Quantum runway, 6 October 2026

Tier 1 of the quantum runway just fell below three billion

Updated 6 October 2026

That is a tiered runway. It is not a single deadline.

What the three tiers are

Bitcoin's quantum exposure is usually described as one number. The number most people quote is the size of the union set, every coin in an address that a sufficiently powerful cryptographically relevant quantum computer could, in theory, steal. That number is large, and growing, and almost useless on its own. It collapses two different problems into a single headline.

The first problem is whether the public key for an output has ever been published on chain. Bitcoin spends an output by revealing the public key that hashes to the address, then signing with the corresponding private key. Once that reveal happens, the public key sits in the block chain forever. Any party that can break secp256k1 can derive the private key from the public key, and then sign a competing transaction that drains the output.

The second problem is whether the public key has not yet been revealed. A pay to public key hash output whose address has never been spent keeps the public key hidden behind a double SHA256. The hash does not, by itself, give an attacker enough information to derive the private key. An attacker who can break secp256k1 still has to invert the hash, and the only known technique for that is a brute search that costs the same for every hash output.

Tier 1 covers outputs whose public keys are already on chain. The classic case is the early pay to public key outputs satoshi put in the genesis block and the first thousand blocks, where the public key sat in plain text from the moment the output was created. Reused pay to public key hash addresses are also tier 1, because the first spend published the public key, and any further funds sent to the same address inherit the exposure.

Tier 2 covers outputs whose public keys are not yet on chain, but whose script types or address formats will force the public key to be revealed at the moment of spend. Taproot key path spends are the obvious example. A pay to witness public key hash address that has never been spent is tier 2, because the moment the holder tries to move the funds, the public key hits the chain. A pay to script hash multisig that has never been spent is also tier 2, because the redeem script and its public keys are published on first spend.

Tier 3 covers outputs whose public keys can stay hidden even at spend time. A pay to witness script hash address whose witness program commits only to hashed public keys, with a tap leaf that reveals nothing sensitive on chain, is tier 3. The funds are recoverable for the holder, and the public key remains a hash that even a quantum attacker would have to invert.

The split matters because the only outputs the quantum attacker can drain without first having to invert a hash are tier 1. Tier 2 outputs become vulnerable the instant the holder tries to move them, which gives the holder a kind of doomed last move, but a last move the attacker still has to win the race for. Tier 3 outputs are the only ones that can move to safety cleanly.

The number on the dashboard is the union of all three tiers. The number a holder should care about is the size of tier 1, because tier 1 is the part the attacker can already drain today, and the part every holder can already fix today, without a fork, without a soft fork, without anyone's permission.

How the three billion figure was reached

As of 6 October 2026, the tier 1 set sits at roughly 2.97 billion dollars at mid spot. The figure comes from a public scraping job that walks every block from genesis to head, parses every output script, classifies it, and tracks the unspent portion. The job is slow, the data set is large, and several researchers maintain independent copies, which is why the number rarely moves by more than a few million dollars between comparable snapshots.

The largest single contributor remains the satoshi era pay to public key outputs. Those coins have not moved since 2010, and the public keys for each one have been on chain since the day the coin was mined. The next contributor is reused pay to public key hash addresses from the 2011 to 2014 era, when wallet software routinely handed the same address to multiple payers. The third contributor is a long tail of exchange hot wallets and gambling services that reused deposit addresses for years.

The interesting part of the move is not the absolute number. The interesting part is the direction. The tier 1 set is shrinking, slowly, for two reasons. First, some holders are moving funds out of reused addresses into fresh bech32 or bech32m addresses, which moves coins from tier 1 to tier 2, or in some cases to tier 3, depending on the script type. Second, price moves of a few percent in either direction change the dollar value of the underlying coin set without changing its size.

Net of both effects, the runway counter on catbitcoin's dashboard ticked down from 3.04 billion to 2.97 billion over the trailing thirty days. The counter is calibrated in dollars at mid spot, which is a blunt instrument. A reader who prefers a unit free view can read it as a fraction of total supply, currently about 2.8 percent of circulating bitcoin, or as a count of roughly 1.51 million bitcoin, depending on which denominator feels less misleading.

