Quantum runway, BIP 360, frozen vaults

Frozen quantum vaults: why BIP 360's clock beats the runway

Updated 6 October 2026

That is a frozen quantum vault. It is not a stale paper wallet you can sweep on a Tuesday.

The box that stopped aging in 2012

Most bitcoin custody debates stay abstract because the boxes in question are still being born. Every new output type lands in a state that is, on paper, quantum-exposed from block one. P2PKH, the original pay-to-pubkey-hash construction, sits in the opposite corner. An address of that kind was hashed at creation, so only the hash was public until spend. From a quantum attacker's perspective the address looked like a sealed envelope. The pubkey sat behind the hash until a transaction broadcast it.

What changed between 2012 and 2016 is that the ecosystem stopped sending to bare P2PKH. A spender has to reveal the full secp256k1 public key inside the witness or scriptSig, and a sophisticated chain observer can fingerprint those reveals. By 2026 the obvious assumption is that every still-unspent P2PKH box has had its pubkey exposed in some form, whether by partial address reuse, by an early sweep that did not complete, or by forensic work on related clusters.

CatBitcoin's working rule, restated for October: a pre-SegWit output whose script type has not changed since activation and which has not seen a successful spend in the same wallet lineage is, for runway arithmetic, as exposed as a bare P2PK. That is the population that crossed the BIP 360 grace threshold on 4 October 2026.

Why the BIP 360 clock beats the runway

The runway, in CatBitcoin's vocabulary, is the dollar value of bitcoin sitting in quantum-vulnerable script types, plotted against the shrinking time horizon before a cryptographically relevant quantum computer can break secp256k1 in wall-clock hours. The number on the counter is the coin side of the problem. The BIP 360 clock is the protocol side. It ticks even when the market does not.

BIP 360 proposes, in its current draft, a grace window during which existing vulnerable outputs can be migrated to post-quantum commitments without invalidating the chain. After that window, certain script paths become non-standard, and a hard consensus rule eventually retires them. The exact dates have been moved twice during 2025 and 2026 as the working group reconciled the wishes of custody maximalists, miners, and the small but loud group that believes frozen coins are a feature, not a bug.

The October 4 crossing is not a new rule. It is the activation of the second phase of the original 2024 timeline, in which outputs whose public key has been broadcast for more than ten years lose the soft migration path and must move to a post-quantum commitment during a spend. The runway number may be, on the day you read this, slightly higher or slightly lower than the USD 7.4 billion the counter showed at the end of September. The clock does not care about the counter. The clock says that a certain class of box is now in its last spend window before a fork or a sunset clause takes the soft path away.

That is the part that the runway headlines miss. The runway is a probabilistic estimate of a future event. The BIP 360 clock is a deterministic date. Probabilistic estimates can be revised. Deterministic dates arrive on a Tuesday.

What a frozen vault actually looks like on chain

Walk the chain with CatBitcoin's vulnerability scanner and the frozen cluster stands out. The output values cluster at two scales. There is a long tail of sub-1 BTC outputs, almost all of them miner rewards from 2009 and 2010 that were never moved. And there is a thinner tail of larger outputs, several above 1,000 BTC, that sit in P2PKH scripts associated with services that went offline in 2014 and 2015. The mid range, the 1 to 100 BTC band, is sparser than the headlines suggest. Most of the action is at the extremes.

The reason matters for anyone thinking about migrating the box. A 2010 coinbase output was created with a fresh secp256k1 keypair whose public key is, today, recoverable from the script bytes. The associated address is a hash of that key, but the key itself is a constant of the chain. There is no rotation story. The only way to move those coins before a CRQC is to find the private key, sign a transaction, and broadcast it on a path that the BIP 360 grace window still permits. If the key is lost, the box is a one-way donation to the first entity that builds a CRQC.

