_LOCKS_REQUIRED(!m_peer_mutex);
+    void RelayQuantumProof(std::span<const unsigned char> proof) override { FloodQuantumProof(proof, /*exclude_peer=*/std::nullopt); }
     void InitiateTxBroadcastToAll(const Txid& txid, const Wtxid& wtxid) override EXCLUSIVE_LOCKS_REQUIRED(!m_peer_mutex);
     void InitiateTxBroadcastPrivate(const CTransactionRef& tx) override EXCLUSIVE_LOCKS_REQUIRED(!m_peer_mutex);
     void SetBestBlock(int height, std::chrono::seconds time) override
@@ -720,6 +722,16 @@ class PeerManagerImpl final : public PeerManager
 
     /** Send a message to a peer */
     void PushMessage(CNode& node, CSerializedNetMsg&& msg) const { m_connman.PushMessage(&node, std::move(msg)); }
+    //! Send a quantum-tripwire proof to every connected peer except `exclude_peer`.
+    void FloodQuantumProof(std::span<const unsigned char> proof, std::optional<NodeId> exclude_peer)
+    {
+        const std::vector<unsigned char> data(proof.begin(), proof.end());
+        m_connman.ForEachNode([&](CNode* pnode) {
+            if (!exclude_peer || pnode->GetId() != *exclude_peer) {
+                MakeAndPushMessage(*pnode, NetMsgType::QPROOF, data);
+            }
+        });
+    }
     template <typename... Args>
     void MakeAndPushMessage(CNode& node, std::string msg_type, Args&&... args) const
     {
@@ -5101,6 +5113,26 @@ void PeerManagerImpl::ProcessMessage(Peer& peer, CNode& pfrom, const std::string
         return;
     }
 
+    if (msg_type == NetMsgType::QPROOF) {
+        // Relayed "aRsm" ECDL-break (quantum tripwire) proof.
+        std::vector<unsigned char> proof;
+        vRecv >> proof;
+        if (proof.size() != node::QUANTUM_PROOF_SIZE) {
+            LogDebug(BCLog::NET, "qproof of invalid size %u from peer=%d\n", proof.size(), pfrom.GetId());
+            return;
+        }
+        // Verify and store. Add() returns false for an invalid (fake) or already
+        // known proof, in which case we neither store nor relay it: over p2p we
+        // only ever accept and forward the first valid proof.
+        if (!node::GetQuantumProofStore().Add(proof)) {
+            LogDebug(BCLog::NET, "ignored invalid or duplicate qproof from peer=%d\n", pfrom.GetId());
+            return;
+        }
+        LogDebug(BCLog::NET, "stored and relaying new qproof from peer=%d\n", pfrom.GetId());
+        FloodQuantumProof(proof, /*exclude_peer=*/pfrom.GetId());
+        return;
+    }
+
     // Ignore unknown message types for extensibility
     LogDebug(BCLog::NET, "Unknown message type \"%s\" from peer=%d", SanitizeString(msg_type), pfrom.GetId());
     return;
diff --git a/src/net_processing.h b/src/net_processing.h
index 630656e2af6d..9acd9645e5be 100644
--- a/src/net_processing.h
+++ b/src/net_processing.h
@@ -20,6 +20,7 @@
 #include <cstdint>
 #include <memory>
 #include <optional>
+#include <span>
 #include <string>
 #include <vector>
 
@@ -153,6 +154,9 @@ class PeerManager : public CValidationInterface, public NetEventsInterface
     /** Send ping message to all peers */
     virtual void SendPings() = 0;
 
+    /** Relay a verified "aRsm" ECDL-break (quantum tripwire) proof to all peers. */
+    virtual void RelayQuantumProof(std::span<const unsigned char> proof) = 0;
+
     /** Set the height of the best block and its time (seconds since epoch). */
     virtual void SetBestBlock(int height, std::chrono::seconds time) = 0;
 
diff --git a/src/node/miner.cpp b/src/node/miner.cpp
index 32a21440c4e5..959e3f75b535 100644
--- a/src/node/miner.cpp
+++ b/src/node/miner.cpp
@@ -19,6 +19,7 @@
 #include <node/kernel_notifications.h>
 #include <node/mining_args.h>
 #include <node/mining_types.h>
+#include <node/quantum.h>
 #include <policy/feerate.h>
 #include <policy/policy.h>
 #include <pow.h>
@@ -183,6 +184,34 @@ std::unique_ptr<CBlockTemplate> BlockAssembler::CreateNewBlock()
     coinbaseTx.vout[0].nValue = block_reward;
     coinbase_tx.block_reward_remaining = block_reward;
 
