The Post-Subsidy World: Should We Be Concerned About The Security Budget?

Gentlemen, thank you for joining us here, and thanks to a lovely audience for coming out for this talk. This is one of those kick-the-can-down-the-road issues. A lot of people like to talk about it, and there is a lot of bloviating and sophistry in the discussion of what is going to happen when Bitcoin's block subsidy runs out.

​

Before we get into the meaning of the discussion, can you give us some brief intros about who you are and the work you do in Bitcoin?

​

Sure. My name is Paul Sztorc. I'm the author of BIP 300 and 301, and I'm the founder and CEO of LayerTwo Labs.

​

I'm Mike Casey, most recently running the Endura platform. Currently I'm an independent working on post-quantum solutions.

​

My name is Nick Hansen. I'm the CEO of Luxor. We build mining software and services, mining pool firmware, financial services like derivatives, and things like that. So we are very interested in what happens in a post-subsidy world.

​

To set the stage for this, for those who hear the word subsidy and it sounds like jargon, Bitcoin's block rewards have both a subsidy, which is freshly minted coins, and transaction fees. With each successive halving, that subsidy continues to diminish in Bitcoin terms, and eventually it will go away, around 2140, long after we're all gone.

​

There is this concern that eventually you're going to get to a point where you rely only on transaction fees. If Bitcoin is not being used enough, and if the transaction fees are not high enough, this could theoretically threaten Bitcoin's security budget because miners are not incentivized to mine. So to start, on a scale of one to ten, how concerned are you that once the subsidy is diminished, there won't be enough transaction fees to furnish Bitcoin mining?

​

I would say an eight. First of all, even though it goes down 100% in the year 2140, it has already gone down a lot. In the first 16 years, it goes down 96%, and then it goes down another 96%. So it goes down very rapidly, and then it just barely survives until the end. So it is going to be a concern long before the year 2140.

​

The reason to be concerned with the security budget is that there are several overlapping things. One is that it is how much money the miners are paid, which is how much proof of work the network has. This is how much money miners will spend, since they can't spend more than they're paid. If the network doesn't have proof of work, then all of this blockchain stuff was kind of a waste of time because it doesn't actually do anything.

​

The second reason is that it is a clue that we have a lot of fee-paying users. We actually have happy customers. If the security budget is very high, it means we have a lot of users actually using the network. That is why we should really focus on how much revenue the miners are getting. We should care about that almost as much as we care about the exchange rate.

​

My answer right now is probably about a five, but it edges up every year. I think within six years it will be an eight. That's how long I think we have to fully assess the situation and take corrective action.

​

If you look at Monero, they have a tail emission, and they put a lot of work into that tail emission. They are still regularly 51% attacked right now. In six years, after another two halvings, as a percentage of the total amount of emission of the coin, Bitcoin's emission rate through the subsidy will actually be less than Monero's tail emission as a rate over the total amount being secured. So we don't have much time left, and it's not something anybody is thinking about. To me, mid- to longer-term, this is a more important issue than quantum itself.

​

I would say my concern level was like an eight or ten back in 2024, mostly because I was thinking about the halving of probably 2032. We've seen all-time-low hashprice pretty consistently over this epoch, and that probably isn't going away.

​

We need users. We need customers, people to use this thing. At the end of the day, it's a service to move money around. People need to be paying to use that, and right now nobody is really doing that. The last cohort of people that did were ordinals and runes, people putting JPEGs on the blockchain, which is a pretty toxic topic. But that was the last time the chain really got any major usage. Blocks are consistently not full right now, and actually the last time they were full was because of a weird ordinal thing.

​

So we need users. We need people to actually move Bitcoin around and use it to pay for stuff, or the subsidy is going to be a massive problem. I do disagree, though. I think quantum is the first thing we have to tackle, and then the subsidy is going to be a problem.

​

You think we will have a viable quantum computer that could threaten quantum-vulnerable coins before the subsidy becomes an issue for miner revenue?

​

Before the subsidy becomes a bigger issue, yeah.

​

What's your timeline for that?

​

I would say right now the consensus is about six years. An aggressive estimate would be more like four, and if you were really conservative and think that quantum is further out, it would be more like nine. So between four and nine years is kind of the timeline.

​

We can't escape from the quantum discussion, even when it's on a panel about subsidy.

​

No, it never ends well.

​

Quantum fixes the subsidy problem for a while.

​

You're getting ahead of my question. We opened two cans of worms there. I'll start with that one second, but I want to first zoom in on one thing you said about the last time we saw a meaningful spike in fees, which was the ordinals craze in 2023 and 2024. It was significant. There were times where you had 30, 40, 50%, and sometimes even 100% of the block subsidy as fees because of this ordinals trading.

​

When all of that was going off, it was obviously very contentious. A lot of people don't like the blockchain being used for non-monetary use cases, but it did spark a dialogue over the fact that eventually we're going to need use cases that feed the fee market, or else mining will die.

