Runway arithmetic

Shor's knapsack: why a million-qubit day only spends one box

Updated 19 October 2026

That is the knapsack problem dressed in qubits. It is not a single transaction that empties the runway.

The runway is counted in boxes, not signatures

The quantum runway counter on catbitcoin.com/runway quotes a number in Bitcoin. It is the mark to market sum of every unspent transaction output whose scriptPubKey exposes a public key, or whose address style is old enough that the key can be reconstructed once a fault tolerant Shor run lands. The number is a stock, not a flow. It is the size of the queue that a quantum adversary would face if it could break one key per logical run, or one hundred, or one thousand. The counter does not know which day the run happens. It only knows what is sitting in the queue.

This matters because every public discussion of the quantum threat collapses two different questions into one. The first question is, can a sufficiently large fault tolerant machine run Shor's algorithm against a 256 bit elliptic curve public key? The second question is, how many boxes can such a machine empty per day, per hour, per second? The first is a yes or no about mathematics, and the mathematics has been settled for thirty years in the abstract. The second is a queueing problem, and the queue is the UTXO set.

Call the first the oracle question. Call the second the knapsack question. CatBitcoin has covered the oracle. The runway is the knapsack.

What a logical qubit actually buys you

A physical qubit is a device held at millikelvin temperatures, wired to control electronics, and tuned by software that does not sit on the Bitcoin chain. A logical qubit is a bundle of physical qubits, kept coherent by an error correction code, and able to hold a quantum state for the duration of a useful computation. The number that matters for ECDSA is the logical qubit count, because Shor's algorithm against a 256 bit curve needs a certain depth and a certain width, and the width is what industry roadmaps talk about when they quote a year and a qubit budget.

Roadmap numbers, in the abstract, are honest about the difference between physical and logical. A laboratory milestone that adds physical qubits is not a milestone that adds logical qubits, and the conversion factor between the two is hostile. Surface code estimates have moved, but the order of magnitude is well known. A single logical qubit costs on the order of a thousand physical qubits for surface code overhead at plausible error rates. A fault tolerant Shor run against secp256k1 wants, on the most cited estimate, somewhere in the low thousands of logical qubits. Multiply the two, and the physical machine is a million qubit class device, not a thousand qubit class device.

None of this is on chain. It sits in industry roadmaps, in academic preprints, in NIST's commentary on its own signature competition, and in the slow cadence of superconducting and trapped ion laboratory press releases. The runway counter does not know whether the next press release is honest. It only knows what is exposed in the queue.

One run, one box

Here is the knapsack. A logical machine that runs Shor against a 256 bit public key, given the right preimage, recovers the private scalar in a number of logical clock cycles that is large, but finite. The result is one private key. With one private key, the adversary can construct one signature that satisfies the scriptPubKey, and therefore spend one box. The chain does not let the adversary reuse the recovered scalar across boxes. Each P2PK or P2PKH output is a separate instance of the discrete logarithm problem, with its own public key bytes, its own script, and its own sighash. A new run, against a new public key, starts the knapsack again.

This is the line that the popular press misses. A million qubit day, in the most generous reading, produces a finite number of recovered private keys. The number is bounded by clock cycles, by calibration, by the number of logical machines that can be run in parallel against distinct keys, and by the simple fact that the public keys themselves are not all loaded into the same register. The adversary pays the full cost per box.

CatBitcoin has covered the p2pkh window as a separate question, and the eleven billion figure as the stock. The knapsack is what links them. The window tells you which boxes are exposed, the runway tells you how many, and the knapsack tells you how fast a single quantum adversary can spend them.

Why parallelism does not save the adversary

There is an obvious objection, and it deserves an answer. A serious adversary runs many logical machines in parallel, and parallelism multiplies throughput. A facility that runs a thousand logical instances in parallel spends a thousand boxes per run cycle, and the queue shrinks faster. CatBitcoin is not arguing that parallelism is impossible. The argument is narrower. Parallelism is bounded by the same physical resources, and those resources do not scale with the size of the queue.