+    // Quantum tripwire: until the "quantum" deployment activates, publish the
+    // single stored "aRsm" ECDL-break proof as a required OP_RETURN output in the
+    // coinbase. The proof is QUANTUM_PROOF_SIZE bytes, carried in a standard
+    // null-data output with zero value (so block_reward_remaining is unaffected),
+    // and added as a required_output that IPC mining clients must include,
+    // alongside the witness commitment appended below.
+    //
+    // The proof cannot fit in the 80-byte block header, so the coinbase is the
+    // only place to carry it. Using a coinbase OP_RETURN as a signalling channel
+    // mirrors a draft for coinbase-based version-bit signalling:
+    //   https://gnusha.org/pi/bitcoindev/D52CEDCC-C7EF-429E-802F-F28DC9241FF0@sprovoost.nl/
+    // In that thread Antoine Poinsot argued against using the coinbase for
+    // signalling -- chiefly that, unlike version bits in the header, it forces
+    // nodes to read full blocks to learn the activation state. We sidestep that
+    // by persisting the activation point (block hash + proof) to a small file
+    // (see node::QuantumProofStore), so determining activation after the one-off
+    // signal needs no block re-reads: a header lookup suffices, even on pruned
+    // nodes. We publish the proof in exactly one block: once that block connects,
+    // the deployment activates from the next block and we stop adding it
+    // (IsActiveAtHeight() below).
+    if (auto& quantum{GetQuantumProofStore()}; !quantum.IsActiveAtHeight(nHeight)) {
+        if (const auto proof{quantum.GetProof()}) {
+            CTxOut proof_out{0, CScript() << OP_RETURN << *proof};
+            coinbaseTx.vout.push_back(proof_out);
+            coinbase_tx.required_outputs.push_back(proof_out);
+        }
+    }
+
     // Start the coinbase scriptSig with the block height as required by BIP34.
     // Mining clients are expected to append extra data to this prefix, so
     // increasing its length would reduce the space they can use and may break
diff --git a/src/node/quantum.cpp b/src/node/quantum.cpp
new file mode 100644
index 000000000000..aa505a8f8f34
--- /dev/null
+++ b/src/node/quantum.cpp
@@ -0,0 +1,272 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <node/quantum.h>
+
+#include <chain.h>
+#include <consensus/merkle.h>
+#include <hash.h>
+#include <kernel/chainstatemanager_opts.h>
+#include <logging.h>
+#include <node/blockstorage.h>
+#include <primitives/block.h>
+#include <primitives/transaction.h>
+#include <pubkey.h>
+#include <script/script.h>
+#include <streams.h>
+#include <sync.h>
+#include <uint256.h>
+#include <util/fs.h>
+#include <util/fs_helpers.h>
+#include <util/strencodings.h>
+#include <util/syserror.h>
+#include <validation.h>
+
+#include <exception>
+#include <optional>
+#include <span>
+#include <utility>
+#include <vector>
+
+using namespace util::hex_literals;
+
+namespace node {
+
+namespace {
+//! A NUMS point with a *known* discrete log (sha256("bitcoin-quantum fake NUMS
+//! point")*G), used only under -test=fakenums so that a theft -- and therefore a
+//! verifying proof -- can be simulated. The matching scalar lives in
+//! test/functional/test_framework/quantum.py (FAKE_NUMS_SECKEY).
+constexpr XOnlyPubKey FAKE_NUMS_POINT{
+    []() consteval { return XOnlyPubKey{"5f0fb4b5d2ecfd58722a44cc59da0f9e22875ef90164f8ba6af3a61db1951177"_hex_u8}; }(),
+};
+} // namespace
+
+std::optional<std::vector<unsigned char>> ProofFromScript(std::span<const unsigned char> script)
+{
+    // Expect exactly: OP_RETURN <QUANTUM_PROOF_SIZE-byte push>.
+    const CScript spk(script.begin(), script.end());
+    CScript::const_iterator pc{spk.begin()};
+    opcodetype op;
+    if (!spk.GetOp(pc, op) || op != OP_RETURN) return std::nullopt;
+    std::vector<unsigned char> data;
+    if (!spk.GetOp(pc, op, data)) return std::nullopt;
+    if (pc != spk.end()) return std::nullopt; // more than one push
+    if (data.size() != QUANTUM_PROOF_SIZE) return std::nullopt;
+    return data;
+}
+
+void QuantumProofStore::SetNumsPoint(const XOnlyPubKey& nums)
+{
+    LOCK(m_mutex);
+    m_nums = nums;
+}
+
+void QuantumProofStore::UseFakeNumsPoint()
+{
+    LOCK(m_mutex);
+    m_nums = FAKE_NUMS_POINT;
+}
+
+XOnlyPubKey QuantumProofStore::GetNumsPoint() const
+{
+    LOCK(m_mutex);
+    return m_nums;
+}
+
+bool QuantumProofStore::VerifyLocked(std::span<const unsigned char> proof) const
+{
+    if (proof.size() != QUANTUM_PROOF_SIZE) return false;
+    // Split a || R || s || m.
+    const uint256 tweak{proof.subspan(0, 32)};
+    const std::span<const unsigned char> sig{proof.subspan(32, 64)};
+    const uint256 msg{proof.subspan(96, 32)};
+    // P = N + a*G
+    const auto tweaked{m_nums.AddTweak(tweak)};
+    if (!tweaked) return false;
+    return tweaked->first.VerifySchnorr(msg, sig);
+}
+
+bool QuantumProofStore::Verify(std::span<const unsigned char> proof) const
+{
+    LOCK(m_mutex);
+    return VerifyLocked(proof);
+}
+
+bool QuantumProofStore::Add(std::vector<unsigned char> proof)
+{
+    if (proof.size() != QUANTUM_PROOF_SIZE) return false;
+    LOCK(m_mutex);
+    if (m_active_since.has_value()) return false; // tripwire already fired
+    if (m_proof.has_value()) return false;        // we already hold a proof
+    if (!VerifyLocked(proof)) return false;
+    m_proof = std::move(proof);
+    return true;
+}
+
+std::optional<std::vector<unsigned char>> QuantumProofStore::GetProof() const
+{
+    LOCK(m_mutex);
+    return m_proof;
+}
+
+std::optional<int> QuantumProofStore::ActivationHeight() const
+{
+    LOCK(m_mutex);
+    return m_active_since;
+}
+
+bool QuantumProofStore::IsActiveAtHeight(int height) const
+{
+    LOCK(m_mutex);
+    return m_active_since.has_value() && height >= *m_active_since;
+}
+
+void QuantumProofStore::BlockConnected(const kernel::ChainstateRole& role, const std::shared_ptr<const CBlock>& block, const CBlockIndex* pindex)
+{
+    if (pindex == nullptr || block->vtx.empty()) return;
+    LOCK(m_mutex);
+    if (m_active_since.has_value()) return; // already activated; stop scanning
+    // Scan the coinbase outputs for a published, valid proof.
+    for (const CTxOut& out : block->vtx[0]->vout) {
+        const auto proof{ProofFromScript(std::span<const unsigned char>(out.scriptPubKey.data(), out.scriptPubKey.size()))};
+        if (!proof || !VerifyLocked(*proof)) continue;
+        if (!m_proof.has_value()) m_proof = *proof;
+        // Instant activation: the tripwire is active from the next block.
+        m_active_since = pindex->nHeight + 1;
+        m_activation_block = pindex->GetBlockHash();
+        // Persist the coinbase and its merkle path so activation can be restored
+        // and re-verified after a restart without reading the block body.
+        WriteActivationFile(*block->vtx[0], TransactionMerklePath(*block, 0));
+        LogInfo("Quantum tripwire activated by block %d (%s); active from height %d\n",
+                pindex->nHeight, pindex->GetBlockHash().ToString(), *m_active_since);
+        break;
+    }
+}
+
+void QuantumProofStore::BlockDisconnected(const std::shared_ptr<const CBlock>& block, const CBlockIndex* pindex)
+{
+    if (pindex == nullptr) return;
+    LOCK(m_mutex);
+    if (m_active_since.has_value() && pindex->GetBlockHash() == m_activation_block) {
+        // The activating block was rolled back; resume scanning. Keep m_proof so
+        // it is re-published on the new chain. Deactivation is keyed on the
+        // activation block alone, so a *later* block that also carried a proof
+        // being reorged out does not deactivate the tripwire.
+        m_active_since.reset();
+        m_activation_block.SetNull();
+        RemoveActivationFile();
+    }
+}
+
+void QuantumProofStore::SetActivationFilePath(fs::path path)
+{
+    LOCK(m_mutex);
+    m_activation_file = std::move(path);
+}
+
+void QuantumProofStore::WriteActivationFile(const CTransaction& coinbase, const std::vector<uint256>& merkle_path) const
+{
+    if (m_activation_file.empty() || m_activation_block.IsNull()) return;
+    try {
+        AutoFile file{fsbridge::fopen(m_activation_file, "wb")};
+        if (file.IsNull()) {
+            LogWarning("Cannot open quantum activation file %s for writing\n", fs::PathToString(m_activation_file));
+            return;
+        }
+        // The witness (just the BIP141 reserved value) is irrelevant to both the
+        // txid used in the merkle path and the proof, so it is omitted.
+        file << m_activation_block << TX_NO_WITNESS(coinbase) << merkle_path;
+        // AutoFile requires written files to be closed explicitly so close errors
+        // can be surfaced; its destructor asserts the file was already closed.
+        if (file.fclose() != 0) {
+            const int errno_save{errno};
+            LogWarning("Failed to close quantum activation file %s: %s\n", fs::PathToString(m_activation_file), SysErrorString(errno_save));
+        }
+    } catch (const std::exception& e) {
+        LogWarning("Failed to write quantum activation file: %s\n", e.what());
+    }
+}
+
+void QuantumProofStore::RemoveActivationFile() const
+{
+    if (m_activation_file.empty()) return;
+    std::error_code ec;
+    fs::remove(m_activation_file, ec);
+}
+
+void QuantumProofStore::LoadActivationFromFile(ChainstateManager& chainman)
+{
+    const fs::path path{WITH_LOCK(m_mutex, return m_activation_file)};
+    if (path.empty() || !fs::exists(path)) return;
+
+    uint256 block_hash;
+    CMutableTransaction coinbase;
+    std::vector<uint256> merkle_path;
+    try {
+        AutoFile file{fsbridge::fopen(path, "rb")};
+        if (file.IsNull()) return;