​

People have been talking about different L2s on Bitcoin and unlocking DeFi use cases on Bitcoin for a long time. During the ordinals craze, there was a lot of fundraising into some of these budding alt L2s. Frankly speaking, a lot of them have failed to deliver any sort of market share that would mirror what we've seen on Ethereum. What do you think is the reason why we haven't seen that adoption? Do you think L2s or additional financial uses of Bitcoin would drive fees, or is that something that's just not sticky for this asset? And if so, why?

​

At the end of the day, you need a fork to really have usable L2s. To get what is called unilateral exit, meaning you can exit from the L2 without having any validators in between, you need a fork to make that possible. The community has pretty much rejected all of those proposals, so CTV, check template verify, OP_CAT, you've probably heard of these. They're really not going anywhere as far as I can tell.

​

You need a fork for them to happen, and I don't think that's going to happen, at least not in this generation of Bitcoiners. I think Taproot was probably the last real fork that we'll get. The next one we would really need to do is BIP 360. So we're not going to get any new opcodes to allow real L2 activity. At the end of the day, I don't think there's going to be much DeFi activity on Bitcoin, unfortunately, which is not good. We want DeFi activity on Bitcoin. It drives a lot of fees.

​

I agree with you on the outcome, but I disagree on the reason. I don't think it's necessarily because of these proposals. The reason I think we're not seeing any kind of free market develop, and we'll see something like ordinals pop every now and again, or we saw the Lightning Network and lots of usage on that for a while, and the same is true of Ark or anything else, it all kind of boils down to the fact that we have a static cap on the amount of block space, and it's in no way adaptive.

​

I know this is a very controversial take, but the problem is somebody develops a killer app use case to use Bitcoin for other than just sending transactions. They build a model, they have something like runes or ordinals, and they do it, and it is wildly successful. But eventually that use case will price itself out of the market because the supply of block space does not increase ever. Because of that, it becomes far too expensive to support that use case.

​

This is true for anything you want to do as a meta-protocol on Bitcoin, including bridging mechanisms to a DeFi protocol on an L2. This is a problem for Lightning. This is a problem for ordinals. This is a problem for Ark or any other system that requires Bitcoin transactions for it to use. Eventually its own weight will crush it under the current way.

​

We could easily have a huge ecosystem that pays miners an enormous amount of fees, much more, 10,000 or 100,000 times what they earn today. But for some reason, the Bitcoin community has chosen not to do anything controversial.

​

Ordinals are a perfect example. Ordinals are a case where people are kind of using Bitcoin to have fun, but as Mike was saying, it caused fee rates to go up in 2023, and that interfered with some Lightning technology and some other stuff. It's very hard to get anything done because if you do anything at all, it's bound to make some people confused or upset. Basically every single decision you could possibly make is controversial, and we've decided that we're not going to do anything controversial.

​

We could have, for example, unlimited extra block space on these merge-mined L2s. That's what the sidechains idea was, and that's what BIP 300 is. I agree with Nick that we're not going to have BIP 300 on BTC anytime soon. We're not going to have OPCAT. We're not going to have OPCTV.

​

We used to do two soft forks on average every year. We did 14 in the first seven years, but now we don't do any at all. Taproot took 46 months from when it was first proposed to when it finally activated. So we could easily change all this around, but the Bitcoin culture, and the way we do things here, just does not prioritize users and does not prioritize the fees. We could do it. In one sense nothing is stopping us from doing that, but in another sense we kind of collectively decided as a culture that we're just not going to do it, which is a big mistake.

​

One final thing: Nick is running one of the mining pools. It's not that big, but it's on the pie chart. You guys are the responsible party in a way. You guys are the specialists. You guys run the block template. You guys can orphan blocks. You could call up your other pool friends and activate all these soft forks tomorrow. Partially, this is the mining pools' decision to fire a gun into their own skull and their own lives. That is one weird aspect.

​

That's akin to a coup, though, in a way.

​

It's a coup to basically keep themselves alive and keep the Bitcoin network growing and obtaining more users, I think. But this is the element in the culture. For anyone to do anything unilaterally is seen as a kind of betrayal of the peace and tranquility that we've all enjoyed.

​

The problem, I think, is because of the halving, we're basically a frog in a boiling pot of water, and the temperature is going up really slowly. Nobody is concerned about the fee market right now because there's a subsidy, and everybody assumes, well, if the price doubles and the Bitcoin subsidy halves, then net-net everything is even.

​

A lot of people believe that, but I think all four of us know that's not true. That's not the way it works. Don't take our word for it. Take out a piece of paper and start multiplying, and you'll see it doesn't work.

