Gentlemen, thank you for joining us here, and thanks to a lovely audience for coming out for this talk. One of those things where it's a really kick-the-can-down-the-road issue, and a lot of people like to talk about it, some bloviate, a lot of sophistry in the discussion of what's going to happen when Bitcoin's block subsidy runs out. Before we get into the meat of the discussion, though, can you all give us some brief intros about who you are, the work you do in Bitcoin? Sure. My name is Paul Sztorc. I'm the author of BIPs 300 and 301, and I'm the founder and CEO of LayerTwo Labs. I'm Mike Casey, most recently with Mera, running the Enduro platform. Currently, I'm an independent working on post-quantum solutions. Hi, my name's Nick Hanson. I'm the CEO of Luxor. We build mining software services, mining pool, firmware, financial services, like derivatives and things like that. Very interested in what happens in a post-subsidy world. Yeah, and to set the stage for this, so for those who, if you're hearing the word subsidy and it's jargon to you, Bitcoin's block rewards have both a subsidy, which refresh them into coins and transaction fees. And so, with each success of having, that subsidy continues to diminish in Bitcoin terms, and eventually it will go away. Like what, like 2134, something like that? Long before, you know, long after we're all gone. So, but there is this concern that eventually you're going to get to a point where you're going to rely only on transaction fees, and if Bitcoin is not being used enough, if the transaction fees are not high enough, this could theoretically threaten Bitcoin's security budget. Because miners are not incentivized to mine. So, to kind of start, I would just say on a scale of one to ten, gentlemen, we'll start with you, Paul, and then move down. How concerned are you for that, the idea that once the subsidy is diminished, there won't be enough transaction fees to furnish Bitcoin mining? I would say an eight. Now, are we allowed to explain, or do we just do it? Yeah, absolutely. Okay, so first of all, even though it goes down 100% in the year 2140, it's already gone down. In the first 16 years, it goes down 96%, and then it goes down another 96%. So, it goes down very, very rapidly, and it just kind of barely survives until the end. So, it's going to be a concern long before the year 2140. And the reason to be concerned with the security budget is like there's several, there's like four different overlapping things. So, one of them is it's how much money the miners are paid, which is how much proof of work the network, this is how much money the miners will spend since they can't spend more than they're paid. And that's how much proof of work the network has. And if the network doesn't have proof of work, then all this blockchain stuff was just kind of a waste of time because it doesn't actually do anything. And I'm only going to explain the second reason out of four. But the second reason is that it's a clue that we have a lot of fee-paying users. We actually have happy customers. So, if the security budget is very high, it means we've got a lot of users actually using the network. And that is why we should really be focused. We should really be focused very much on how much revenue the miners are getting. We should care about that almost as much as we care about the exchange rate. To me? Yeah. My answer right now, it's probably about like a five, but it edges up every year. I think within six years' time, it'll be an eight. That's how long I think we have to fully assess the situation, take corrective action. The reason being for this, if you look at Monero, Monero, they have a tail emission. And they put a lot of work into that tail emission, and they're still regularly 51% attacked right now. In six years' time, another two halvings as a percentage of the total amount of emission of the coin, Bitcoin emission rate through the subsidy will actually be less than Monero's tail emission as a rate over the total amount being secured. So we don't have much time left, and it's not something anybody's thinking about. To me, mid to longer term, this is a more important issue than quantum itself. Yeah, so I would say what my concern level was like an eight or ten back in 2024, mostly because I'm just kind of thinking about the halving of probably 2032. We've seen all-time low hash price pretty consistently over this epoch. That probably isn't going away. And Paul said it the best, we need users, we need customers, people to use this thing. At the end of the day, it's a service to move money around. People need to be paying to use that, and right now nobody's really doing that. The last cohort of people that did were ordinals and runes people, putting JPEGs on the blockchain, which is a pretty toxic topic. But yeah, that was like the last time the chain really got any major usage. I mean, blocks are consistently not full right now. And actually the last time they were full was because of a weird ordinal thing. So we need users. We need people to actually move Bitcoin around, use it to pay for stuff. Or the subsidy is going to be a massive problem. I do disagree, though. I think quantum is the first thing we have to tackle, and then the subsidy is going to be a problem. You think we'll have a viable quantum computer that could threaten quantum vulnerable coins before the subsidy becomes an issue for minor revenue? Before the subsidy becomes