+        file >> block_hash >> TX_NO_WITNESS(coinbase) >> merkle_path;
+    } catch (const std::exception&) {
+        LogWarning("Ignoring malformed quantum activation file %s\n", fs::PathToString(path));
+        return;
+    }
+
+    // Confirm the activation block is still in the active chain (it may have been
+    // reorged out while the node was down). Only the header is needed, so this
+    // also works for pruned nodes.
+    int height;
+    uint256 merkle_root;
+    {
+        LOCK(cs_main);
+        const CBlockIndex* pindex{chainman.m_blockman.LookupBlockIndex(block_hash)};
+        if (pindex == nullptr || !chainman.ActiveChain().Contains(*pindex)) {
+            LogInfo("Quantum activation block %s is not in the active chain; tripwire inactive\n", block_hash.ToString());
+            return;
+        }
+        height = pindex->nHeight;
+        merkle_root = pindex->hashMerkleRoot;
+    }
+
+    // Verify the coinbase is committed in that block: fold the merkle path. The
+    // coinbase is the leftmost leaf, so it stays the left operand at every level.
+    uint256 root{coinbase.GetHash().ToUint256()};
+    for (const uint256& step : merkle_path) {
+        root = Hash(root, step);
+    }
+    if (root != merkle_root) {
+        LogWarning("Quantum activation file %s has an invalid merkle proof; ignoring\n", fs::PathToString(path));
+        return;
+    }
+
+    // Recover the proof from the (now-trusted) coinbase, re-verifying it -- a
+    // defense against broken or malicious software writing a bogus coinbase.
+    std::optional<std::vector<unsigned char>> found;
+    for (const CTxOut& out : coinbase.vout) {
+        auto proof{ProofFromScript(std::span<const unsigned char>(out.scriptPubKey.data(), out.scriptPubKey.size()))};
+        if (proof && Verify(*proof)) {
+            found = std::move(proof);
+            break;
+        }
+    }
+    if (!found) {
+        LogWarning("Quantum activation file %s coinbase carries no valid proof; ignoring\n", fs::PathToString(path));
+        return;
+    }
+
+    LOCK(m_mutex);
+    m_proof = std::move(found);
+    m_active_since = height + 1;
+    m_activation_block = block_hash;
+    LogInfo("Quantum tripwire activation restored from disk: block %d (%s); active from height %d\n",
+            height, block_hash.ToString(), *m_active_since);
+}
+
+QuantumProofStore& GetQuantumProofStore()
+{
+    static QuantumProofStore store;
+    return store;
+}
+
+} // namespace node
diff --git a/src/node/quantum.h b/src/node/quantum.h
new file mode 100644
index 000000000000..e23723d652f5
--- /dev/null
+++ b/src/node/quantum.h
@@ -0,0 +1,124 @@
+// Copyright (c) 2026 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_NODE_QUANTUM_H
+#define BITCOIN_NODE_QUANTUM_H
+
+#include <pubkey.h>
+#include <sync.h>
+#include <util/fs.h>
+#include <validationinterface.h>
+
+#include <cstddef>
+#include <optional>
+#include <span>
+#include <vector>
+
+class CBlock;
+class CBlockIndex;
+class CTransaction;
+class ChainstateManager;
+
+namespace node {
+
+//! Serialized size of an "aRsm" ECDL-break proof: a(32) || R(32) || s(32) || m(32).
+static constexpr size_t QUANTUM_PROOF_SIZE{128};
+
+/**
+ * In-memory state for the "quantum tripwire" -- Anthony Towns' "aRsm" ECDL-break
+ * proof from the bitcoindev thread
+ * https://gnusha.org/pi/bitcoindev/aj9SkwXqdRbuVZxH@erisian.com.au/
+ *
+ * A 128-byte proof is the concatenation a || R || s || m. It is valid for the
+ * configured NUMS point N if (R, s) is a valid BIP-340 signature of m under
+ * P = N + a*G. A valid signature can only be produced by someone who knows
+ * dlog(P) = dlog(N) + a; since a is part of the proof, that is equivalent to
+ * knowing dlog(N), which requires breaking the elliptic-curve discrete log
+ * problem on secp256k1. See test/functional/test_framework/quantum.py.
+ *
+ * The node holds at most ONE proof (publishing more would just bloat coinbases).
+ * Once a proof is known it is published as a single required OP_RETURN output in
+ * the coinbase of the next block. A block carrying the proof instantly activates
+ * the "quantum" tripwire from the following block (see getdeploymentinfo); after
+ * activation the proof is no longer added to templates and incoming blocks are
+ * no longer scanned for it. There is no actual consensus rule change here -- the
+ * activation is purely a signal that a NUMS discrete log has been published.
+ *
+ * Activation is detected by scanning connected blocks' coinbase outputs, so this
+ * is a CValidationInterface. The activation point is persisted: when the tripwire
+ * fires we write a small file with the activation block hash, the full coinbase
+ * transaction, and its merkle inclusion path. At startup the file is re-read and
+ * verified two ways -- the coinbase's merkle path must reconstruct the block
+ * header's merkle root, and the coinbase must carry a proof that verifies -- and
+ * the header is looked up to confirm it is still in the active chain. Only the
+ * header is needed (not the block body), so this works for pruned nodes; and the
+ * proof is recovered by scanning the coinbase, so it is not stored twice. The
+ * store is a process-global singleton (each bitcoind has its own).
+ */
+class QuantumProofStore : public CValidationInterface
+{
+public:
+    //! Set the NUMS point N used for verification. Defaults to the real BIP-341
+    //! NUMS point (XOnlyPubKey::NUMS_H), whose discrete log is unknown.
+    void SetNumsPoint(const XOnlyPubKey& nums) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+    //! Switch to a fake NUMS point with a known discrete log (-test=fakenums),
+    //! so tests can simulate a theft and produce a verifying proof.
+    void UseFakeNumsPoint() EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+    XOnlyPubKey GetNumsPoint() const EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+    //! Return true if `proof` is well-formed and verifies against our NUMS point.
+    bool Verify(std::span<const unsigned char> proof) const EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+    //! Verify `proof` and, if valid, store it. Returns true only if it was newly
+    //! stored. A proof is ignored (returns false) if it is invalid, if we already
+    //! hold a proof, or if the tripwire has already activated.
+    bool Add(std::vector<unsigned char> proof) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+    //! The stored proof, if any.
+    std::optional<std::vector<unsigned char>> GetProof() const EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+    //! First block height at which the tripwire is active (one past the height of
+    //! the block that published the proof), or nullopt if not yet activated.
+    std::optional<int> ActivationHeight() const EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+    //! Whether the tripwire is active for a block at the given height.
+    bool IsActiveAtHeight(int height) const EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+    //! Set the path of the file used to persist the activation point. Must be set
+    //! at startup, before any block is connected.
+    void SetActivationFilePath(fs::path path) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+    //! Restore activation from the persisted file (if any): re-verify the proof,
+    //! confirm the activation block is still in the active chain, and activate.
+    void LoadActivationFromFile(ChainstateManager& chainman) EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+protected:
+    void BlockConnected(const kernel::ChainstateRole& role, const std::shared_ptr<const CBlock>& block, const CBlockIndex* pindex) override EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+    void BlockDisconnected(const std::shared_ptr<const CBlock>& block, const CBlockIndex* pindex) override EXCLUSIVE_LOCKS_REQUIRED(!m_mutex);
+
+private:
+    bool VerifyLocked(std::span<const unsigned char> proof) const EXCLUSIVE_LOCKS_REQUIRED(m_mutex);
+    void WriteActivationFile(const CTransaction& coinbase, const std::vector<uint256>& merkle_path) const EXCLUSIVE_LOCKS_REQUIRED(m_mutex);
+    void RemoveActivationFile() const EXCLUSIVE_LOCKS_REQUIRED(m_mutex);
+
+    mutable Mutex m_mutex;
+    XOnlyPubKey m_nums GUARDED_BY(m_mutex){XOnlyPubKey::NUMS_H};
+    std::optional<std::vector<unsigned char>> m_proof GUARDED_BY(m_mutex);
+    //! Height of the first block at which the tripwire is active. Set when a block
+    //! publishing the proof is connected; cleared if that block is disconnected.
+    std::optional<int> m_active_since GUARDED_BY(m_mutex);
+    //! Hash of the block that published the proof (for reorg handling).
+    uint256 m_activation_block GUARDED_BY(m_mutex);
+    //! File the activation point is persisted to (empty disables persistence).
+    fs::path m_activation_file GUARDED_BY(m_mutex);
+};
+
+//! Extract a 128-byte aRsm proof from an OP_RETURN <proof> scriptPubKey, if it
+//! has exactly that shape.
+std::optional<std::vector<unsigned char>> ProofFromScript(std::span<const unsigned char> script);
+
+//! Accessor for the process-global tripwire state.
+QuantumProofStore& GetQuantumProofStore();
+
+} // namespace node
+
+#endif // BITCOIN_NODE_QUANTUM_H
diff --git a/src/protocol.h b/src/protocol.h
index 24851e2fc49d..eb7fd48f4bff 100644
--- a/src/protocol.h
+++ b/src/protocol.h
@@ -268,6 +268,11 @@ inline constexpr const char* SENDTXRCNCL{"sendtxrcncl"};
  * BIP 434 Peer feature negotiation
  */
 inline constexpr const char* FEATURE{"feature"};
+/**
+ * Relays a 128-byte "aRsm" ECDL-break (quantum tripwire) proof
+ * (a || R || s || m). Experimental.
+ */
+inline constexpr const char* QPROOF{"qproof"};
 }; // namespace NetMsgType
 
