When the address type decides how long the public key sits exposed

The p2pkh window narrows, while the mempool stays open

Updated 6 October 2026

That is a mempool window, not a locked box. It is not a fork decision that the holder can defer to 2035.

What hits the wire, when the box opens

A pay to pubkey hash output is built as a hash lock. The network only ever sees RIPEMD160(SHA256(pubkey)) until the spending transaction is broadcast. At spend, the witness carries a push of the full secp256k1 public key, an ECDSA signature, and a script. From the moment that transaction reaches a node, the public key is in cleartext, sitting in the mempool, waiting for confirmation. Anyone reading the mempool can take a copy and run Shor's algorithm against it. The size of that key on disk is thirty three bytes compressed, and the bytes are enough to seed a fault tolerant run on a cryptographically relevant machine.

A taproot key path spend, by contrast, spends along an aggregated x only key, and the witness carries a Schnorr signature rather than the public key in raw form. The x only key is implicitly known because the output committed to it, but the y coordinate is never revealed at spend. A Shor run on an x only point still recovers the secret, because the curve equation fixes the y parity, but the data the network carries is smaller and the indexing surface for a quantum attacker is narrower. A p2pkh spend, in plain language, hands the public key to every relay in cleartext, while a taproot key path spend hands the network a signature whose verification key is already known to be valid for the output. The mempool is still the soft underbelly, but p2pkh widens it.

The window also stretches because p2pkh change outputs are common. A wallet that mixes input types sends a p2pkh change output back to a fresh hash lock, so the mempool now carries both the spend and a new address whose spending conditions will only be revealed at a later broadcast. Each later broadcast reopens the window. The QRL Network tracker, in a snapshot dated 2 October 2026, lists around 1.74 million BTC at p2pkh or p2pk style outputs whose public keys are already exposed on chain through prior spends. The list grows roughly in step with legacy wallet usage, and the list is what a quantum attacker would index first. The mempool, by contrast, exposes keys in real time, and the live count there fluctuates by the hour.

Why fee choice does not close the gap

A natural reaction is to assume that a higher fee, one that confirms in the next block, removes the exposure. The numbers do not support that read. The Bitcoin network's median confirmation time on a busy day in October 2026 sits near 600 seconds for a high fee transaction, and a quantum attacker, given the right hardware, runs Shor against a single secp256k1 public key in a time window that is shrinking but still measured in days, not hours. The race is asymmetric. The attacker only needs to win once. The holder has to win every time, for every transaction, for the entire period the address type stays relevant.

The other natural reaction is to assume the attacker needs the full block. They do not. A quantum attacker listening to a mempool can take the public key, run a fault tolerant circuit against the discrete log problem on the secp256k1 group, and produce a candidate private key. They can then sign an alternative transaction that spends the same input to an address they control, and submit it with a higher fee. The race is then a small fee auction. A holder who underbid by a single satoshi per vbyte loses the box. The p2pkh holder, because their public key sits in cleartext, is the one most likely to find themselves bidding against their own coin.

Fee choice also cannot be planned. The wallet signs the moment the user clicks send, and the network accepts the signed transaction regardless of subsequent mempool churn. A quantum attacker with privileged mempool access through a mining pool, or with a peer node front running high value transactions, can submit a competing transaction before the holder's transaction is even visible to a non mining node. The defence against that is not fee engineering. The defence is to change address type, and that requires a migration step the holder has to take before the spend, not after.

What a holder can actually do, this quarter

The first move is to map the address mix. A watch only wallet, configured against a hardware signer, can list every UTXO by address type without exposing the seed. Sparrow, Electrum, and Nunchuk all support p2pkh filtering on a watch only descriptor. The list will almost always include change outputs the holder has forgotten about, because p2pkh wallets in 2017 to 2019 commonly defaulted to legacy change. The list is the audit.

The second move is to consolidate by sending the funds to a fresh segwit or taproot address. The consolidation transaction itself opens a brief mempool window, but the next spend, and every spend after, opens a narrower one. A consolidation that is fee bumped through a replace by fee cycle, or that is timed to a low mempool period, narrows the exposure further. The Catbitcoin QSB converter, in its 6 October 2026 build, shows the migration cost for the median p2pkh wallet at 0.4 percent of migrated value in fees, assuming a 2 sat per vbyte rate and 150 inputs.

The third move is to remove the seed from the watch only configuration as soon as the descriptor is loaded. A watch only wallet that imports an xpub or a descriptor never needs the seed, and any prompt that asks for a seed in a watch only context is a phishing surface. A hardware signer, used for the migration, never exports the seed. A seed typed into a watch only field is a seed compromised. The conversion step is not a shortcut, it is a custody change, and the custody change deserves the same care as a hardware wallet purchase.

The post quantum fork, and the half life of legacy outputs

BIP 360, in its current draft, freezes legacy output types at a deadline, with a recovery path that allows a hashed public key owner to claim funds after the freeze, using a post quantum signature alongside proof of knowledge of the legacy hash. The freeze is not the danger. The danger is the gap between BIP 360 activation, if it activates, and the date a holder migrates. The p2pkh holder who waits until 2027 to migrate is exposed to the mempool window for every intervening spend, and is exposed to the recovery path only if BIP 360 ships, which is not guaranteed. The Catbitcoin editorial line has been steady on this point. The migration is a custody decision that the holder makes, not a fork that the network makes on the holder's behalf.

The mempool also gives the network a second, less discussed half life. A p2pkh output that has never been spent has a hash, not a key, and the hash sits in the UTXO set, which is a different exposure surface. A p2pkh output whose public key was revealed on chain through a prior spend sits in the QRL index, and the index is rebuilt nightly by volunteers running the catbitcoin quantum indexer. The index, in October 2026, lists 1,743,219 BTC at p2pkh or p2pk style outputs with exposed keys, of which roughly 312,000 BTC sit at addresses whose coins have moved in the last twelve months. The latter number is the population that the mempool window actually affects, because the holder is still active, still spending, still feeding the public key into the relay graph. The migration thins that population, and the fork, if it lands, retires the rest.

What the next twelve months look like, on the current calendar

The NIST post quantum deadline, published as FIPS 203 and FIPS 204, took effect in 2024, and the deprecation timeline for classical algorithms in regulated contexts runs through 2030. Bitcoin sits outside that regulated track, but the supply chain does not. Hardware signer firmware in late 2026 ships with ML DSA and SLH DSA support on the verification side, and the signing side is gated behind a descriptor flag. A holder who buys a new hardware signer in 2026 gets the verification path for free. The signing path, the path that lets the holder create a post quantum spend, waits for BIP 360.

The mempool itself, in October 2026, has not changed. It still relays p2pkh spends with the public key in cleartext, and it still relays taproot key path spends with the signature in cleartext and the public key implicit. The two are not equivalent. A p2pkh spend, on the current relay graph, is the bigger target. A holder who treats that as a Q4 2026 housekeeping item, and consolidates the legacy UTXO set into a fresh taproot wallet, removes the widest window they have. The migration does not close every window. It closes the widest one, and the holder is left with the narrower set that BIP 360 is meant to retire. That is the trade, and the trade is the one a p2pkh holder has been deferring since 2018.