A CPU-mined fork of Bitcoin Core with quantum-resistant addresses by default
Abstract. TrueNorth is a peer-to-peer electronic cash system derived from Bitcoin Core. It keeps Bitcoin's transaction model, scripting system, SegWit and Taproot, and changes four things: proof of work is a RandomX variant that commodity CPUs mine efficiently; difficulty retargets every block; the block subsidy declines to a permanent floor instead of to zero; and the default output type commits to a hash of the spending key rather than exposing it, with a registry that lets post-quantum signature schemes be added by soft fork. This document describes each change, the reasoning behind it, and what it does not protect against. Every parameter here is taken from the source code, which is authoritative where the two differ.
Bitcoin's design has held up for seventeen years, and TrueNorth does not try to improve on its transaction model. It addresses three narrower concerns.
Who can mine. SHA-256d mining is dominated by specialised hardware, so taking part requires buying equipment built for no other purpose. A proof of work that runs well on ordinary processors lets anyone with a computer contribute hashrate and earn from it, which spreads block production across more independent hands.
Keys exposed on chain. A sufficiently large quantum computer running Shor's algorithm could derive a private key from a secp256k1 public key. Many Bitcoin outputs already reveal their public keys — early pay-to-pubkey outputs, every reused address, and every Taproot output, whose key is the output itself. Those coins would be exposed the moment such a machine exists, whether or not their owners ever move them. A new chain can choose an output type that hides the key until it is spent, and can plan for new signature schemes from the start rather than retrofitting them.
Paying for security forever. Bitcoin's subsidy halves toward zero, after which miners are paid only by fees. Whether fees alone will fund enough security is an open question. TrueNorth answers it by keeping a small permanent subsidy.
TrueNorth Core is a fork of Bitcoin Core and inherits, unchanged: the UTXO model, Script, SegWit (BIP141/143), Taproot (BIP340/341/342), descriptor wallets, PSBT, the P2P protocol and its relay and mempool policy, and the reorg, validation and storage machinery. It has no smart-contract platform and no on-chain governance. A TrueNorth node and a Bitcoin node will not peer: the network magic, ports, address prefixes and genesis block all differ.
Block headers are hashed with RandomX, the proof of work Monero has used since 2019. RandomX executes randomly generated programs on a virtual machine designed to resemble a general-purpose CPU — integer and floating-point arithmetic, branches, and random reads from a large memory dataset. The work rewards exactly what desktop and server processors are built to do, which narrows the advantage specialised hardware can gain.
TrueNorth's variant, RandomNorth, changes RandomX's Argon2 salt to
TrueNorth/RandomNorth/v1. The salt feeds the dataset construction, so a stock
RandomX miner produces valid-looking work for a different proof of work entirely: its hashes
are real, but they cannot satisfy TrueNorth's difficulty. Hashpower rented for or pointed at
Monero cannot be redirected here without a purpose-built miner.
The RandomX key — the seed from which the dataset is derived — rotates every 2,048 blocks (about 2.8 days), taken from a block hash 64 blocks in the past so miners can build the next dataset before it is needed. Mining uses RandomX's fast mode with a dataset of roughly 2 GiB; verifying a block uses light mode with a cache of roughly 256 MiB, so running a node does not require mining-class memory.
What this does not claim. RandomX is designed to resist ASICs, not to make them impossible. RandomX ASICs exist. The aim is to keep any specialised advantage small enough that commodity CPUs remain competitive. Nor is CPU-friendliness a defence on its own: an attacker can rent CPU time as easily as anyone else, which is why the security measures in section 7 do not rest on proof of work alone.
Blocks target 120 seconds. Difficulty is set by LWMA-1, a linearly weighted moving average of solve times over the last 90 blocks (about three hours), recomputed for every block. Recent blocks carry the most weight, so difficulty follows hashrate within hours rather than weeks.
Bitcoin's 2,016-block retarget works for a large, stable network. On a small one it lets a miner arrive with a burst of hashrate, mine many blocks cheaply at the old difficulty, and leave the honest network stuck at an inflated difficulty until the next window. Per-block retargeting removes that window.
Pay-to-Quantum-Resistant-Hash (P2QRH) is a new SegWit output type at witness version 2. It is the wallet default.
scriptPubKey: OP_2 <32-byte commitment>
commitment = SHA256("TrueNorth/QRH/v1" || scheme_id || pubkey || script_root)The output holds a 32-byte hash, never a public key. scheme_id is one byte
selecting a signature scheme, pubkey is that scheme's public key, and
script_root is the root of an optional tree of alternative spending scripts,
following Taproot's design (all zeros when there is none). The domain-separation prefix
prevents a commitment from colliding with any other hash. Addresses are bech32m with the
prefix north1z…, 65 characters long — three more than a Bitcoin Taproot
address, a difference that comes entirely from the longer human-readable prefix.
To spend, the witness reveals scheme_id, the public key and the signature.
Consensus recomputes the commitment from them, checks it matches the output, and only then
dispatches to the verifier that scheme_id names. A script-path spend reveals a
script and a Merkle proof against script_root instead, exactly as in Taproot.
| scheme_id | Scheme | Status |
|---|---|---|
0x01 | secp256k1 Schnorr (BIP340) | Active |
0x02 | ML-DSA-44 | Reserved |
0x03 | Falcon-512 | Reserved |
0x04 | SLH-DSA-128s | Reserved |
Today only Schnorr is valid; any other scheme_id fails at consensus. Because
the output commits to a hash regardless of scheme, a post-quantum scheme can be activated by
soft fork without a new output type, a new address format, or any change to existing coins.