 /** All known message types (see above). Keep this in the same order as the list of messages above. */
@@ -308,6 +313,7 @@ inline const std::array ALL_NET_MESSAGE_TYPES{std::to_array<std::string>({
     NetMsgType::WTXIDRELAY,
     NetMsgType::SENDTXRCNCL,
     NetMsgType::FEATURE,
+    NetMsgType::QPROOF,
 })};
 
 static constexpr size_t MAX_FEATUREID_LENGTH{80};
diff --git a/src/pubkey.cpp b/src/pubkey.cpp
index 264f861bc7a4..781734c4acc0 100644
--- a/src/pubkey.cpp
+++ b/src/pubkey.cpp
@@ -279,6 +279,22 @@ std::optional<std::pair<XOnlyPubKey, bool>> XOnlyPubKey::CreateTapTweak(const ui
     return ret;
 }
 
+std::optional<std::pair<XOnlyPubKey, bool>> XOnlyPubKey::AddTweak(const uint256& tweak) const
+{
+    secp256k1_xonly_pubkey base_point;
+    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_static, &base_point, data())) return std::nullopt;
+    secp256k1_pubkey out;
+    if (!secp256k1_xonly_pubkey_tweak_add(secp256k1_context_static, &out, &base_point, tweak.data())) return std::nullopt;
+    int parity = -1;
+    std::pair<XOnlyPubKey, bool> ret;
+    secp256k1_xonly_pubkey out_xonly;
+    if (!secp256k1_xonly_pubkey_from_pubkey(secp256k1_context_static, &out_xonly, &parity, &out)) return std::nullopt;
+    secp256k1_xonly_pubkey_serialize(secp256k1_context_static, ret.first.begin(), &out_xonly);
+    assert(parity == 0 || parity == 1);
+    ret.second = parity;
+    return ret;
+}
+
 
 bool CPubKey::Verify(const uint256 &hash, const std::vector<unsigned char>& vchSig) const {
     if (!IsValid())
diff --git a/src/pubkey.h b/src/pubkey.h
index 0391609ebcc3..677cb3359cec 100644
--- a/src/pubkey.h
+++ b/src/pubkey.h
@@ -276,6 +276,12 @@ class XOnlyPubKey
     /** Construct a Taproot tweaked output point with this point as internal key. */
     std::optional<std::pair<XOnlyPubKey, bool>> CreateTapTweak(const uint256* merkle_root) const;
 
+    /** Add tweak*G to this point, with the 32-byte `tweak` scalar used directly
+     *  (unlike CreateTapTweak, which derives the tweak from a Merkle root).
+     *  Returns the resulting x-only point and its parity, or nullopt on failure.
+     *  This computes P = X + tweak*G, e.g. a BIP341 output key N + a*G. */
+    std::optional<std::pair<XOnlyPubKey, bool>> AddTweak(const uint256& tweak) const;
+
     /** Returns a list of CKeyIDs for the CPubKeys that could have been used to create this XOnlyPubKey.
      * As the CKeyID is the Hash160(full pubkey), the produced CKeyIDs are for the versions of this
      * XOnlyPubKey with 0x02 and 0x03 prefixes.
diff --git a/src/rpc/blockchain.cpp b/src/rpc/blockchain.cpp
index d78b82bce3e5..ff00dc3dbd28 100644
--- a/src/rpc/blockchain.cpp
+++ b/src/rpc/blockchain.cpp
@@ -29,6 +29,7 @@
 #include <net_processing.h>
 #include <node/blockstorage.h>
 #include <node/context.h>
+#include <node/quantum.h>
 #include <node/transaction.h>
 #include <node/utxo_snapshot.h>
 #include <node/warnings.h>
@@ -1480,7 +1481,7 @@ RPCMethod getblockchaininfo()
 
 namespace {
 const std::vector<RPCResult> RPCHelpForDeployment{
-    {RPCResult::Type::STR, "type", "one of \"buried\", \"bip9\""},
+    {RPCResult::Type::STR, "type", "one of \"buried\", \"bip9\", \"tripwire\""},
     {RPCResult::Type::NUM, "height", /*optional=*/true, "height of the first block which the rules are or will be enforced (only for \"buried\" type, or \"bip9\" type with \"active\" status)"},
     {RPCResult::Type::BOOL, "active", "true if the rules are enforced for the mempool and the next block"},
     {RPCResult::Type::OBJ, "bip9", /*optional=*/true, "status of bip9 softforks (only for \"bip9\" type)",
@@ -1504,6 +1505,24 @@ const std::vector<RPCResult> RPCHelpForDeployment{
     }},
 };
 
+static void QuantumSoftForkDescPushBack(const CBlockIndex* blockindex, UniValue& softforks)
+{
+    // The "quantum" tripwire: not a consensus rule change, but a signal that an
+    // ECDL-break proof has been published in a coinbase OP_RETURN. It activates
+    // instantly, one block after the proof-bearing block.
+    UniValue rv(UniValue::VOBJ);
+    rv.pushKV("type", "tripwire");
+    const auto activation{node::GetQuantumProofStore().ActivationHeight()};
+    bool active{false};
+    if (activation.has_value()) {
+        rv.pushKV("height", *activation);
+        // Active if the rules apply to the block after blockindex (the next block).
+        active = blockindex != nullptr && (*activation <= blockindex->nHeight + 1);
+    }
+    rv.pushKV("active", active);
+    softforks.pushKV("quantum", std::move(rv));
+}
+
 UniValue DeploymentInfo(const CBlockIndex* blockindex, const ChainstateManager& chainman)
 {
     UniValue softforks(UniValue::VOBJ);
@@ -1513,6 +1532,7 @@ UniValue DeploymentInfo(const CBlockIndex* blockindex, const ChainstateManager&
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_CSV);
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_SEGWIT);
     SoftForkDescPushBack(blockindex, softforks, chainman, Consensus::DEPLOYMENT_TESTDUMMY);
+    QuantumSoftForkDescPushBack(blockindex, softforks);
     return softforks;
 }
 } // anon namespace
diff --git a/src/rpc/mining.cpp b/src/rpc/mining.cpp
index 1d72c699c593..42b40fd40684 100644
--- a/src/rpc/mining.cpp
+++ b/src/rpc/mining.cpp
@@ -22,12 +22,14 @@
 #include <interfaces/types.h>
 #include <key_io.h>
 #include <net.h>
+#include <net_processing.h>
 #include <netbase.h>
 #include <node/blockstorage.h>
 #include <node/context.h>
 #include <node/miner.h>
 #include <node/mining_args.h>
 #include <node/mining_types.h>
+#include <node/quantum.h>
 #include <node/warnings.h>
 #include <policy/feerate.h>
 #include <policy/policy.h>
@@ -62,6 +64,7 @@
 #include <versionbits.h>
 