a bigger issue, yeah. What's your timeline for that? I would say right now, I think the conservative estimate is about six years. And aggressive would be shorter than that. And then I think, or sorry, the consensus is about six years. An aggressive estimate would be more like four. And then if you were really conservative, you think that quantum is further out, would be more like nine. So between four and nine years is kind of the timeline. We can't escape from the quantum discussion, even when it's just a panel about subsidy. Nope, it never ends. Well, quantum fixes the subsidy problem for a while. You're getting ahead of my questions. Sorry. But, you know, we opened two cans of worms there. I'll start with that one second, but I want to first zoom in on one thing that you said about the last time we saw a meaningful spike in fees was the Ordinal's craze in 2023, 2024. And it was significant. There were times where, you know, you had 30, 40, 50 percent, sometimes 100 percent even of the block subsidy as fees because of this Ordinal's trading. And when all of that was going off, it was obviously very contentious. A lot of people don't like the blockchain being used for non-monetary use cases. But there was dialogue. It did spark a dialogue over. Well, eventually we're going to need use cases that feed the fee market or else mining will die. And so for my next question, we'll start with you this time, Nick, and then move down. People have been talking about different L2s on Bitcoin, unlocking, you know, DeFi use cases on Bitcoin for a long time. During the Ordinal's craze, there was gobs of fundraising into some of these budding L2s. And just frankly speaking, a lot of them have failed to deliver any sort of market share that would mirror what we've seen on Ethereum. So what do you think is the reason why we haven't seen that adoption? Do you think that L2s and alternative or additional financial uses of Bitcoin that would drive fees are something that's just not sticky for this asset? And if that's so, why is that? Nick, we'll start with you. At the end of the day, you need a fork to really have usable L2s to get what's called unilateral exit, meaning you can exit from the L2 without having to have any validators in between. You need a fork to make that possible, and they've determined that a fork is not going to happen. So that's kind of, you know, I mean, when I say they, I mean the community has pretty much rejected all of those proposals. CTV, Checksick from Stack, Opcat, you've probably heard of these. They're really not going anywhere as far as I can tell. So you need a fork for them to happen, and I don't think that that's going to happen, at least not in this generation of Bitcoiners. I think Taproot was probably the last real fork that we'll get. The next one we would really need to do is Bit360. So we're not going to get like any new opcodes to allow real L2 activity. So at the end of the day, I don't think there's going to be much DeFi activity on Bitcoin, unfortunately. Which is good. We want DeFi activity on Bitcoin. It drives a lot of fees. So I agree with you on the outcome, but I disagree on the reason. I don't think it's necessarily because of these proposals. The reason, I think, that we're not seeing any kind of appreciable fee market develop, and we'll see something like Ordinals pop every now and again. We saw the Lightning Network and lots of usage on that for a while. And the same is true of ARK or anything else. It all kind of boils down to the fact that we have a static cap on the amount of block space, and it's in no way adaptive. So the problem, and I know this is a very controversial take, but the problem with this is somebody develops a killer app use case to use Bitcoin for, other than just sending transactions. And they try to do it. They build up a model. They have something like Runes or Ordinals, and they do it. And it is wildly successful. But eventually that use case will price itself out of the market because the supply of block space does not increase ever. So because of that, it becomes far too expensive to support that use case. This is true for anything you want to do as a meta protocol on Bitcoin, including bridging mechanisms to a DeFi protocol on ML2. So this is a problem for Lightning. This is a problem for Ordinals. This is a problem for ARK or any other system that requires Bitcoin transactions for it to use. Eventually its own weight will crush it under the current way. Okay, we could easily have a huge ecosystem that pays miners an enormous amount of fees, and much, much more, 10,000 or 100,000 times what they earn today. But for some reason, the Bitcoin community has chosen not to do anything controversial. And so even the Ordinals is a perfect example, because the Ordinals is a case where people are kind of using Bitcoin to have fun. But exactly as Mike was saying, it caused the fee rates to go up in 2023. And that interfered with some Lightning technology and some other stuff. So it's just very hard to get anything done, because if you do anything at all, it's bound to make some people sort of confused or upset. And so basically every single decision you could possibly make is controversial. And we've decided that we're not going to do anything controversial, so that we could have, for example, unlimited extra block space on these merge mine L2s. And that's what the sidechain's idea was, and that's what BIP300 is. I agree