Replay surfaces that the box model hides

P2PKH replay, when a pre fork output reopens the box

Updated 6 October 2026

That is a P2PKH replay, where a spent pre segwit output is re signed against Bitcoin using a key that was first used on another chain. It is not a quantum disclosure, and it is not a watch only leak. The Bitcoin box stays closed in the UTXO set, but the key that opened it is now public, and a second box on another chain has already been emptied by the same signature.

What P2PKH replay actually does

Pay to public key hash outputs predate segwit. They commit only to a hash of the public key, not the key itself, so the key only appears on chain at spend time. That single property is what every replay tool exploits: once a P2PKH input is spent on chain A, the signature, the public key, and the signature script are all visible. Any other chain that uses the same secp256k1 curve and the same address format can validate that signature and produce its own valid spend. Bitcoin Cash, Bitcoin SV, and a long list of forks that copied the original client in 2017 all carried this property forward, and several side chains still do.

The replay in this sense is not the 2016 Ethereum DAO style replay, where two competing chains shared a transaction format and an attacker could rebroadcast the same bytes on both. The mechanism here is closer to key reuse. The attacker does not rebroadcast a raw Bitcoin transaction. They re sign a new transaction on the target chain using the same secp256k1 private key that just opened the Bitcoin box. To the second chain, the spend looks ordinary, because it is.

This is why the box metaphor on its own is misleading. A closed box is a useful image for an unspent output. A P2PKH output that has been spent no longer exists in the UTXO set, so the box is gone. The key, however, was the thing that opened the box, and it remains usable on every other chain that accepts the same curve. The closed box image implies the key is sealed inside, and that is exactly backwards once the output has been spent.

Why the disclosure only happens at spend

P2PKH hides the public key behind a hash until the first spend. The output script is OP_DUP OP_HASH160, followed by the twenty byte hash, OP_EQUALVERIFY, OP_CHECKSIG. The public key only enters the witness or scriptSig when the owner signs. From that point on, the key is part of the permanent record, and any third party that parses the spending transaction can extract it.

This is the asymmetry the box metaphor actually captures. Before the spend, the box is closed and the public key is not on chain. After the spend, the box is gone, the public key is public, and the same key can be tested against any other chain that uses the same curve. Watch only wallets have been making this point for a decade: a P2PKH address exposes nothing until it spends, and that is the design.

Quantum discussions lean on the same property. A closed P2PKH box is, in the language of BIP 360, an output that is still quantum safe in the narrow sense that the public key has not been revealed. The moment it spends, that protection drops. Replay does not change that. It just adds a second chain to the list of places the same key can be tried.

How a relayer turns one spend into two

Relayer services that bridge coins between forks have been running since 2017. The honest ones split the key and rotate. The dishonest ones, and the careless ones, take a signed P2PKH spend on chain A, extract the public key from the script, and offer to broadcast a corresponding spend on chain B in return for the funds. From the user's point of view, the transaction looks like a normal cross chain move. From the chain's point of view, it is a normal signature on a normal input.

The risk is concentrated at exactly the addresses that most people treat as low risk. A long term cold storage address that has never spent is, in box terms, a sealed box with the key kept offline. If that address is P2PKH, and the owner ever spends from it on a fork chain without rotating the key, the key is now public on both chains. Replay can drain the fork chain even if the Bitcoin box itself is long gone.

This is the angle that the box model hides. Watch only tools show a closed box, and that is correct for the UTXO set. They do not show whether the same key has been used elsewhere, and that is where the actual exposure lives. The 2026 disclosure climate has only made this worse: more chains publish more historical transaction data, more indexers cache the public keys, and more relayers treat the key as fair game.

P2PKH versus P2WPKH in the same situation

Segwit v0, P2WPKH, moved the public key into the witness and committed to it in the output. The key is still only public at spend time, so the same replay risk applies in theory. The practical difference is that most modern chains that copied Bitcoin copied the legacy address format, not the bech32 format, and the relayer ecosystem around bech32 is much smaller. A P2WPKH spend is harder to replay because fewer chains accept the same witness program.

Taproot, P2TR, makes the situation stranger. A taproot key path spend reveals an internal key, but the script tree is not exposed. Some forks have copied taproot, and some have not. Where taproot is not supported, a taproot key cannot be replayed at all, because the target chain has no script to validate against. Where taproot is supported, the key path is replayable in the same way P2PKH was, with the added twist that the internal key may have been tweaked with a hidden script branch.

For a custody decision, the takeaway is narrow. A P2PKH address that has spent on any chain is no longer a closed box anywhere that uses the same curve. A P2WPKH address is in the same position on chains that copied segwit. A taproot address depends on the fork. None of this is changed by quantum, by BIP 360, or by the post quantum migration deadlines. The key left the box the first time it was used to sign.

What the box metaphor still gets right

The closed box is still a good image for an unspent output whose key has never signed. It captures the asymmetry between an address and the key behind it. It captures the difference between watch only, which is a window onto the box, and ownership, which is the key. It captures the failure mode of BIP 39 seeds that get pasted into online tools, and the failure mode of air gapped devices that get reconnected to load a transaction. None of those failure modes are about replay.

Replay is the case where the box metaphor quietly fails. A spent P2PKH output is no longer a box, and the key is no longer sealed. The fact that the address still appears in a watch only wallet, with a zero balance, is true, and it is also beside the point. The address is not the exposure. The key is. Replay tools have known this since 2018, and the relayer market has treated it as a service ever since.

For 2026, the practical guidance is the same as it was in 2019. Do not reuse keys across chains. Do not sign on a fork with a key that still secures value on Bitcoin. Treat any address that has ever spent as a public key, and route future funds through addresses that derive from a fresh key. The box metaphor can carry that advice, but only if the writer remembers to mark the box as spent.