 #include <algorithm>
+#include <array>
 #include <cstddef>
 #include <cstdint>
 #include <functional>
@@ -728,6 +731,7 @@ static RPCMethod getblocktemplate()
                 {RPCResult::Type::NUM, "height", "The height of the next block"},
                 {RPCResult::Type::STR_HEX, "signet_challenge", /*optional=*/true, "Only on signet"},
                 {RPCResult::Type::STR_HEX, "default_witness_commitment", /*optional=*/true, "a valid witness commitment for the unmodified block template"},
+                {RPCResult::Type::STR_HEX, "quantum_proof", /*optional=*/true, "the 128-byte ECDL-break (quantum tripwire) proof to include as a coinbase OP_RETURN, if one is held and not yet activated"},
             }},
         },
         RPCExamples{
@@ -1056,8 +1060,19 @@ static RPCMethod getblocktemplate()
     }
 
     if (auto coinbase{block_template->getCoinbaseTx()}; coinbase.required_outputs.size() > 0) {
-        CHECK_NONFATAL(coinbase.required_outputs.size() == 1); // Only one output is currently expected
-        result.pushKV("default_witness_commitment", HexStr(coinbase.required_outputs[0].scriptPubKey));
+        // required_outputs holds the witness commitment plus, before activation,
+        // the single quantum-tripwire proof OP_RETURN. Surface the witness
+        // commitment in the historical field and the proof (if any) separately.
+        static constexpr std::array<unsigned char, 6> WITNESS_COMMITMENT_HEADER{0x6a, 0x24, 0xaa, 0x21, 0xa9, 0xed};
+        for (const CTxOut& out : coinbase.required_outputs) {
+            const CScript& spk{out.scriptPubKey};
+            if (spk.size() >= WITNESS_COMMITMENT_HEADER.size() &&
+                std::equal(WITNESS_COMMITMENT_HEADER.begin(), WITNESS_COMMITMENT_HEADER.end(), spk.begin())) {
+                result.pushKV("default_witness_commitment", HexStr(spk));
+            } else if (const auto proof{node::ProofFromScript(std::span<const unsigned char>(spk.data(), spk.size()))}) {
+                result.pushKV("quantum_proof", HexStr(*proof));
+            }
+        }
     }
 
     return result;
@@ -1175,6 +1190,98 @@ static RPCMethod submitheader()
     };
 }
 
+static RPCMethod submitquantumproof()
+{
+    return RPCMethod{
+        "submitquantumproof",
+        "Submit an \"aRsm\" ECDL-break (quantum tripwire) proof.\n"
+        "The 128-byte proof is the concatenation a || R || s || m. It verifies\n"
+        "against the node's configured NUMS point N: it is valid if (R, s) is a\n"
+        "valid BIP-340 signature of m under P = N + a*G. The node holds at most one\n"
+        "proof (in memory, not persisted); it is published as a single OP_RETURN\n"
+        "output in the coinbase of the next block, which instantly activates the\n"
+        "\"quantum\" deployment (see getdeploymentinfo).\n"
+        "Any valid proof submitted this way is relayed to all peers, even if one is\n"
+        "already held (unlike proofs received over p2p, which stop at the first).",
+        {
+            {"proof", RPCArg::Type::STR_HEX, RPCArg::Optional::NO, "The 128-byte proof, hex-encoded."},
+        },
+        RPCResult{
+            RPCResult::Type::OBJ, "", "",
+            {
+                {RPCResult::Type::BOOL, "valid", "Whether the proof verified against the NUMS point."},
+                {RPCResult::Type::BOOL, "stored", "Whether the proof was newly stored (false if invalid, a proof is already held, or the tripwire already activated)."},
+            }
+        },
+        RPCExamples{
+            HelpExampleCli("submitquantumproof", "\"<128-byte-hex>\"")
+            + HelpExampleRpc("submitquantumproof", "\"<128-byte-hex>\"")
+        },
+        [](const RPCMethod& self, const JSONRPCRequest& request) -> UniValue
+{
+    const std::string proof_hex{request.params[0].get_str()};
+    if (!IsHex(proof_hex)) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "proof must be hexadecimal");
+    }
+    std::vector<unsigned char> proof{ParseHex(proof_hex)};
+    if (proof.size() != node::QUANTUM_PROOF_SIZE) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("proof must be %u bytes", node::QUANTUM_PROOF_SIZE));
+    }
+
+    auto& store{node::GetQuantumProofStore()};
+    const bool valid{store.Verify(proof)};
+    // Relay any valid proof to peers -- even if we already hold one -- so an
+    // operator can inject a proof into the network. Only the p2p path stops
+    // forwarding once a proof is known.
+    if (valid) {
+        NodeContext& node{EnsureAnyNodeContext(request.context)};
+        EnsurePeerman(node).RelayQuantumProof(proof);
+    }
+    const bool stored{store.Add(std::move(proof))};
+
+    UniValue result(UniValue::VOBJ);
+    result.pushKV("valid", valid);
+    result.pushKV("stored", stored);
+    return result;
+},
+    };
+}
+
+static RPCMethod getquantumproof()
+{
+    return RPCMethod{
+        "getquantumproof",
+        "Return the \"aRsm\" ECDL-break (quantum tripwire) proof currently held, and the activation state.",
+        {},
+        RPCResult{
+            RPCResult::Type::OBJ, "", "",
+            {
+                {RPCResult::Type::STR_HEX, "proof", /*optional=*/true, "the stored 128-byte proof (a || R || s || m), hex-encoded; absent if none is held"},
+                {RPCResult::Type::BOOL, "active", "whether the \"quantum\" tripwire has activated"},
+                {RPCResult::Type::NUM, "activation_height", /*optional=*/true, "the first block height at which the tripwire is active; absent if not activated"},
+            }
+        },
+        RPCExamples{
+            HelpExampleCli("getquantumproof", "")
+            + HelpExampleRpc("getquantumproof", "")
+        },
+        [](const RPCMethod& self, const JSONRPCRequest& request) -> UniValue
+{
+    auto& store{node::GetQuantumProofStore()};
+    UniValue result(UniValue::VOBJ);
+    if (const auto proof{store.GetProof()}) {
+        result.pushKV("proof", HexStr(*proof));
+    }
+    const auto activation{store.ActivationHeight()};
+    result.pushKV("active", activation.has_value());
+    if (activation.has_value()) {
+        result.pushKV("activation_height", *activation);
+    }
+    return result;
+},
+    };
+}
+
 void RegisterMiningRPCCommands(CRPCTable& t)
 {
     static const CRPCCommand commands[]{
@@ -1185,6 +1292,8 @@ void RegisterMiningRPCCommands(CRPCTable& t)
         {"mining", &getblocktemplate},
         {"mining", &submitblock},
         {"mining", &submitheader},
+        {"mining", &submitquantumproof},
+        {"mining", &getquantumproof},
 