with Nick that we're not going to have BIP300 on BTC anytime soon. We're not going to have OPCAT. We're not going to have OPCTV. We used to do two soft forks on average every year. We did 14 in the first seven years, but now we don't do any at all. And Taproot took 46 months from when it was first proposed to when it finally activated. So we could easily change all this around. The Bitcoin culture and the way we do things here, we just don't prioritize users, and we just don't prioritize the fees. So we could do it. But in one sense, nothing is stopping us from doing that. But in another sense, it's just we kind of collectively decided as a culture that we're just not going to do it, which is a big mistake. But I have one final thing to say, which is, see, you're running a pool. Nick is running one of the pools, one of the big pools. It's not that big, but it's on the pie chart. Bro! So you guys are the responsible party in a way. You guys are the specialists. You guys run the block template. You guys can orphan blocks. So you could call up your other pool friends, and you could activate all these soft forks tomorrow. I'm just saying, partially this is the mining pool's decision to just fire a gun into their own skull and end their own lives. So that is one weird aspect about it. That's akin to a coup, though, in a way. It's a coup to basically keep themselves alive and keep the Bitcoin network growing and obtaining more users, I think. But I agree with you. He's right, because this is the element in the culture that it's for anyone to just do anything unilaterally is seen as a kind of betrayal of the peace and tranquility that we've all enjoyed for the last whatever. If I can jump in, the problem, I think, is because of the halvings. It's basically we're a frog in a boiling pot of water, and the temperature's going up really slowly, really slowly, really slowly. And so nobody's concerned about the fee market right now because there's a subsidy. And everybody assumes, oh, okay, well, if the price doubles and the Bitcoin subsidy halves, well, that's net-net. Everything's even. A lot of people believe that, but I think all four of us know that that's not true. That's not the way it works. Or take out a piece of paper and start multiplying, and you'll see that doesn't work. So the security budget, in actuality, needs to be one Satoshi more than the attack budget. So Bitcoin always must be profitable to mine with your hash. If you can acquire hash, it has to be more profitable to mine with it than it is to try to attack Bitcoin. The more expensive Bitcoin gets, the more value it has, the more attractive target it is for attack. So it actually does not help. The number to go up does not help the problem. I thought you were going to say something, Paul. This is kind of a tough panel, guys, because you all have said something just now that I could latch onto for a follow-up conversation. Like, for instance, Mike, you kind of hinted at this catch-22 with Bitcoin's block space, this idea that there's not actually big enough to furnish the use cases that would drive fees in a way that doesn't hamper other use cases, like Paul was saying. For instance, when the ordinal's craze was popping off, people would be running lightning routing nodes, and they would close channels or have channels forced closed, and all of their revenue from that routing node was gone because fees were crazy. Anyway, that kind of struck me. If you build anything with the assumption that fees will eventually be cheap enough, then you're going to lose all your money. Right, right. Anyway, that kind of struck me as just a fee, and I just wanted to point it out. And I would like to get back to the developer discussion in a second in terms of thinking about what quantum means for threatening any other opcode being added that would actually improve functionality. But first, I do want to return to quantum in a different element with you, Mike, specifically this hourglass proposal that you co-authored. Can you explain to people what this is and also how it might, as a side effect, solve this problem? Yeah, sure. Taking time, I'll try to be brief. I'm sure most people are familiar with Satoshi's coins, this vast trove, and most people aren't worried about them. They've been written off so thoroughly because they haven't moved since 2011 or earlier, 2010. This represents a whole class of coins. It's P2PK, noticeably not P2PKH. It's not protected by that hash element, which means these coins exist on-chain with a public key exposed, and they are 100% quantum vulnerable to a cryptographically relevant quantum computer. That means somebody could, with any amount of time, they can crack them with a sufficient quantum computer running Shor's algorithm. These coins are exposed. They're presumed dead, so nobody's going to move them and migrate them over. Let's say we activate bit 360. Let's say we have post-quantum cryptography. Great. It's all safe. Nobody's going to move those coins. They're going to be there, presumably forever, until a quantum attacker steals it. We did the math looking into this, and it would take 1.7 million bitcoin, not dollars. 