Runway

Quantum runway counter ticks past eleven billion

Updated 19 October 2026

That is eleven billion dollars of bitcoin whose public key is already on chain, mostly in legacy P2PKH boxes that paid in full before SegWit. It is not a countdown to a specific attack, and it is not a count of every address that could one day matter. The figure is a runway: the pool a sufficiently large quantum machine could draw from first, before any frozen vault, before any taproot key path, before any timelocked output whose script only reveals what it needs at spend time.

What the counter actually counts

The counter, kept independently by a small group of analysts tracking the metric, is not a measure of cryptographic vulnerability in the abstract. It sums the unspent transaction output value of every script type that publishes the public key, or a key image equivalent, before the owner signs. The dominant contributor remains legacy P2PKH outputs created between January 2009 and the broad SegWit rollout of 2017, where the scriptPubKey carries the hash160 of the public key, and the spending witness must reveal the full public key plus signature.

At 19 October 2026 the counter reads approximately eleven billion one hundred million US dollars, across roughly one and a half million individual boxes. Of that, P2PKH contributes the largest share. The remainder sits in a long tail of pay-to-public-key outputs from the earliest blocks, early namecoin-style experiments, and a small residual of bare-multisig boxes whose participant keys are also on chain.

The figure moves. Every time a legacy address spends, the counter drops by the value of that box. Every time an early adopter consolidates dust, the counter drops. The direction since the start of 2026 has been a slow grind downward, paced by the small handful of 2010-vintage holders who have used the year to consolidate. The runway has not collapsed. The runway has shortened by perhaps two hundred million dollars across ten months, against a starting baseline of roughly eleven and a third billion.

Why the number still climbs in some readings

Different methodologies produce slightly different numbers. The strict reading the counter publishes counts only P2PKH and pay-to-public-key outputs. A wider reading adds every taproot output funded before a recent block, on the argument that a cooperative key path spend eventually publishes a tweaked key in the witness. The wider reading has not been adopted by the analysts who maintain the headline number, because taproot boxes are not, in the current consensus rules, exposed at the moment of funding.

The strict reading can also spike upward for accounting reasons. A coinbase maturation, a reorg boundary, or a change output from a non-taproot wallet can briefly add to the pool before the next block confirms a consolidation. The November 2025 reading of eight billion was corrected upward by roughly forty million dollars after a dormant address returned to activity and was reclassified.

What the counter does not do is project forward. It does not ask how many boxes would be exposed if today's taproot users, on a future soft fork, are forced to migrate to a post-quantum script. It does not ask what value sits in timelocked vaults that will reveal a key in 2034. It is a snapshot of the present pool, not a forecast of the future one.

Where the runway now sits against the clocks

The eleven billion number sits awkwardly against the timelines published by national standards bodies in 2024 and 2025. The most cited target, the deadline by which certain categories of classical signature scheme are to be retired from sensitive federal use, passed without a Bitcoin Core roadmap that budgets a fork. The roadmap draft circulated by a working group in early 2026, which proposed a phased migration over four years, has not advanced to a Bitcoin Improvement Proposal.

The counter matters because the runway is denominated in dollars, and the clocks are denominated in years. If a cryptographically relevant quantum machine were to be demonstrated in 2029, the runway on that date would be whatever value remains in legacy boxes that have not spent. If the figure on that date is two billion, the exposure is two billion. If the figure is eight billion, the exposure is eight billion. The runway is the variable that holders of legacy coins can move by acting now, and that no one else can move for them.

For holders of taproot coins, of segwit coins whose public key has not yet been revealed, of frozen vaults constructed under BIP 360 style proposals that have not been activated, the runway does not apply directly. Their boxes are closed at the moment of funding. Their exposure begins at the moment of spend, and a soft fork that introduces a new script type can change what that spend looks like without touching the funding transaction.

What changes the number, and what does not

The number falls when legacy holders spend. The most efficient way to spend, from a runway-shortening perspective, is to consolidate into a taproot output whose key path is not yet revealed, or into a segwit v0 output whose public key is committed only as a hash. Either move transfers the box from the exposed pool to a closed pool, and the runway drops by the value of the box on the next block.

The number does not fall when a legacy holder moves funds to another legacy address. The script type is unchanged, the exposure is unchanged, and the runway ticks on. The number does not fall when a holder uses a custodial exchange and the exchange holds the coin in a legacy cold wallet. The exposure has moved from the holder to the custodian, and the runway still counts.

The number also does not fall when a holder encrypts a backup of their key, stores it on a hardware device, or splits it across a Shamir scheme. The key, once published on chain, is on chain. The exposure is a function of the chain, not of the holder's operational security.

Why the runway is not the same as the attack surface

Eleven billion is the value that a sufficiently large quantum machine could, in theory, target first. It is not the value that any single demonstration could lift. A first-generation machine, with a budget measured in millions of physical qubits after error correction overhead, would target the oldest and quietest boxes first, the ones whose addresses have not signed since 2010. A more capable machine, years later, could sweep a wider set.

The runway is a probabilistic measure. It assumes an attacker who is patient, who is well resourced, and who is willing to wait for the right box. It does not assume an attacker who can break every legacy output in a single afternoon. The figure is a planning input for the holders of the boxes, not a guarantee of what would happen to them.

What a holder of a legacy box can do this week

Move the box to a segwit or taproot address, in a transaction that reveals the public key once, at spend time, and closes the new box at funding. The cost is a fee, the risk is a one-time exposure of the public key during the spend broadcast, and the benefit is a permanent reduction in the runway for as long as the new box remains unspent. A holder who waits to move until a quantum threat is publicly demonstrated has waited too long for the strategy to work, because the demonstration would also be the moment an attacker is positioned to act.

Hold the box in cold storage against a future fork that introduces a new output type. The fork has not been activated. The roadmap has not been written. The runway does not pause for the fork to be designed. The runway shortens only when boxes move, and the boxes that move are the boxes whose holders act.