         {"hidden", &generatetoaddress},
         {"hidden", &generatetodescriptor},
diff --git a/src/test/fuzz/rpc.cpp b/src/test/fuzz/rpc.cpp
index e3d3e540dcb5..01ce70120361 100644
--- a/src/test/fuzz/rpc.cpp
+++ b/src/test/fuzz/rpc.cpp
@@ -151,6 +151,7 @@ const std::vector<std::string> RPC_COMMANDS_SAFE_FOR_FUZZING{
     "getpeerinfo",
     "getprioritisedtransactions",
     "getprivatebroadcastinfo",
+    "getquantumproof",
     "getrawaddrman",
     "getrawmempool",
     "getrawtransaction",
@@ -180,6 +181,7 @@ const std::vector<std::string> RPC_COMMANDS_SAFE_FOR_FUZZING{
     "submitblock",
     "submitheader",
     "submitpackage",
+    "submitquantumproof",
     "syncwithvalidationinterfacequeue",
     "testmempoolaccept",
     "uptime",
diff --git a/test/functional/feature_quantum_proof.py b/test/functional/feature_quantum_proof.py
new file mode 100755
index 000000000000..553718f60dcc
--- /dev/null
+++ b/test/functional/feature_quantum_proof.py
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Simulate a post-quantum theft, build the resulting aRsm ECDL-break proof, and
+exercise the node's handling of it (RPC submission, coinbase publication via both
+the monolithic miner and the Mining IPC, and the instant "quantum" tripwire
+activation).
+
+See test_framework/quantum.py for the cryptographic background. This test:
+
+  1. Runs the node with -test=fakenums, so its verifier uses a NUMS point N = n*G
+     whose discrete log n we know (standing in for the real BIP-341 NUMS point,
+     whose discrete log nobody knows). Knowing n is what lets us simulate a
+     quantum attacker that has "broken ECDL".
+  2. A "victim" creates an ordinary script-path-only Taproot output that uses N
+     as its internal key: scriptPubKey = OP_1 <P>, with P = N + a*G.
+  3. A "quantum thief" key-path spends that output, broadcasting a BIP-340
+     signature under P -- only possible if you know dlog(P) = dlog(N) + a.
+  4. The proof a || R || s || m is assembled from the public tweak a and the
+     thief's on-chain signature (R, s) over sighash m, and submitted via RPC.
+  5. The node publishes it as a single coinbase OP_RETURN in the next block --
+     verified both via the monolithic miner and (when IPC is available) via the
+     Mining IPC getCoinbaseTx() requiredOutputs -- which instantly activates the
+     "quantum" deployment. After activation the OP_RETURN is no longer added.
+"""
+import asyncio
+import hashlib
+from io import BytesIO
+
+from test_framework.key import (
+    compute_xonly_pubkey,
+    sign_schnorr,
+    tweak_add_privkey,
+)
+from test_framework.messages import (
+    COIN,
+    COutPoint,
+    CTransaction,
+    CTxIn,
+    CTxInWitness,
+    CTxOut,
+)
+from test_framework.quantum import (
+    FAKE_NUMS_SECKEY,
+    FAKE_NUMS_XONLY,
+    NUMS_H,
+    make_proof,
+    split_proof,
+    verify_proof,
+)
+from test_framework.script import (
+    CScript,
+    OP_CHECKSIG,
+    OP_RETURN,
+    taproot_construct,
+    TaprootSignatureHash,
+)
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal
+from test_framework.wallet import MiniWallet
+
+# The Mining IPC check is optional: it needs both a multiprocess build and the
+# python capnp module. When either is missing we still run the rest of the demo.
+try:
+    import capnp  # type: ignore[import] # noqa: F401
+    from test_framework.ipc_util import (
+        destroying,
+        load_capnp_modules,
+        make_mining_ctx,
+        mining_get_coinbase_tx,
+    )
+    HAVE_CAPNP = True
+except ImportError:
+    HAVE_CAPNP = False
+
+
+class QuantumProofTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 1
+        self.setup_clean_chain = True
+        # Verify proofs against a NUMS point whose discrete log we know.
+        self.extra_args = [["-test=fakenums"]]
+
+    def setup_nodes(self):
+        # Bind the IPC socket so we can also demonstrate the proof flowing through
+        # the Mining IPC, when both IPC and python capnp are available.
+        self.ipc = self.is_ipc_compiled() and HAVE_CAPNP
+        if self.ipc:
+            self.extra_init = [{"ipcbind": True}]
+        super().setup_nodes()
+        if self.ipc:
+            self.capnp_modules = load_capnp_modules(self.config)
+
+    def simulate_theft(self):
+        """Carry out the theft on-chain and return (proof, expected_op_return_spk)."""
+        node = self.nodes[0]
+
+        self.log.info("Victim creates a script-path-only Taproot output with NUMS internal key")
+        # A throwaway script leaf so the output commits to a non-empty merkle
+        # root; its key is irrelevant because the coin is taken via the key path.
+        decoy_key, _ = compute_xonly_pubkey(hashlib.sha256(b"victim decoy leaf").digest())
+        leaf_script = CScript([decoy_key, OP_CHECKSIG])
+        tap = taproot_construct(FAKE_NUMS_XONLY, [("decoy", leaf_script)])
+        tweak = tap.tweak  # the scalar a = hash_TapTweak(N_x || merkle_root)
+
+        amount = 50 * COIN // 100  # 0.5 BTC
+        victim_utxo = self.wallet.send_to(from_node=node, scriptPubKey=tap.scriptPubKey, amount=amount)
+        self.generate(self.wallet, 1)
+        self.log.info(f"Victim output P = {tap.output_pubkey.hex()} funded in {victim_utxo['txid']}")
+
+        self.log.info("Quantum thief key-path spends the victim output")
+        thief = MiniWallet(node)
+        theft = CTransaction()
+        theft.version = 2
+        theft.vin = [CTxIn(COutPoint(int(victim_utxo["txid"], 16), victim_utxo["sent_vout"]))]
+        theft.vout = [CTxOut(amount - 1000, thief.get_output_script())]
+        theft.wit.vtxinwit = [CTxInWitness()]
+
+        # The spent output, needed for the BIP-341 sighash.
+        spent_outputs = [CTxOut(amount, tap.scriptPubKey)]
+        # m: the message the thief signs (the Taproot key-path sighash).
+        msg = TaprootSignatureHash(theft, spent_outputs, hash_type=0, input_index=0)
+        # The thief, having "broken ECDL", derives dlog(P) = dlog(N) + a and signs.
+        output_seckey = tweak_add_privkey(FAKE_NUMS_SECKEY, tweak)
+        sig = sign_schnorr(output_seckey, msg)  # (R || s)
+        theft.wit.vtxinwit[0].scriptWitness.stack = [sig]
+
+        # The theft is a valid spend: the network accepts and mines it.
+        node.sendrawtransaction(theft.serialize().hex())
+        self.generate(self.wallet, 1)
+        assert_equal(node.getmempoolinfo()["size"], 0)
+        self.log.info(f"Coins stolen in {theft.txid_hex}")
+
+        # a is public (anyone who knows the address construction can recompute
+        # it); (R, s) is read off the thief's witness; m is the sighash.
+        proof = make_proof(tweak, sig, msg)
+        expected_spk = CScript([OP_RETURN, proof])
+        return proof, expected_spk
+
+    def check_proof_crypto(self, proof):
+        self.log.info("Assemble the aRsm proof from public data and verify it (in Python)")
+        assert_equal(len(proof), 128)
+        split_proof(proof)
+        # The proof verifies against our (fake) NUMS point: it demonstrates
+        # knowledge of dlog(N), i.e. that ECDL was broken.
+        assert verify_proof(proof, nums=FAKE_NUMS_XONLY)
+        # A tampered proof, or one checked against a different NUMS point, fails.
+        bad = bytearray(proof)
+        bad[80] ^= 1
+        assert not verify_proof(bytes(bad), nums=FAKE_NUMS_XONLY)
+        assert not verify_proof(proof, nums=NUMS_H)
+        assert not verify_proof(proof[:-1], nums=FAKE_NUMS_XONLY)
+
+    def coinbase_outputs(self, blockhash):
+        """Return the list of coinbase scriptPubKey hexes for a block."""
+        block = self.nodes[0].getblock(blockhash, 2)
+        return [out["scriptPubKey"]["hex"] for out in block["tx"][0]["vout"]]
+
+    def quantum_deployment(self):
+        return self.nodes[0].getdeploymentinfo()["deployments"]["quantum"]
+
+    def check_ipc_coinbase(self, expected_spk):
+        """A mining client driving the node over IPC must include the proof OP_RETURN."""
+        if not self.ipc:
+            self.log.info("IPC unavailable; skipping the Mining IPC coinbase check")
+            return
+        self.log.info("The Mining IPC getCoinbaseTx() lists the proof as a required output")
+
+        async def async_routine():
+            ctx, mining = await make_mining_ctx(self)
+            opts = self.capnp_modules['mining'].BlockCreateOptions()
+            async with destroying((await mining.createNewBlock(ctx, opts)).result, ctx) as template:
+                coinbase_res = await mining_get_coinbase_tx(template, ctx)
+                scripts = []
+                for output_data in coinbase_res.requiredOutputs:
+                    out = CTxOut()
+                    out.deserialize(BytesIO(output_data))
+                    scripts.append(bytes(out.scriptPubKey))
+                assert bytes(expected_spk) in scripts, "IPC coinbase should require the proof OP_RETURN"
+
+        asyncio.run(capnp.run(async_routine()))
+
+    def run_test(self):
+        node = self.nodes[0]
+        self.wallet = MiniWallet(node)
+        self.generate(self.wallet, 101)  # mature a coinbase to fund the victim
+
+        proof, expected_spk = self.simulate_theft()
+        self.check_proof_crypto(proof)
+
+        self.log.info("Before any proof is submitted, the node holds none and is inactive")
+        assert_equal(node.getquantumproof(), {"active": False})
+
+        self.log.info("A block mined before any proof is submitted has no proof OP_RETURN")