The thing to notice is that the runway is not a single dial that falls to zero. The runway is a stack of three dials, and the top dial is the one any holder of a box can still turn back by hand. The dial does not require a soft fork. The dial does not require a flag day. The dial does require the holder to know which box they hold, and to be willing to move the contents into a box that has never had its key published.

Why a fresh bech32m address is still the right move

The cheapest defence a holder of a tier 1 box can mount today is a move. Move the funds to a fresh bech32m address, ideally a taproot address whose key path will publish a fresh public key only at the moment of the next spend, and ideally never reuse the destination address for anything else. The move costs a transaction fee, the destination address joins tier 2 until it is spent, and that is the entire cost.

The move is not a permanent fix. A taproot key path output, once spent, reveals its public key. The output graduates from tier 2 to tier 1 at the moment of spend. To stay in tier 2, the holder has to move the funds again, into another fresh address, before spending from the current one. To reach tier 3, the holder has to use a script path that never reveals the spending public key, which means a multisig where the redeem script commits only to hashes, or a single sig wrapped in a script that exposes nothing.

For a holder who is not ready to learn the script path tools, the move from tier 1 to tier 2 is still a net win, and a large one. The quantum attacker who wants the funds has to be on the network at the moment of the move, ready to race the holder's transaction with a competing spend, and ready to do that for every future spend the holder makes. The attacker has the advantage at the first move, because the holder has to publish the public key to move the funds, and the attacker can grab the funds at the same moment. The attacker also has to break secp256k1, which is the part the dashboard number quietly assumes.

For a holder who holds satoshi era pay to public key outputs directly, the calculus is the same, only the cost of doing nothing is higher. The public key has been on chain for fifteen years. The only thing protecting the funds today is the assumption that no one has a cryptographically relevant quantum computer, plus the assumption that no one with such a computer will drain the funds before the holder gets around to moving them.

The thing a fresh bech32m address does not do is protect funds already in tier 1 if the holder loses the keys. The keys, the seed, the passphrase, and the wallet software that knows the script type are the only path to a valid spend. A watch only wallet, a block explorer, a paper backup that has faded, a custodial account on a centralised exchange, none of these can sign a transaction. They can see the box. They cannot open the box.

The thing a fresh bech32m address does not do is protect a holder who pastes a seed phrase into a field that is not a wallet. The watch only import field on every block explorer and every portfolio tracker exists so that an address can be labelled without the seed leaving the device. The seed never has to leave the device. The seed must never leave the device. The field that asks for a seed is either a wallet, or it is a scam, and there is no third option. Never paste a seed into a watch only field.

What the runway counter does not count

The counter is honest about what it is and what it is not. It is a count of bitcoin in tier 1 outputs, valued at mid spot on the date of the snapshot. It is not a count of addresses, because one address can hold many outputs. It is not a count of holders, because one holder can control many addresses. It is not a count of vulnerable outputs, because a tier 1 output is only vulnerable if the attacker can derive the private key from the public key in the time it takes to race a competing spend to confirmation.

The counter does not count frozen coins. A coin in a script that requires a hardware module that no longer exists, or a multisig where two of three signers are dead, is not in the counter, because the coin cannot be moved by anyone, including the quantum attacker. The counter does not count lost coins, because a lost coin is one whose private key has been thrown away, and a private key that no longer exists cannot be derived by anyone, classical or quantum.

The counter does not count coins that sit in tier 2 outputs whose holders can still move them to safety. The counter does not predict when a cryptographically relevant quantum computer will exist. The counter does not predict which side of the race the attacker will win, if the race ever happens. The counter is a measurement of the size of a problem, not a prediction of when the problem will land.

That is the point. A runway counter that admits what it does not know is more useful than a countdown that pretends to know. The 2.97 billion dollar figure is a measurement. The question of whether the figure will be zero before a quantum computer is built is a separate question, and the honest answer is that no one on the public internet knows.

The 2.97 billion dollar figure is also a number a holder can act on. Every box in tier 1 is a box the holder can move, today, into a box that is not in tier 1. Every move is a smaller number on the counter. Every move is one fewer box the attacker can drain without first having to break the chain. The counter is honest about the size of the problem. The counter is also honest about the part of the problem the holder still controls.