Custody mechanics, not market commentary
Quantum runway counter ticks past eight billion
Updated 6 October 2026
That is a counter that nobody wants to cross. It is not a kill switch, an emergency phone number, or a clock that fires on a particular date.
What the counter actually counts
The headline is arithmetic, not cryptography. Start with every bitcoin that sits behind a script which reveals the public key before the coins move. The classic P2PK outputs that Satoshi and a handful of cypherpunks mined in 2009 and 2010 qualify, because the script literally contains OP_CHECKSIG followed by an uncompressed public key, and the only thing protecting those coins is the discrete log problem between the key and a valid signature. Add every P2PKH address that has ever been reused, because the moment coins were sent back to that address the public key was already exposed on the chain, even though the address only ever showed a HASH160 fingerprint. Subtract the boxes that have been opened since the last tally. Multiply the remainder by the spot price. That is the runway counter, in dollars, and that is the figure that crossed eight billion dollars sometime in late September 2026.
The reason the figure drifts is partly thermodynamic and partly human. A higher bitcoin price inflates every box proportionally, so a flat distribution of exposed coins becomes a larger dollar number without anybody doing anything new. A wave of legacy wallet upgrades pulls the figure down, because each P2PKH reuse that migrates to a SegWit or Taproot address removes one box from the exposed set. Mining pools that consolidated payouts in 2010 and 2011 also matter, because the early coinbase outputs were P2PK and a single sweep can retire hundreds of thousands of bitcoins in a single transaction.
What the counter does not count is just as important. It does not count P2WPKH outputs that have only ever received and never spent, because the SegWit witness commits to a HASH160 and the public key only enters the witness when the owner signs. It does not count P2TR outputs spent through the key path, which is the most common case today, because the taproot output hides a tweaked Schnorr key behind a script commitment. It does not count any output that funds a multisig with fresh keys after the spenders rotated. The counter is a floor, not a ceiling, and the floor is the part of the UTXO set that quantum hardware can already target if a fault tolerant machine appears tomorrow morning.
Why tier 1 keeps slipping
Bitcoin Core's BIP 360 draft defines three tiers. Tier 1 is the count above: P2PK, reused P2PKH, and the BIP 13 pay to script hash outputs that have already published the underlying keys. Tier 2 is the long tail of P2PKH and P2WPKH addresses that have not been spent, plus the P2SH multisigs whose redeem scripts have already been exposed. Tier 3 is everything else, including every Taproot output and every fresh SegWit keypath spend. The runway counter on catbitcoin.com tracks tier 1 because tier 1 is the only tier that a quantum adversary can attack without first seeing a signature.
Tier 1 keeps slipping for a structural reason that has nothing to do with engineering. Roughly a million bitcoin sit in P2PK outputs from the first eighteen months of the network, and the owners of those boxes have not moved them because the coins are either lost, forgotten, or held in cold storage that the owner treats as a museum exhibit. Another large slice is held by exchanges and custodians who know about the exposure and have decided, reasonably, that the operational risk of a bulk migration outweighs the cryptographic risk of waiting one more quarter. Every time the price ticks up by ten percent, the same boxes become a larger number on the counter without anybody changing the underlying security model.
The honest version of the runway counter is therefore a measurement of social coordination, not of cryptographic progress. A meaningful reduction requires somebody to spend a P2PK box into a post quantum compatible address, pay a fee, and accept the small but non zero chance of a mistake. Until BIP 360 lands and gives those owners a destination that does not require a hard fork, the counter will drift upward with the price and downward only when an individual actor decides to act.
What eight billion dollars does and does not buy you
The temptation, when a number reaches this size, is to treat it as a target. The temptation is wrong. Eight billion dollars is the amount of bitcoin that an adversary with a sufficiently large fault tolerant quantum computer could, in principle, sweep from the legacy set. The cost of building and operating such a machine is unknown, but credible estimates place it well above the eight billion figure, and the engineering hurdles include error corrected qubits in the millions, a dilution refrigerator budget, and a multi year build. The counter is therefore a measure of the prize, not a measure of the attack.
The box metaphor helps here. Every coin on the counter sits behind a lock that a quantum computer can pick by reducing the public key to a private key and producing a valid signature. The lock is the same lock that protects every other bitcoin on the network, and the difference is only that the public key is already visible in the script. A quantum adversary does not need to break SHA 256. A quantum adversary does not need to break the hashing that protects SegWit addresses whose keys have never been published. A quantum adversary only needs to break the discrete log between a public key and a private key, and the public keys on tier 1 are already printed in the ledger.
That is also the reason the counter is not an emergency. An adversary who can break secp256k1 in 2026 can also break secp256k1 in 2027, and the network has not given the attacker a deadline. The attack is one transaction, broadcast to the mempool, and the only defence is to have already moved the coins. The runway is the time between now and the moment a cryptographically relevant machine exists, and the counter is the amount of value that runway is racing to clear. The two numbers are independent. The runway can be short and the counter can be small. The runway can be long and the counter can be large. Treating either number as a trigger is a category error.
How the counter is built, and how it slips
The script that produces the figure is short, auditable, and public. It iterates over every output in the UTXO set, classifies the script type, and asks two questions. First, does the script already commit to a public key that a quantum adversary could extract? Second, has the address, in the case of P2PKH, ever appeared as the recipient of a transaction whose input revealed a signature with the matching public key? If both answers are yes, the output joins the exposed set. The script then multiplies the value by the spot price from a public oracle and publishes the result.