+        pre_hash = self.generate(self.wallet, 1)[0]
+        assert expected_spk.hex() not in self.coinbase_outputs(pre_hash)
+
+        self.log.info("A bogus proof is rejected by submitquantumproof and not stored")
+        bogus = (b"\x00" * 96) + proof[96:]  # invalid signature, real message
+        assert_equal(node.submitquantumproof(bogus.hex()), {"valid": False, "stored": False})
+        assert_equal(node.getquantumproof(), {"active": False})
+
+        self.log.info("The real proof is accepted and stored; a second proof is ignored")
+        assert_equal(node.submitquantumproof(proof.hex()), {"valid": True, "stored": True})
+        # Re-submitting verifies but is not stored again (we already hold one).
+        assert_equal(node.submitquantumproof(proof.hex()), {"valid": True, "stored": False})
+        assert_equal(node.getquantumproof(), {"proof": proof.hex(), "active": False})
+
+        # Before activation, a mining client building the coinbase over IPC sees
+        # the proof among the required outputs.
+        self.check_ipc_coinbase(expected_spk)
+
+        self.log.info("The next mined block carries the proof and activates the tripwire")
+        activating_hash = self.generate(self.wallet, 1)[0]
+        assert expected_spk.hex() in self.coinbase_outputs(activating_hash)
+        activation_height = node.getblock(activating_hash)["height"] + 1
+        assert_equal(node.getquantumproof(), {"proof": proof.hex(), "active": True, "activation_height": activation_height})
+        # The tripwire is reported as an active "quantum" deployment.
+        assert_equal(self.quantum_deployment(), {"type": "tripwire", "height": activation_height, "active": True})
+
+        self.log.info("After activation, later blocks no longer carry the proof OP_RETURN")
+        post_hash = self.generate(self.wallet, 1)[0]
+        assert expected_spk.hex() not in self.coinbase_outputs(post_hash)
+
+        self.log.info("After activation, further proofs are ignored")
+        assert_equal(node.submitquantumproof(proof.hex()), {"valid": True, "stored": False})
+
+        self.log.info("Activation persists across a restart (restored from the activation file)")
+        self.restart_node(0, extra_args=["-test=fakenums"])
+        assert_equal(node.getquantumproof(), {"proof": proof.hex(), "active": True, "activation_height": activation_height})
+        assert_equal(self.quantum_deployment()["active"], True)
+
+        self.log.info("Reorging a block mined *after* activation does not deactivate the tripwire")
+        _, later_hash = self.generate(self.wallet, 2)
+        node.invalidateblock(later_hash)  # rolls back a non-activation block
+        # The store tracks activation via the (asynchronous) validation interface,
+        # so drain its queue before reading the tripwire state back.
+        node.syncwithvalidationinterfacequeue()
+        assert_equal(node.getquantumproof()["active"], True)
+        node.reconsiderblock(later_hash)
+
+        self.log.info("Reorging the activation block itself deactivates the tripwire")
+        node.invalidateblock(activating_hash)
+        node.syncwithvalidationinterfacequeue()
+        assert_equal(node.getquantumproof()["active"], False)
+        node.reconsiderblock(activating_hash)  # reconnecting re-activates it
+        node.syncwithvalidationinterfacequeue()
+        assert_equal(node.getquantumproof()["active"], True)
+
+        self.log.info("A bogus activation file is rejected at startup")
+        self.stop_node(0)
+        # Garbage that doesn't reference a real block with a merkle-committed,
+        # proof-bearing coinbase, as broken/malicious software might write.
+        (node.chain_path / "quantum_tripwire.dat").write_bytes(b"\x00" * 64)
+        self.start_node(0, extra_args=["-test=fakenums"])
+        assert_equal(node.getquantumproof(), {"active": False})
+
+        self.log.info("Quantum theft simulated; proof published once and tripwire activated instantly")
+
+
+if __name__ == '__main__':
+    QuantumProofTest(__file__).main()
diff --git a/test/functional/p2p_quantum_proof.py b/test/functional/p2p_quantum_proof.py
new file mode 100755
index 000000000000..c3b3d19e90be
--- /dev/null
+++ b/test/functional/p2p_quantum_proof.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Relay of "aRsm" ECDL-break (quantum tripwire) proofs over the p2p network.
+
+A peer sends QPROOF messages. The node:
+  - ignores a malformed (wrong size) proof,
+  - ignores a bogus proof whose signature does not verify,
+  - stores the first valid proof and publishes it as a single coinbase OP_RETURN
+    in the next block, instantly activating the "quantum" deployment,
+  - ignores any further proofs received over p2p once one is held.
+
+It also relays a proof submitted locally via submitquantumproof to its peers --
+even when a proof is already held -- whereas the p2p path stops at the first.
+
+See test_framework/quantum.py for the cryptographic background, and
+feature_quantum_proof.py for the on-chain theft scenario that produces such a
+proof in the wild. Here valid proofs are constructed synthetically (we know the
+discrete log of the fake NUMS point the node uses under -test=fakenums).
+"""
+import hashlib
+
+from test_framework.messages import msg_qproof
+from test_framework.p2p import (
+    P2PInterface,
+    p2p_lock,
+)
+from test_framework.quantum import (
+    FAKE_NUMS_SECKEY,
+    FAKE_NUMS_XONLY,
+    build_proof,
+    verify_proof,
+)
+from test_framework.script import CScript, OP_RETURN
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import assert_equal
+from test_framework.wallet import MiniWallet
+
+
+class QuantumProofP2PTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.num_nodes = 1
+        self.setup_clean_chain = True
+        # Verify proofs against the fake NUMS point we can sign for.
+        self.extra_args = [["-test=fakenums"]]
+
+    def coinbase_outputs(self, blockhash):
+        block = self.nodes[0].getblock(blockhash, 2)
+        return [out["scriptPubKey"]["hex"] for out in block["tx"][0]["vout"]]
+
+    def make_valid_proof(self, salt):
+        tweak = hashlib.sha256(b"p2p quantum proof tweak" + salt).digest()
+        msg = hashlib.sha256(b"p2p quantum proof message" + salt).digest()
+        proof = build_proof(FAKE_NUMS_SECKEY, tweak, msg)
+        assert verify_proof(proof, nums=FAKE_NUMS_XONLY)
+        return proof
+
+    def run_test(self):
+        node = self.nodes[0]
+        self.wallet = MiniWallet(node)
+
+        proof = self.make_valid_proof(b"1")
+        expected_spk = CScript([OP_RETURN, proof]).hex()
+        peer = node.add_p2p_connection(P2PInterface())
+
+        self.log.info("A malformed (wrong-size) qproof is ignored")
+        peer.send_and_ping(msg_qproof(proof[:-1]))
+        assert_equal(node.getquantumproof(), {"active": False})
+
+        self.log.info("A bogus qproof (signature does not verify) is ignored")
+        bogus = bytearray(proof)
+        bogus[64] ^= 1  # corrupt s
+        assert not verify_proof(bytes(bogus), nums=FAKE_NUMS_XONLY)
+        peer.send_and_ping(msg_qproof(bytes(bogus)))
+        assert_equal(node.getquantumproof(), {"active": False})
+
+        self.log.info("A block mined while only fakes were seen has no proof OP_RETURN")
+        pre_hash = self.generate(self.wallet, 1)[0]
+        assert expected_spk not in self.coinbase_outputs(pre_hash)
+
+        self.log.info("A valid qproof received over p2p is stored")
+        peer.send_and_ping(msg_qproof(proof))
+        self.wait_until(lambda: node.getquantumproof().get("proof") == proof.hex())
+
+        self.log.info("submitquantumproof relays to peers even when a proof is already held")
+        with p2p_lock:
+            peer.last_message.pop("qproof", None)
+        assert_equal(node.submitquantumproof(proof.hex()), {"valid": True, "stored": False})
+        peer.wait_until(lambda: "qproof" in peer.last_message)
+        with p2p_lock:
+            assert_equal(peer.last_message["qproof"].proof, proof)
+
+        self.log.info("A different valid proof received over p2p is ignored while one is held")
+        peer.send_and_ping(msg_qproof(self.make_valid_proof(b"2")))
+        assert_equal(node.getquantumproof().get("proof"), proof.hex())
+
+        self.log.info("The next mined block carries the relayed proof and activates the tripwire")
+        activating_hash = self.generate(self.wallet, 1)[0]
+        assert expected_spk in self.coinbase_outputs(activating_hash)
+        assert_equal(node.getdeploymentinfo()["deployments"]["quantum"]["active"], True)
+
+        self.log.info("After activation, later blocks no longer carry the proof OP_RETURN")
+        peer.send_and_ping(msg_qproof(self.make_valid_proof(b"3")))
+        post_hash = self.generate(self.wallet, 1)[0]
+        assert expected_spk not in self.coinbase_outputs(post_hash)
+
+        self.log.info("Fakes ignored; first valid proof relayed, published once, tripwire activated")
+
+
+if __name__ == '__main__':
+    QuantumProofP2PTest(__file__).main()
diff --git a/test/functional/rpc_blockchain.py b/test/functional/rpc_blockchain.py
index d731907fd8ca..afe9aafc060b 100755
--- a/test/functional/rpc_blockchain.py
+++ b/test/functional/rpc_blockchain.py
@@ -244,6 +244,7 @@ def check_signalling_deploymentinfo_result(self, gdi_result, height, blockhash,
                 },
                 'active': False
             },
+            'quantum': {'type': 'tripwire', 'active': False},
           }
         })
 