​

The security budget in actuality needs to be one satoshi more than the attack budget. Bitcoin always must be profitable to mine with your hash. If you can acquire hash, it has to be more profitable to mine with it than it is to try to attack Bitcoin. The more expensive Bitcoin gets, the more value it has, and the more attractive a target it is for attack. Number up does not help the problem.

​

This is a tough panel because you all have said something just now that I could latch onto for a follow-up conversation. Mike, you hinted at this catch-22 with Bitcoin's block space, this idea that there is not actually enough to furnish the use cases that would drive fees in a way that doesn't hamper other use cases. For instance, when the ordinals craze was popping off, people running Lightning routing nodes would close channels or have channels force closed, and all of their revenue from that routing node was gone because fees were crazy.

​

If you build anything with the assumption that fees will eventually be cheap enough, you're going to lose all your money.

​

I would like to get back to the developer discussion in a second, in terms of thinking about what quantum means for threatening any other opcode being added that would actually improve functionality. But first, I do want to return to quantum in a different element with you, Mike, specifically this Hourglass proposal that you coauthored. Can you explain what this is, and also how it might, as a side effect, solve this problem?

​

Sure. I'll try to be brief. I'm sure most people are familiar with Satoshi's coins, this vast trove, and most people aren't worried about them. They've been written off so thoroughly because they haven't moved since 2011 or earlier, 2010.

​

This represents a whole class of coins. It's P2PK, notably not P2PKH. It's not protected by that hash element, which means these coins exist on chain with a public key exposed, and they are 100% quantum vulnerable to a cryptographically relevant quantum computer. That means somebody could crack them with a sufficient quantum computer running Shor's algorithm.

​

These coins are exposed. They're presumed dead. Nobody is going to move them and migrate them over. So let's say we activate BIP 360. We have post-quantum. Great, it's all safe. Nobody is going to move those coins. They're going to be there presumably forever until a quantum attacker steals them.

​

We did the math looking into this, and there are 1.7 million bitcoins in this class, the original 50 BTC mining rewards. These coins could be moved by a single entity, the entire set, in three hours' time. That's how long it would take a quantum attacker to actually mine all of those into an address they control. Presumably, they could even flood them onto the market and sell, crashing the entire market.

​

That is the problem statement. There are factions who say, we can't allow this. Those coins are supposed to be dormant. They're supposed to be dead. That's not what I bought into. So we should freeze or burn these coins. That would mean freezing or burning Satoshi's coins, among others. I think that's anathema to what Bitcoin represents and property rights.

​

On one side are the liquidationists, who say, not your keys, not your coins. If they get the keys, it's theirs. This is freedom. The other side says, no, we have to protect. Hourglass is a compromise solution between these two camps.

​

The original Hourglass proposal allowed one P2PK output per block. That means 50 BTC could be released per block, which means it would take about eight months to run through that supply, as opposed to three hours. The most recent version, Hourglass V2, stretches it out because it only allows one BTC to be released from one of these addresses per block, and that stretches it out over 32 years.

​

Getting back to your original point, how does this affect the security budget? If everything went right, and there was a credible quantum threat in the near-term future, and Hourglass was activated, and they did attack these coins as a salvage because they're unclaimed property at this point, and it was legitimized so they weren't incentivized to steal other sets of unprotected coins, and everybody else moved those over, then if there is one attacker, they get all those coins. They get one BTC per block, or 144 bitcoins a day, over the course of 32 years.

​

If Satoshi doesn't move his coins, the second attacker now has to bid against the first one. This creates an incentive. It's a race condition because they have to pay the miners. They have to pay the mining pools.

​

Just to be clear for context, they would be doing something like RBF, replace-by-fee?

​

Not RBF, because it's not the same transaction. There's only one allowable transaction. The miner picks which one. They're only allowed to pick one, and that one can be at max one bitcoin out. The rest has to be refunded to the address. So it's not necessarily RBF, but similar.

​

But it would be a fee bidding war for those coins.

​

A fee bidding war, yes.

​

And then those fees would go to the miners, and it would be a way to increase their revenue.

​

Yes.

​

It would effectively guarantee that there's one bitcoin worth of fees paid in each block.

​

Provided you have enough parties bidding against each other for this.

​

That assumes that one of them doesn't just give up at one point, right?

​

It depends. If you already have the keys cracked, it's a sunk cost. If you get 1% of a bitcoin, that's better than getting nothing. If you've already spent the effort to crack the key, would you rather get nothing for it or get something for it?

​

Nick, you presented on this at OP_NEXT, Blockspace's conference in New York last week or two weeks ago. What are your thoughts on this as a miner? And then Paul, we'll go to you for your thoughts.

​

I'm going to be advocating pretty heavily for it. OP_NEXT, presented by Blockspace, was a great conference. Thank you, Colin. We talked a lot about Hourglass, and I think it was actually well received. I thought I was going to get a lot of boos from the crowd because that's a hardcore Bitcoin or Bitcoin Core dev conference, and I expected that the majority of the folks there would really not like it. But it seemed like it was well received. I was pretty excited. It feels like there's actually a real possibility that we could get an Hourglass fork.

