Runway update

Quantum runway counter ticks past twelve billion

Updated 23 October 2026

That is a price tag. It is not a protocol change. The exposed-Bitcoin counter is a thermometer, and the number on the dial tells you how much of the legacy supply is still sitting behind a public key a quantum machine can factor. Crossing twelve billion does not move a single sat, and it does not move a single deadline. The dial ticks because coins do, and the box still does not open until someone spends it the old fashioned way or a sufficiently large fault tolerant machine is plugged into the mempool.

What the counter actually measures

The exposed-Bitcoin counter is a single number published by a small group of analysts who track the unspent outputs whose script reveals a public key. The script types that count are pay to public key, the early pay to public key hash outputs that have already been spent from, and any taproot outputs whose key path has been revealed through spending. The counter does not include hashed outputs that have never moved, because the hash is the only thing on chain until the spender broadcasts. The counter does not include script path only taproot, because no key is published unless the script path is exercised and even then the inner key can be hidden.

Twelve billion dollars is the rough mark to market value of those outputs as of this week. The number is a function of two variables. One is the price. The other is the rate at which old coins move. When the price climbs, the same UTXOs are worth more, and the counter rises even if no new key is exposed. When dormant coins move, exposed key supply drops because the spend commits a new output and the legacy key vanishes from the UTXO set. The dial moves in both directions and a clean reading requires watching both at once.

Crossing the line does not change the underlying cryptographic claim. The line is a financial description of attack surface, not a measure of attacker capability. A counter at twelve billion tells you that twelve billion dollars of satoshis are sitting behind a public key that a sufficiently large fault tolerant quantum computer could in principle invert. It does not tell you that such a machine exists, that one is close, or that one will land before the coins move.

That distinction is the whole story. The runway counter and the quantum capability counter are two separate dials. They share a unit of terror but not a unit of physics. A high runway number with a low capability number is a stockpile. A low runway number with a high capability number is a heist. A high number on both dials is the configuration the BIP-360 conversation is built around, and it is the configuration the counter is designed to warn about.

The counter crossed eleven billion in late summer, and it crossed twelve this week because of two effects layered on top of each other. The price rose. Old coins moved, and more of them moved into fresh hashed outputs than out of hashed outputs into the exposed bucket. Net effect: more dollars per exposed key, and a few percent more exposed keys per dollar. The runway narrowed on a key count basis, but widened on a dollar basis. Both are honest readings. They are just different rulers.

Why the dollar framing is misleading

An attacker who runs Shor against an exposed public key recovers a private key. The recovered key is binary. It is either useful for the address it came from, or it is not. A twelve billion dollar counter describes the value of the keys an attacker could in principle recover. It does not describe the value an attacker could actually steal, because stealing requires racing the legitimate signer, paying the fee, and broadcasting before the honest network sees the spend.

This race is the part the dollar framing hides. If the address is empty by the time the attacker broadcasts, the key is worthless regardless of what it was once worth. The counter rewards coins that stay put. It punishes holders who move into hashed outputs early, because the early mover reduces the exposed set and the late mover is counted as new exposure even when the move is to a safer place. The framing inverts the incentive. The safest behaviour for the individual is to migrate, and the safest behaviour for the network is for everyone to migrate, but the runway counter treats migration as neutral until the coin lands in a hashed output that never spends from a key path.

A cleaner reading would count the expected attacker revenue per unit of quantum capability, discounted by the probability the coin is still in the same address when the spend broadcasts. That number is much smaller than the headline, and it shrinks as holders move. The headline number is what gets cited because it is a clean number, and clean numbers travel.

This is not a complaint. The counter is a thermometer, and thermometers are useful exactly because they are blunt. The complaint is reserved for the press releases that treat the headline as a deadline, or as a budget for an attacker, or as a measure of how close the network is to broken. None of those framings survive a second look.

What the NIST finalisation actually changes

Earlier this month NIST closed out the third round of the post quantum signature competition with a small set of finalists, and the public drafts for module lattice and hash based schemes are now in their final comment window. The standardisation pipeline is the part of the quantum conversation that moves on a calendar, not on a counter. The runway number does not push that calendar. The calendar moves on its own.

For Bitcoin the relevant question is which of those schemes survives the soft fork conversation. The candidates that are friendly to segwit transaction size limits are the ones that will get a serious look. The candidates that blow up witness data by an order of magnitude will be considered, and probably parked. The hash based finalists have the cleanest story on conservatism. The lattice finalists have the cleanest story on signature size. Neither story is settled.

BIP-360 is the proposal that puts the conversation in concrete terms: a new output type, a migration path for legacy outputs, and a freeze for keys that are not migrated. The freeze is the part the runway counter makes urgent, because a freeze that lands after the counter has moved most exposed coins out of the set is a freeze that costs almost nothing, and a freeze that lands before is a freeze that confiscates. The window between now and standardisation is the negotiation window, and the counter is one of the inputs to that negotiation.

Crossing twelve billion does not by itself move the window. It does, however, change the temperature of the conversation. A counter below three billion is an easy conversation. A counter above ten billion is a hard one, because the confiscation bill is large enough to show up in the political economy of the network. Twelve billion is a hard conversation that has stopped being hypothetical.

What holders can actually do

The action item is the same one it has been for two years. If you control keys for an exposed output, move them into a fresh hashed output that you do not intend to spend from a key path. A pay to witness script hash output that locks to a single signature, and that you spend only by revealing a fresh taproot key path, is the cheapest insurance available. The migration costs a fee and a few minutes. The protection lasts until the coin moves, or until a quantum machine arrives, whichever is sooner.

If you do not control the keys, the box is not yours to move. The exposed output stays in the set until either the owner moves it, the coins are provably burned to fees, or the soft fork freezes the key. None of those are in your hands. The counter counts those coins regardless of who owns them, and the counter is honest about that.

Watch only tools show the script type and the balance. They do not move coins. They do not sign. A watch only field that asks for a seed, a passphrase, or a private key is not a watch only field, regardless of what the form says. Never paste a seed into a watch only field.

The counter is a useful prompt. It is not an action. The action is a transaction, and the transaction is yours to sign, or to leave unsigned. Crossing twelve billion is the counter telling you that the prompt has stopped being polite. It is now a warning, and the warning is the same one it has been since the runway first crossed one billion. Move what you can. Watch the rest. Wait for the fork.