Here is the bounded part. Each logical machine needs its own set of physical qubits, its own dilution refrigerator footprint, its own control plane. A facility that runs a thousand logical instances against secp256k1 still needs to move the public keys into the registers, run the algorithm, read out the result, and broadcast a transaction. The read out itself is a classical step, and the transaction is a network step. The chain will see the spends, in some order, and the order matters for the mempool and for the fee market. A quantum adversary that rushes spends at high fee. A quantum adversary that waits spends at low fee. Neither spends all at once.

The other bounded part is older. The discrete logarithm problem for secp256k1 has not been shown to admit subexponential speedups under realistic models. Shor's algorithm is the known path, and its cost is superlinear but not exponential in the key size. That is the threat. The threat is not that the cost collapses to zero. The threat is that a well funded adversary with a million qubit machine can do the cost in a number of hours that fits inside a weekend. CatBitcoin has covered the qubit budget question, and the budget is the lever.

What this means for the runway counter

Run the arithmetic. Suppose a fault tolerant Shor run against a 256 bit key takes ten hours of logical machine time on a million physical qubit class device, with a calibrated error rate, against a target key that is already public. The adversary recovers one private key per ten hours. If the adversary runs a hundred such machines in parallel, the throughput is ten keys per hour, or two hundred and forty per day, or roughly eighty eight thousand per year. At a mark to market of sixty thousand dollars per Bitcoin and a runway of eleven billion dollars, that is roughly one hundred and eighty three thousand boxes, and the throughput would clear the runway in two years of continuous, parallel, error corrected operation.

Two years is a long time. It is also a short time, and it is a number that the counter can be made to react to. The counter currently shows the stock. A second counter, which CatBitcoin has not yet built, would show the burn rate, the number of boxes a well funded adversary could empty per day at a given logical qubit count. The two numbers, side by side, would tell a reader how many days the runway is wide, not just how deep it is.

The hard warning

The arithmetic does not change the operational advice. Watch only wallets are windows, not openings, and a watch only field that asks for a seed is a phishing surface, not a feature. Recovery phrases belong on paper, on metal, in a safe, and never in a software field of any kind, on any device, for any reason. The knapsack is the queueing problem. The seed is the single point of failure, and the single point of failure does not care whether the adversary is quantum or classical.

Never paste a seed into a watch only field.

What changes when the box owns the key

The knapsack also changes shape when the script is not the standard P2PK or P2PKH form. Taproot key path spends still close the box at spending time, and the key path still closes the box in the sense that the public key is only revealed in the witness, after the spend is broadcast. A quantum adversary that wants to front run a Taproot key path spend has to break the key between the broadcast and the confirmation, which is a much smaller window than the multi decade exposure of an old P2PKH box. The Satoshi era boxes are a different case. Their public keys have been public since 2010, and the knapsack cost against them is identical to the cost against any other exposed key. The queue treats all exposed keys as equivalent items, regardless of origin.

The open questions

Three questions remain, and CatBitcoin will return to them as the calendar moves. First, what is the honest lower bound on the number of physical qubits per logical qubit at the error rates a Shor run needs? Second, what is the throughput of a facility that runs logical machines in parallel against distinct keys, and how does that throughput scale with the facility's footprint, its cooling, and its control plane? Third, what is the price of a private key on a market that does not yet exist, and how does that price move when the first public Shor run is announced?

The runway counter answers the first indirectly, by quoting the stock. The knapsack answer is a separate number, and it is the number that a defensive migration has to beat. The runway is currently eleven billion dollars. The knapsack, on the most generous reading, is a few years of continuous parallel operation. The two are not the same scale, and the order in which they fall is the order in which Bitcoin has to act.

This post uses arithmetic that combines industry roadmap estimates with adversarial queueing assumptions. The numbers are illustrative and should not be read as a forecast of any specific facility's capability.