1.7 million bitcoins are in this class. The original ones, 50 BTC per pop mining rewards. These coins could be moved by a single entity if they pre-cracked the entire set in three hours' time. That's how long it would take a quantum attacker to actually mine all of those into an address they control outright under whatever. Presumably, they could even flood them onto the market and crash the entire market. That is the problem statement. There are factions who say, well, we can't allow this. Those coins are supposed to be dormant. They're supposed to be dead. That's not what I bought into. We should freeze or burn these coins. That would mean freezing or burning Satoshi's coins, amongst others. I think that's kind of an anathema to what bitcoin represents and property rights. You have the one side, which are the liquidationists. Liquidationists say, not your keys, not your coin. If they get the keys, it's theirs. This is freedom. The other side says, no, we have to protect. What Hourglass is, is it's a compromise solution between these two camps. The original Hourglass proposal, one output, one P2PK output, was allowable per block. That means 50 BTC could be released per block, which means it would take about eight months to run through that supply, as opposed to three hours. The most recent version, Hourglass V2, that actually stretches it out, because it only allows one BTC to be released from one of these addresses per block. That actually stretches it out over 32 years. Getting back to your original point, because I know this took a long time to get there, but getting back to your original point, how does this affect the security budget? Well, if the stars aligned and everything went right, and there actually was a credible quantum threat in the near-term future, and Hourglass was activated, and they did attack these coins as a salvage right, because they're unclaimed property at this point, and it was legitimized, so they weren't incentivized to steal other sets of unprotected coins, and everybody else moved those over. Well then, if there's one attacker, then they get all those coins. They get one BTC per block, or 144 bitcoins a day, which is not that bad. The second, and this is over the course of 32 years, if Satoshi doesn't move his coins, the second attacker now has to bid against the first one, and this creates an incentive. It's a race condition, because they have to pay the miners. They have to pay the mining pools. And just to be, for context, they would be doing an RBF or a place-by-few? No, not an RBF, because it's not the same transaction, right? There's only one allowable transaction. The miner picks which one. They're only allowed to pick one, and that one can be at max one bitcoin out. The rest has to be refunded to the address. So it's not necessarily an RBF, but similar characteristics. But it would be a fee-bidding war for those? A fee-bidding war, yes. And then those fees would go to the miners, and it would be a way to increase their revenue? Yes. You would effectively guarantee that there's one bitcoin worth of fees paid in each block? Yes, provided you have enough parties bidding against each other for this. This is my question, because this assumes that one of them just doesn't give up at one point, right? Well, it depends. If you already have the keys cracked, it's a sunk cost. If you get 1% of a bitcoin, that's better than getting nothing, right? So if you've already spent the effort to crack the key, would you rather get nothing for it, or get something for it? Welcome to Predict. The world is a market. Everything is a market. Every headline moves the line. Every moment is your market. Call the moves. Bet on your instinct. Your prediction. Your edge. Dual Bits. Predict. Where everything is a market. You presented on this at OpNext, BlockSpace's conference in New York last week, or two weeks ago. What are your thoughts on this as a miner? And then Paul will go to you for your thoughts. Yeah, I mean, I'm going to be advocating pretty heavily for it. Yeah, the OpNext conference presented by BlockSpace was a great conference. Thank you, Colin. And so when I was at OpNext, presented by BlockSpace, yeah, we talked a lot about Hourglass, and I think that, you know, Yeah, we talked a lot about Hourglass, and I think that, you know, it was actually well-received. I actually thought that I was going to get a lot of boos from the crowd, because that's like a hardcore Bitcoiner, like Bitcoin core kind of dev conference. And I expected that the majority of the folks there would really not like it, but it seemed like it was well-received. So I was pretty excited. I mean, it feels like there's actually real possibility that we could get an Hourglass fork in. Some would say it's better than 361. Oh, yeah. So 361 is the proposal to freeze any of the coins that are quantum susceptible after some date, which is, you know, basically the seizure. I don't advocate for that. I think that's antithetical to Bitcoin. I don't think that's the way that we should go. I'm also, I am very concerned about, you know, option one, which is do nothing, because it will demolish the market. And it'll be who knows how long until the market reforms. It could take decades. And the problem is, I want to be around to see Bitcoin hyper-Bitcoinization. And if they demolish the market and, you know, all these coins, you know, there's actually 6.7 million coins. It's a whole thing, but that are susceptible to being stolen. If that hits the market, like it's never coming back, probably not in my lifetime. Institutions are just out there. Like, I don't know really what happened here. Bitcoin went down by 90% in two days. I'm out. I just am out. So I don't know what to