​

Some would say it's better than BIP 361.

​

BIP 361 is the proposal to freeze any of the coins that are quantum susceptible after some date, which is basically the seizure. I don't advocate for that. I think that's anti-Bitcoin. I don't think that's the way we should go.

​

I'm also very concerned about option one, which is do nothing, because it will demolish the market, and who knows how long until the market reforms. It could take decades. The problem is I want to be around to see Bitcoin hyperbitcoinize. If all these coins hit the market, there are 6.7 million coins in the whole thing that are susceptible to being stolen. If that hits the market, it's never coming back, probably not in my lifetime. Institutions are just out. They don't really know what happened here. Bitcoin went down by 90% in two days. I'm out.

​

I don't know what to do about that. I think Hourglass is a great solution to slow that trickle and potentially have the majority of those coins, which are inevitably going to be stolen anyway, flow to miners who are most asset-aligned.

​

Hourglass is, I think, a pretty good idea. It does have two drawbacks with respect to the security budget. One is it requires that the quantum computer actually be built, which is not a foregone conclusion. It may not actually be built.

​

You don't think it's a foregone conclusion?

​

I think a lot of people are weighing in, but very few people know. I would be in favor of a prediction market or something that would say, will it be built by this date, so that the insiders can tell us.

​

I actually take that as another argument for Hourglass versus a confiscation. If you implement a confiscation early, you have to time it right before a quantum attack. Otherwise it's worthless, and you've wasted everything. With Hourglass, if it's enacted early and there is no quantum computer, it's minimal harm because anybody who wants to recover those keys still can.

​

You can still spend one BTC per week, which is kind of a lot of money.

​

The second point is still a very good idea. It does require that the quantum computer be built, that it crack all the keys, and that they be posted on a website or that anyone can do it with a cheap computer. The other problem is that when all those coins have been spent, we've kicked the can down the road. We had this artificial one BTC per block subsidy, and then it will just fall off a cliff to zero at the end.

​

There's nothing prohibiting a future soft fork to smooth it later, but I don't have that initially.

​

I'd just like to quickly say that I'm in favor of merge-mined L2s, and that's BIP 300 and 301. We could have an unlimited number of L2 blockchains, and the miners could automatically collect the transaction fees from all of them without doing any extra work. That would enable them to collect huge amounts of money.

​

For example, there used to be this site, and there still is, called cryptofees.info. You can look up all the transaction fees paid, basically the security budget more or less paid by each blockchain. You see that Ethereum's number is always higher than BTC. Sometimes it's ten times as much. That's something to think about, that we could have those with merged L2s.

​

All right, gentlemen, we have two minutes and 45 seconds left. Quick lightning round. One of the solutions outside of transaction fees getting juiced up has been the idea of extending Bitcoin's emission schedule, tail emissions, basically extending the block subsidy in perpetuity. What do you all think of this proposal, and why do you think it is or isn't a good solution?

​

I think it's a bad idea. You'll get two forks anyway. You'll get two bitcoins at the end of that, and I'm pretty sure everybody will just go with the one that doesn't add a tail subsidy. Maybe in 20 years they'll come back and realize that was a mistake, but I don't think you'll ever get any support for it.

​

When you bought Bitcoin 15 years ago, you were sold the idea of 21 million. You look around and you see 21 million all over the signage here. That's a big selling point of Bitcoin, and you kind of destroy that. So I don't think it will ever happen, and I would push against it.

​

I agree. I don't think a tail emission is something that's part of the contract people signed up for when they bought Bitcoin. Everybody was sold on a 21 million hard cap forever. That's the entire premise of it. It is sound money, hard money, unchangeable. That's the bill we were all sold. If that changes, that could undermine the entire value proposition of Bitcoin itself as hard money.

​

Not to say that if we don't do something, it may be inevitable. I don't know at what point it would be, but we are going to have to start taking some really hard looks within the next six years. Monero's tail emission is at the rate that we will be for the subsidy in ten years. Even if we freeze it there, it will be less than Monero, and Monero is regularly 51% attacked. Obviously the tail emission is not enough for Monero.

​

This is good timing because we just had a Litecoin attack also, so all of that is related. For years everyone has said, don't worry about the security budget, but now all of us who brought it up are being vindicated.

​

About tail emission, we just did a year of bikeshedding over the optional configurable OP_RETURN standard parameter or something. I completely agree with Nick that there would just be endless bikeshedding, and no one would ever be able to agree on that. I also agree with Mike that it wouldn't even solve the problem, really.

​

Gentlemen, thank you very much. Let's give it up for our panelists.

​

Thank you, guys.

​

Thank you.