About 35 percent of unspent Bitcoin sits at addresses whose public keys are already visible on the chain. PACT lets those holders record control of an address now, with no transaction, without naming the address, and without telling anyone they hold anything at all.
On 5 November 2026 the aggregator sealed a batch, routed it over Tor, and submitted its root to public timestamping servers. Six minutes later it was committed to the Bitcoin chain. The batch contained only padding, no member data, so the submission itself reveals nothing — which is the property the design exists to provide.
Stated precisely: the transaction's OP_RETURN carries the timestamping calendar's aggregated root. The batch root sits inside that aggregation, and the proof file is the path joining the two. That is how the scheme is designed to work, and it is what anyone verifying the claim will find.
A protocol change that disables spending from exposed-key addresses would require every affected holder to have recorded control in advance. Recording it afterwards is precisely what the change prevents.
Measured at block 959,800, between 34.911 and 35.005 percent of unspent supply is exposed. A public key becomes visible the first time an address spends, and for some older address types it was never hidden. Those keys are what a sufficiently capable future adversary would attack, and the coins behind them cannot be made private again.
The obvious way to record control is to move the coins to a safer address. That is a public, permanent, attributable transaction. For anyone whose safety rests on nobody knowing what they hold, the remedy is worse than the risk.
Holders in jurisdictions where owning Bitcoin is dangerous, and large self-custodied holders whose cost of acting rises with the size of what they hold. Both are deterred from protecting themselves by the act of protection.
The holder signs a message with the key that controls the address. The signature never leaves their machine and no transaction is broadcast.
The signature and a random salt are hashed into a single 32-byte value. It reveals nothing about the address, the balance, or the holder.
A pool batches commitments from many holders into one Merkle tree and anchors a single root in the Bitcoin chain, so no individual submission is visible.
If a recovery path is ever opened, the holder reveals the original values and the timestamped record stands. Until then, they have disclosed nothing.
Bar length is each deliverable's share of the proposed budget; the filled portion is what is finished. Weights are those submitted on the application form.
Aggregates commitments from many holders, batches them into one Merkle tree and anchors a single root.
The program an individual holder runs: guided, validated, reproducible on three platforms.
What the scheme protects against, what it does not, and every assumption it rests on.
Operational guidance for non-technical holders, written to be translated.
Test vectors so any independent implementation can be checked against the reference.
Months run from grant start. Diamonds mark the three success measures committed to on the application.
Three conditions. Published is a release. Running means an unbroken sequence of sealed intervals a reader can inspect. Independently reproducible means someone who is not the author rebuilds from source and obtains the same artefact.
The document is written and published. The measure's weight sits in the review: a threat model is an argument rather than a measurement, so it cannot be self-certified, and the author is the last person able to judge whether it is complete.
With the failure modes found and fixed documented. The record has to show what testers got wrong and what changed because of it, which is what makes the result useful to anyone building something similar.
Three of these measures need people from outside the project: someone to rebuild the software from source independently, two reviewers with security expertise, and five non-technical holders to test the tool. Nobody is being hired and no budget is set aside for them. They are unpaid contributions from people who think the problem is worth an afternoon, and the work is specified and open precisely so that an afternoon is enough.
A grant is a claim about the future, so the thing worth offering is a record of how claims get checked. Three practices the work is held to.
When something turns out to be wrong, the correction is recorded where the mistake was, not quietly overwritten. The conformance suite's own notes explain why its passing result is weaker evidence than it looks. The scheduling code opens by recording that an earlier plan cited the wrong source. The threat model states on its own face that nobody outside the project has reviewed it.
The commitment format is pinned by conformance vectors derived independently of the code that implements it, so an outside developer can check their own build against the reference rather than taking it on trust.
Finished components are handed to an independent reviewer briefed to test them rather than confirm them. Nothing is released until every finding is closed and covered by a regression test that holds it closed.