do about that. And so I think that Hourglass is really a great solution to slow that trickle and potentially, you know, have the majority of those coins, which are inevitably going to be stolen anyway, flow to miners who are most asset aligned. Hourglass is, I think, a pretty good idea. It does have two drawbacks with respect to the security budget. One is it requires that the quantum computer actually be built, which is not a foregone conclusion. It may not actually be built. You don't think so? You don't think it's a foregone conclusion? I think that a lot of people are weighing in, but very few people know. So I would be in favor of a prediction market or something that would say, like, will it be built by this date or something so that the insiders can tell us. I actually take that as another argument for Hourglass. Sorry to get you off, Paul. Because if it is, I'll let you do your second point. But versus a confiscation, if a confiscation, if you implement it early, you have to time it right before a quantum attack. Otherwise it's worthless and you've wasted everything. Hourglass, if it's enacted early and there is no quantum computer, it's minimal harm. Because anybody who wants to recover those keys still can. Yeah, you can still spend one BTC per week, which is kind of a lot of money. Sorry to interrupt your second point. I think it's still a very good idea. It does require that the quantum computer be built and crack all the keys and that they be posted on a website or just anyone can do it with a cheap quantum computer. The other problem is that when all those coins have been spent, now we've kicked the can down the road. We have this artificial one BTC per week subsidy and then it will just fall off a cliff to zero at the end of the third. Well, there's nothing prohibiting a future soft fork to smooth it later. But I don't advocate that initially. I'd just like to quickly say that I'm in favor of merge-mined L2s and that's what the 301 are. We could have an unlimited number of L2 blockchains and the miners could automatically collect the transaction fees from all of them without doing any extra work. And that would enable them to collect, again, huge amounts of money. For example, there used to be this site. There still is. It's called cryptofees.info. You can look up all the transaction fees paid, basically the security budget, more or less, paid by each blockchain. And you see that Ethereum, the number is always higher than BTC. Sometimes it's 10 times as much. So that's just something to think about, that we could have those with merge-mined L2s. All righty, gentlemen. We got two minutes, 45 seconds left. Quick lightning round. One of the solutions outside of transaction fees getting juiced up to this problem has been the idea of extending Bitcoin's emission schedule. Tail emissions, basically extending the block subsidy in perpetuity. What do y'all think of this proposal and why do you think it is or isn't a good solution? I think it's a bad idea. I mean, you'll get two forks anyway. You'll get two Bitcoins at the end of that anyway. And I'm pretty sure that everybody will just go with the one that doesn't add a tail subsidy. And then maybe in like 20 years, they'll come back and realize that was a mistake. But I don't think you'll ever get any support for it. And I think it's because when you bought Bitcoin 15 years ago, you were sold the idea of 21 million. You look around, you see 21 million all over the signage here. That's a big selling point of Bitcoin and you kind of destroy that. So I don't think it will ever happen and I would push against it. I agree. I don't think a tail emission is something that's part of the contract people signed up for when they bought Bitcoin. Everybody was sold on a 21 million hard cap forever. That's the entire premise of it. It is sound money, hard money, unchangeable. That's the bill we were all sold. If that changes, that could undermine the entire value proposition of Bitcoin itself as a hard money. Not to say if we don't do something, it may be inevitable. I don't know at what point it would be, but I mean, really? We're going to have to start taking some really hard looks, like I said, within the next six years. Because Monero's tail emission is at the rate that we will be for the subsidy in 10 years. So even if we freeze it there, it will be less than Monero and Monero is regularly 51% attacked. So obviously the tail emission is not enough for Monero. And this is good timing for that because we just had a Litecoin attack also. So all that is related to... For years, everyone has said, oh, don't worry about the security budget. But now all of us are being vindicated who brought it up. About tail emission, I think, you know, we just did a year of bike shedding over the optional configurable op return standardness byte parameter or something. So I completely agree with Nick that there would just be endless bike shedding and no one would ever be able to agree on that, I think. And I also agree with Mike that it wouldn't even solve the problem, really, I think. Gentlemen, thank you very much. Let's give it up for our panelists, y'all. Thank you, guys. Thank you. Every year, this community comes together to celebrate, to debate, to build what comes next. And every year, the stage gets bigger. Sound money, center stage. So where do you go to celebrate the next chapter in Bitcoin history? You come home. Nashville, July 2027.