Users would move funds to a commitment under the new scheme when they choose to, using the
same kind of address they already have.
A P2QRH output is 34 bytes, identical to a Taproot output, so the UTXO set does not grow. A Schnorr key-path spend adds about three witness bytes over Taproot. Post-quantum schemes have far larger keys and signatures, but that cost falls only on the transaction that spends, and only when it uses one.
subsidy(height) = max(512 >> floor(height / 1,051,200), 8) NORTH| Era | Approximate years | Subsidy per block |
|---|---|---|
| 1 | 0–4 | 512 |
| 2 | 4–8 | 256 |
| 3 | 8–12 | 128 |
| 4 | 12–16 | 64 |
| 5 | 16–20 | 32 |
| 6 | 20–24 | 16 |
| Tail | 24 onward | 8, permanently |
The halving interval of 1,051,200 blocks is four years at two-minute blocks, the same period as Bitcoin. The six halving eras issue 1,059,609,600 NORTH. After that the subsidy stays at 8 NORTH a block, about 2.1 million NORTH a year — roughly 0.2% of supply at that point, and a smaller percentage every year after, because the issuance is fixed while the supply grows. There is therefore no hard cap. The smallest unit is the miette; one NORTH is 100,000,000 miettes.
How coins come into existence. Only through block subsidies, paid to
whoever mined the block. There was no presale, no ICO, no airdrop and no founder
allocation. The genesis block's output is an OP_RETURN and can never be spent.
There is no dev fee: the coinbase pays a single output, and consensus limits its amount but
never its recipient. Mining pools and third-party miner software may charge their own fees;
those are theirs, not the protocol's. Newly mined coins can be spent after 100 blocks.
A small proof-of-work chain can be attacked by anyone who briefly controls more hashrate than everyone else combined. TrueNorth does not pretend otherwise. It combines several measures, each covering a different part of the problem.
A node refuses to disconnect more than 72 blocks (about 2.4 hours) from its own chain tip, however much work the competing chain carries. Past that depth a double-spend is not merely expensive — it is rejected. The cap has two limits. It protects a node that holds a tip; a node syncing from scratch has nothing to defend and will follow the most-work chain it is shown. And a refused reorg splits the network between nodes that saw the honest chain and nodes that didn't, which takes operator action to resolve. It turns a silent theft into a visible incident; it does not make the chain unattackable.
Newly mined coins become spendable after 100 blocks, which is deliberately more than the 72-block cap. By the time a coinbase can be spent, no reorganisation the network will accept can remove the block that created it.
The project recommends that exchanges and merchants treat a payment as final after
100 confirmations — a fixed number above the reorganisation cap, rather
than one computed from hashrate. Below about six confirmations, ordinary chain races can
reverse a payment with no attacker involved. Between six and 72, safety depends on the
payment being worth less than the cost of rewriting that many blocks, which moves with
hashrate. Above 72 it does not depend on hashrate at all. The cost arithmetic, with worked
examples, is in doc/reorg-economics.md.
The RandomNorth salt (section 3) means existing RandomX hashpower cannot be pointed at the chain without a purpose-built miner, and at the time of writing no hashrate marketplace sells RandomNorth. That raises the cost of a quick attack. It is a barrier, not a guarantee — supporting the salt is a small code change.
Releases can carry checkpoints that fix known-good blocks in place, inherited from Bitcoin Core. Separately, mainnet consensus rejects any non-genesis block whose timestamp is earlier than the launch instant, 2026-10-12 00:00:00 UTC. That rule constrains block timestamps; it is not a statement about when work was done.
The longer-term defence is to commit TrueNorth block hashes periodically into a
higher-hashrate chain, most likely Bitcoin, so that any reorganisation past a notarised
point can be rejected regardless of proof of work — including for a node syncing from
scratch, the case the depth cap cannot cover. This is designed but not built, and has no
committed date. The design space is documented in doc/notarization-design.md.
Merge-mining with a larger chain is the strongest known defence for small coins, but it ties mining to that chain's miners and hardware, which defeats the purpose of CPU mining. And there is no counter-attack remedy: out-mining an attacker to reverse a reorganisation is itself a 51% attack, and would demonstrate that the chain's history can be rewritten. The response to an attack is prevention and coordinated node updates, not retaliation.
| Ticker | NORTH |
| Smallest unit | 1 miette = 0.00000001 NORTH |
| Proof of work | RandomNorth (RandomX, salt TrueNorth/RandomNorth/v1) |
| Seed rotation | every 2,048 blocks, 64-block lag |
| Block target | 120 seconds |
| Difficulty | LWMA-1, 90-block window, every block |
| Subsidy | 512 NORTH, halving every 1,051,200 blocks, floor 8 NORTH |
| Coinbase maturity | 100 blocks |
| Reorg depth cap | 72 blocks |
| Default output | P2QRH, witness v2, north1z… |
| Ports | 9555 P2P, 9554 RPC |
| SLIP-44 coin type | 1867; P2QRH derivation m/88h/1867h/0h/… |
| Genesis | 470c8b8ae824c06575cfae0851282c495b861829211194842590dc6a2c829981 |
| Launch | 2026-10-12 00:00:00 UTC |
src/randomx/doc/specs.md).TRUENORTH_SPEC.md, doc/p2qrh.md,
doc/reorg-economics.md, doc/exchange-listing-guidance.md,
doc/notarization-design.md.