diff --git a/test/functional/test_framework/messages.py b/test/functional/test_framework/messages.py
index 07abd5b6eb09..7e84ace2b131 100755
--- a/test/functional/test_framework/messages.py
+++ b/test/functional/test_framework/messages.py
@@ -1950,6 +1950,24 @@ def __repr__(self):
         return f"msg_feature(feature_id={self.feature_id}, data={self.feature_data.hex()})"
 
 
+class msg_qproof:
+    """QPROOF message relaying a 128-byte aRsm ECDL-break (quantum tripwire) proof."""
+    __slots__ = ("proof",)
+    msgtype = b"qproof"
+
+    def __init__(self, proof=b""):
+        self.proof = proof
+
+    def deserialize(self, f):
+        self.proof = deser_string(f)
+
+    def serialize(self):
+        return ser_string(self.proof)
+
+    def __repr__(self):
+        return f"msg_qproof(proof={self.proof.hex()})"
+
+
 class TestFrameworkScript(unittest.TestCase):
     def test_addrv2_encode_decode(self):
         def check_addrv2(ip, net):
diff --git a/test/functional/test_framework/p2p.py b/test/functional/test_framework/p2p.py
index 803194791bfa..e58bda149f9e 100755
--- a/test/functional/test_framework/p2p.py
+++ b/test/functional/test_framework/p2p.py
@@ -63,6 +63,7 @@
     msg_notfound,
     msg_ping,
     msg_pong,
+    msg_qproof,
     msg_sendaddrv2,
     msg_sendcmpct,
     msg_sendheaders,
@@ -146,6 +147,7 @@
     b"notfound": msg_notfound,
     b"ping": msg_ping,
     b"pong": msg_pong,
+    b"qproof": msg_qproof,
     b"sendaddrv2": msg_sendaddrv2,
     b"sendcmpct": msg_sendcmpct,
     b"sendheaders": msg_sendheaders,
@@ -561,6 +563,7 @@ def on_mempool(self, message): pass
     def on_merkleblock(self, message): pass
     def on_notfound(self, message): pass
     def on_pong(self, message): pass
+    def on_qproof(self, message): pass
     def on_sendaddrv2(self, message): pass
     def on_sendcmpct(self, message): pass
     def on_sendheaders(self, message): pass
diff --git a/test/functional/test_framework/quantum.py b/test/functional/test_framework/quantum.py
new file mode 100644
index 000000000000..390098a0e63b
--- /dev/null
+++ b/test/functional/test_framework/quantum.py
@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+# Copyright (c) 2026 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+"""Helpers for the "aRsm" ECDL-break proof (the quantum tripwire).
+
+Concept (Anthony Towns' variant, bitcoindev thread
+https://gnusha.org/pi/bitcoindev/aj9SkwXqdRbuVZxH@erisian.com.au/):
+
+  N           the BIP-341 NUMS ("Nothing Up My Sleeve") point, as an x-only
+              pubkey. Because its x-coordinate falls out of a hash, nobody is
+              supposed to know its discrete log.
+  a           a scalar; in practice the BIP-341 Taproot tweak
+                  a = hash_TapTweak(N_x || merkle_root)
+              which the output's owner knows because it is a hash of public
+              data (the internal key and the script tree).
+  P = N + a*G the Taproot output key that appears (x-only) in the scriptPubKey.
+  (R, s)      a BIP-340 Schnorr signature on a 32-byte message m, valid under P.
+
+The 128-byte proof is the concatenation a || R || s || m. It is verified by
+recomputing P = N + a*G and checking that (R, s) is a valid BIP-340 signature
+of m under P. A valid signature can only be produced by someone who knows
+dlog(P) = dlog(N) + a; since a is revealed in the proof, that is equivalent to
+knowing dlog(N), which is only possible by breaking the elliptic-curve discrete
+log problem (ECDL) on secp256k1.
+
+In a real deployment the verifier uses the real BIP-341 NUMS point as N (see
+NUMS_H below), whose discrete log is unknown. Tests substitute a *fake* NUMS
+point whose discrete log is known, so an actual theft can be simulated and the
+resulting proof made to verify end to end.
+"""
+import hashlib
+
+from .key import (
+    H_POINT,
+    compute_xonly_pubkey,
+    sign_schnorr,
+    tweak_add_privkey,
+    tweak_add_pubkey,
+    verify_schnorr,
+)
+
+# The real BIP-341 NUMS point (x-only). In production this is the N the verifier
+# uses; its discrete log is unknown to anyone.
+NUMS_H = bytes.fromhex(H_POINT)
+
+# A fake NUMS point whose discrete log we know, for tests. It stands in for the
+# real NUMS point N so a theft -- and therefore a verifying proof -- can be
+# simulated end to end. Tests start the node with -quantumnums=FAKE_NUMS_XONLY.
+FAKE_NUMS_SECKEY = hashlib.sha256(b"bitcoin-quantum fake NUMS point").digest()
+FAKE_NUMS_XONLY, _ = compute_xonly_pubkey(FAKE_NUMS_SECKEY)
+assert FAKE_NUMS_XONLY != NUMS_H
+
+# Byte layout of a serialized proof: a (32) || R (32) || s (32) || m (32).
+PROOF_SIZE = 128
+
+
+def make_proof(tweak, sig, msg):
+    """Assemble a 128-byte aRsm proof from its parts.
+
+    tweak: the 32-byte scalar a
+    sig:   the 64-byte BIP-340 signature (R || s)
+    msg:   the 32-byte message m that was signed
+    """
+    assert len(tweak) == 32
+    assert len(sig) == 64
+    assert len(msg) == 32
+    return tweak + sig + msg
+
+
+def split_proof(proof):
+    """Split a 128-byte aRsm proof into (a, R, s, m)."""
+    assert len(proof) == PROOF_SIZE
+    return proof[0:32], proof[32:64], proof[64:96], proof[96:128]
+
+
+def build_proof(nums_seckey, tweak, msg):
+    """Construct a valid aRsm proof, simulating a quantum attacker.
+
+    Signs `msg` under the output key P = N + tweak*G, where N = nums_seckey*G is
+    the (fake) NUMS point whose discrete log nums_seckey we know. The result
+    verifies via verify_proof() against the x-only form of N.
+    """
+    assert len(tweak) == 32
+    assert len(msg) == 32
+    output_seckey = tweak_add_privkey(nums_seckey, tweak)
+    sig = sign_schnorr(output_seckey, msg)
+    return make_proof(tweak, sig, msg)
+
+
+def verify_proof(proof, nums=NUMS_H):
+    """Return True if `proof` is a valid aRsm ECDL-break proof for NUMS point `nums`.
+
+    This mirrors the verification the node performs: recompute P = N + a*G and
+    check that (R, s) is a valid BIP-340 signature of m under P.
+    """
+    if len(proof) != PROOF_SIZE:
+        return False
+    a, R, s, m = split_proof(proof)
+    res = tweak_add_pubkey(nums, a)  # P = N + a*G, returned x-only
+    if res is None:
+        return False
+    p_xonly, _ = res
+    return verify_schnorr(p_xonly, R + s, m)
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 5bfc7d86239b..b3da466a3319 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -103,6 +103,8 @@
     # vv Tests less than 5m vv
     'feature_fee_estimation.py',
     'feature_taproot.py',
+    'feature_quantum_proof.py',
+    'p2p_quantum_proof.py',
     'feature_block.py',
     'mempool_ephemeral_dust.py',
     'wallet_conflicts.py',