The script has three known biases. It treats every P2PKH address that has been spent from as a candidate for the exposed set, even if the spend came from a different key. It treats every P2SH multisig as fully exposed, even if the redeem script contains a SegWit nested key that has never been published. It treats every coinbase output from the first eighteen months as P2PK, even when the miner used a compressed key in late 2010. The biases all push the counter upward, which means the eight billion figure is a ceiling rather than a floor, and the true exposed value is probably somewhere between six and eight billion dollars at the current price.
The counter also has a temporal component that the public dashboards sometimes hide. Every time a P2PK box is spent into a SegWit address, the counter drops by the value of that box. Every time a reused P2PKH address sends a consolidation transaction, the counter drops by the value of the consolidation. The largest known sweep in 2024 retired tens of thousands of early P2PK coins in a single transaction, and the counter fell by a meaningful amount. The next large sweep, if it happens, will be a similar event, and the only question is whether the owner chooses to migrate before or after BIP 360 ships.
What this means for the box you actually hold
If your coins sit behind a SegWit address that has never been spent, the eight billion dollar counter is not your problem. The counter is a measurement of somebody else's exposure, and the only way it becomes your problem is if you reuse an address after the first spend. If your coins sit behind a Taproot output that you have only spent through the key path, the counter is also not your problem. The taproot key is hidden behind a tweak and a script commitment, and a quantum adversary would have to recover the internal key, derive the tweak, and produce a valid Schnorr signature in the same block.
If your coins sit behind a P2PKH address that you used twice, the counter is a slow moving risk that you can retire in a single transaction. Move the balance to a fresh SegWit address, wait for a confirmation, and the original address joins the retired set. The fee is small. The operational risk is the usual operational risk of any bitcoin transaction, and it does not require a fork, a soft fork, or a new output type. The catch is that the move is itself a spend, and the spend reveals your public key on chain. A quantum adversary who already had your public key learns nothing new, and a quantum adversary who did not have your public key now has it. The net effect is positive, because the window between the move and the arrival of a cryptographically relevant machine is now open only on a future spend, and you can choose to make that future spend on a Taproot or post quantum output when BIP 360 lands.
If your coins sit behind a P2PK output that you mined in 2010, the counter is a faster moving risk, and the mitigation is the same. Spend the coins into a modern address, accept the fee, and accept that the coins will leave the tier 1 set. The reason this has not happened at scale is partly operational, partly legal, and partly a function of the holders being early adopters who treat the coins as historical artefacts. The runway counter is, in the end, a measure of how much of the early ledger is still on the early ledger, and the only way to reduce the number is for the holders of those coins to act.
What BIP 360 changes, and what it does not
BIP 360 introduces a new output type that commits to a post quantum public key, alongside a soft fork that allows existing outputs to migrate without invalidating the legacy chain. The proposal is the first time that Bitcoin has had a concrete, code reviewed plan for a quantum resistant address format, and the eight billion dollar counter is the figure that the plan is designed to retire. The soft fork does not force anybody to move. The soft fork only opens a destination, and the destination is a P2QRH output that commits to a SLH-DSA or Falcon signature key, depending on the final NIST guidance.
What the proposal does not do is change the economic incentives for legacy holders. A P2PK holder who does not move their coins before BIP 360 activates is in the same position after activation as before: the coins still sit behind a public key, and the holder still bears the quantum risk. The proposal does not, contrary to some early commentary, schedule a forced spend of legacy outputs. The frozen vault language in earlier drafts referred to a future hard fork that would, at some unspecified date, invalidate any output whose public key had not been moved, and that hard fork is not part of the current BIP 360 draft.
The runway counter, in this framing, is a forecast of the migration that BIP 360 enables. If the soft fork activates in 2027 and the migration takes three years, the counter will fall to a small fraction of its current value as the early P2PK boxes are finally retired. If the soft fork activates and the migration does not happen, the counter will continue to track the price. If the soft fork does not activate, the counter will continue to track the price and the legacy exposure. The counter is therefore a measure of the social coordination problem, not a measure of the cryptographic problem, and the solution is the same in every case: build the destination, and let the holders decide when to move.
Quick answers
- Does the counter crossing eight billion mean a quantum attack is imminent?
- No. The counter measures the dollar value of coins whose public keys are already on chain, and the figure rises and falls with the price. A quantum attack requires a fault tolerant machine that does not yet exist, and the cost of building one is still estimated to exceed the prize.
- Should I move my coins today because the counter crossed eight billion?
- Only if your coins sit behind a P2PK output or a P2PKH address you have already spent from. If your coins sit behind a fresh SegWit or Taproot address, the counter is not measuring your exposure, and a precautionary move would only add a fee without retiring any risk.
- Will BIP 360 force a move of legacy coins?
- No. The current draft opens a new output type and lets holders migrate voluntarily. The frozen vault language in earlier drafts referred to a much later hard fork that is not part of the present proposal.
- Why does the counter count reused P2PKH but not single use P2PKH?
- A P2PKH address only reveals a HASH160 until the first spend, and the public key enters the chain inside the witness. A reused P2PKH address reveals the public key on the first spend, and every later output to the same address sits behind a key that is already public. That is the asymmetry the counter measures.