Kairos
A peer-to-peer electronic cash system

Money should outlive the machines that mint it.

Kairos keeps what seventeen years of Bitcoin proved: SHA-256d proof-of-work, unspent outputs, the chain with the most work. It fixes, from the first block, what those years exposed: a security budget headed to zero, a fee market that swings, keys a quantum computer could break, and a history every new node must replay.

Genesis · testnet 2
000008fa96a695a8e30751146a123e55ee730693362e0acba2c43ce704b73c51
Coinbase message
22/Sep/2026 Kairos genesis: money should outlive the machines that mint it
time2026-09-24 00:00:00 UTC output0 KRS, unspendable header132 bytes preminenone
The ledger

What operation exposed, and what Kairos does from block 0

Every mechanism here has been deployed or analysed somewhere. The contribution is choosing them together, fixing them into consensus at genesis, and showing that they compose.

In Bitcoin
In Kairos
The block subsidy halves toward zero; long-run security depends entirely on fees.
Smooth emission with no cliffs that settles into a permanent 0.6 KRS per block, and a burned base fee that lets usage offset it.
Fees are a blind auction that swings by orders of magnitude.
A per-byte base fee adjusted every block, capped at 12.5% per step, burned rather than paid to miners. The fee for the next block is written into every header.
A large quantum computer could recover keys from exposed public keys.
Every address commits to a Schnorr key and a hash-based Lamport key. A built-in signalling mechanism lets the network switch spends to the hash-based key.
A new node must replay every transaction since 2009.
Every header commits to the full set of unspent coins. A new node verifies a snapshot against proof-of-work and downloads only what came after.
Signatures do not commit to the amounts being spent; hardware wallets needed BIP143 to see what they pay.
The signature hash commits to the value and address of every coin spent, and to the chain identifier, so signers know what they pay and replay across chains is impossible.
Difficulty retargets every 2016 blocks, which oscillates and invites timestamp games.
Difficulty adjusts every block on an absolute schedule (ASERT, two-day half-life). Two-minute blocks.
A small SHA-256 chain can be rewritten with rented hash power.
Merge-mining with Bitcoin from day one, in the format pools already use.
Malleability, Merkle ambiguity, duplicate coinbases and replay all needed patches.
Excluded by construction: witness-free identifiers, tagged Merkle hashing, height in the header and coinbase, chain id in every signature.
Emission

A security budget with a floor

Each block pays a fixed fraction of what remains on a 21 million curve, never less than the tail. There is no scheduled moment when a large share of hash power becomes unprofitable at once.

subsidy = max( 0.6 KRS , (21,000,000 KRS − issued) / 221 )
10.01KRSFirst block
5.5yearsHalf the curve issued
0.6KRSPer block, forever
60motes/BBase fee that offsets the tail

Cumulative issuance, first forty years

Kairos, 2-minute blocksBitcoin, 10-minute blocks
Values by year
Years since genesisKairos, KRSBitcoin, BTC

Computed in this page from the subsidy rule, block by block, with 365.25-day years. Before the fee burn: net growth is the tail minus what blocks burn, and it reaches zero when the average block burns 0.6 KRS.

Quantum switch

Prepared at genesis, not at the moment of crisis

A large quantum computer breaks elliptic-curve keys. Hash functions it only weakens. Every Kairos address already holds a hash-based key in reserve, and the rules already contain the mechanism to switch to it.

A Kairos address commits to a Schnorr public key and the hash of a Lamport public key
An address is the hash of a Schnorr key and a Lamport key root. Neither key is revealed until the coins move.

How the switch works

Miners signal readiness with a bit in the block header. Once 95% of a 2016-block window signals, the change locks in, and one window later it is active: elliptic-curve spends become invalid and every coin can still be spent with its Lamport key. Nobody's coins are frozen and none are stolen.

The switch has a start height of zero and no timeout, so it stays armed for the life of the chain. For the case where miners cannot be trusted to signal in time, an emergency release can fix it at a flag-day height.

The first rehearsal is running on testnet 2 now. Follow the announcement thread for the activation height.

DEFINEDBefore the start height. The bit is ignored.
STARTEDMiners signal. Counted per 2016-block window.
LOCKED_IN1916 of 2016 signalled. Activation is now certain.
ACTIVEOne window later. Only Lamport spends are valid.
State & sync

Every header commits to the whole state

The commitment is a MuHash over the multiset of unspent outputs: adding a coin multiplies it in, spending one divides it out. Any node maintains it as it validates, in constant time per coin.

Three consecutive 132-byte headers, each committing to its parent, its transactions and the resulting UTXO set and next base fee
The 132-byte header in serialisation order. The UTXO root and the next base fee are the state a node needs to continue from a snapshot.

Fast sync

A new node downloads headers, validates their work, fetches a UTXO snapshot from anyone, and adopts it only if its hash equals the commitment in a header it has verified. Issued supply is recomputed from the schedule; burned supply follows by conservation; the base fee is read from the header. History below the snapshot is never downloaded and cannot be reorganised.

Headers first

A peer's whole chain of headers is checked for work, schedule and timestamps before a single block body is requested. Bodies are then fetched in order from every peer that has them. No peer can make a node download a chain that does not carry the most work.

Run a node

Join testnet 2 in three commands

Python 3.9 or newer, macOS or Linux. Your node finds the network through the built-in seed nodes. The first start creates an encrypted wallet and prints a backup code; write it down.

$ git clone https://github.com/Nimsalcade/kairos.git && cd kairos
$ python3 -m venv .venv && .venv/bin/pip install coincurve
$ .venv/bin/python -m kairos --testnet node --mine
# leave out --mine to only validate and relay; add --signal pq to signal for the quantum switch
Frankfurt95.179.255.186:19333
Singapore45.76.176.39:19333
Miami207.246.114.19:19333
infoHeight, supply, base fee, soft-fork state
balanceYour coins; rewards unlock after 20 blocks
addressA fresh address to receive coins
send <addr> <amount>Pay someone; Lamport-signed once the switch is active
utxo exportWrite a snapshot other nodes can start from
rpc getdeploymentinfoWatch the signalling count for the quantum switch
Status

What it is, and what it is not yet

Kairos is an experimental, unaudited public testnet.

Testnet coins have no value and never will. There is no mainnet, no token sale, no presale and no airdrop. Anyone offering to sell you Kairos is scamming you. If a mainnet ever happens it will be a fair launch, with the software and the genesis timing published before anyone mines.

Soft-fork activation by miner signalling, built into consensus
Headers-first synchronisation and peer discovery
UTXO snapshot export and import, verified against the header commitment
Public testnet on three continents; 82 tests on two signature backends
Quantum-emergency rehearsal on the live testnet (in progress)
Independent consensus and cryptography audits
A second implementation, cross-tested against this one
At least six months of public testnet with no consensus bug in the final ninety days

The full list of conditions for a mainnet is in LAUNCH.md. Known limitations and the private reporting channel for security problems are in SECURITY.md.