The service-era boxes are a different story. Some of them were custodied by exchanges that failed and whose estate documents were never reconciled with on chain holdings. Others belonged to mining pools that shut down without publishing their sweep procedures. A non-trivial fraction of the 2026 frozen cluster has an identifiable corporate ancestor and a private key that almost certainly still exists in some safe, in some jurisdiction, in some filing cabinet. Those boxes are not lost. They are abandoned. The legal question of whether the abandonment can be cured by a CRQC is, as of October 2026, genuinely unsettled. The technical question is not. The technical question is whether the BIP 360 clock gives the legal system enough time to find its own answer.

The migration path that is closing

BIP 360's soft path, in the version that was live until 4 October 2026, allowed a vulnerable output to be spent to a post-quantum commitment by wrapping the spend in a special witness. The wrapping was inefficient, roughly doubling the witness size, and wallets had to opt in. Three wallet families did, in a limited form, and roughly USD 240 million of previously frozen value moved during the soft window. The remaining USD 7.4 billion did not.

After 4 October, the soft path is still in the consensus rules for one more transition phase, but the relay policy is tightened. Miners who have adopted the tightening will not include a soft-path spend unless the spend also satisfies a stricter set of conditions, including a commit to a specific post-quantum scheme. That is the engineering compromise: the soft path is not dead, but it is no longer free. Migrations now cost fee budget, and the boxes that most need migration are the ones whose owners have not been paying fee budget for over a decade.

CatBitcoin's read, as of the week of the clock crossing, is that the next twelve months will be defined by two pressures. The first is miner adoption of the relay tightening, which determines whether a soft-path spend still propagates. The second is estate recovery, which determines whether abandoned keys get found before a CRQC turns the boxes into prizes. Both pressures are tractable, and both are slower than the runway counter suggests. That is the part of the story the optimistic coverage tends to underweight.

What to do if you own one of these boxes

Start by checking the script type. If the address starts with 1, the box is a P2PKH. If it is a bare P2PK output, the address format is different but the analysis is the same. The scanner will tell you, for any address you load into a watch-only view, whether the script type is in the frozen cluster. Do not paste a seed into a watch-only field to do this. A watch-only wallet is a window. The key stays in your cold device. The CatBitcoin cold storage rotation guide walks the air-gapped signing flow for boxes that are about to cross a grace threshold.

If the key is in your hand, the migration is mechanical. Build a transaction that spends the frozen output to a fresh post-quantum commitment, sign it on an air-gapped device, broadcast through a watch-only relay, and confirm inclusion. The fee budget, in October 2026 fee markets, is non-trivial for the larger boxes, and the witness size penalty for the soft path is real. Plan accordingly. If the key is in a safe somewhere, the migration is a custody problem that looks a lot like a normal estate recovery, with one extra variable. The clock.

If the key is genuinely lost, the honest answer is the box becomes a quantum bounty. There is no BIP 360 path that mints a replacement, and there is no covenant that lets the network recognise abandonment before a CRQC. The coins will sit where they have always sat, and a future actor with a CRQC will sweep them. That outcome is contested in policy circles. It is not contested in the consensus rules. Move the coins if you can. Accept the loss if you cannot.

Why this is not the same story as the 2017 replay

The SegWit replay debate of 2017 was a debate about whether a pre-fork transaction could be re-broadcast after a fork and have unintended effects on the new chain. The frozen-vault story of 2026 is not a replay debate. There is no fork in the BIP 360 plan. There is a grace window, and there is a relay policy. The boxes that crossed the 4 October threshold are still spendable, in consensus terms, for as long as the chain exists. The relay policy makes them expensive to spend, and the BIP 360 roadmap makes them more expensive with each phase.

The 2017 story was about actors who did not know they had exposure. The 2026 story is about actors who have had over a decade of runway and have not moved. Some of them cannot move, because the key is gone. Some of them will not move, because they think a CRQC is twenty years away. A small group, uncomfortably, are betting that a CRQC is near enough that they would rather hold the box and lose it to a quantum attacker than pay today's fee and surrender the optionality. That is a rational bet under one set of assumptions and a foolish bet under every other set. The BIP 360 clock is what the bet gets priced against.