Runes in 2026: Who Pays Bitcoin’s Security Bill?

On the first day of November 2026, Bitcoin looks tired. The price sits at $77,580.54 on CoinGecko, down about 4% on the week and roughly 38% below the record $126,080 it printed on 6 October 2025. The mempool is almost empty: mempool.space shows fees pinned at one satoshi per virtual byte across every priority tier, with fewer than 45,000 transactions waiting. The Runes market that once pushed those fees to record highs is quiet too. The category that Casey Rodarmor minted into existence trades at a headline figure near $135 million, but strip out one glitchy micro-cap reading and the real number is closer to $105 million, and a single dog-themed token accounts for roughly four fifths of it.

Quiet markets are easy to ignore. This one should not be, because it lands on top of a question that has nothing to do with memecoin prices and everything to do with whether Bitcoin can pay to defend itself a decade from now. Runes were not an accident of timing. They launched at the exact block that cut Bitcoin’s block subsidy in half, and the pitch, at least from the people who cared about miner economics rather than quick flips, was that on-chain token issuance might help replace the revenue that halvings keep taking away. Two and a half years later, the data says it has not, and the gap is getting harder to wave off.

This is a story about fees, not prices. It is about who pays Bitcoin’s miners once the printer slows, whether a protocol built for degens can double as public infrastructure, and why the emptiest mempool of the year is the clearest view yet of a problem that arrives in full around 2028.

What a Rune Is, and Why It Arrived at the Halving

A Rune is a fungible token that lives directly in Bitcoin’s own ledger, with no sidechain, no bridge, and no smart-contract platform underneath it. The protocol, designed by Ordinals creator Casey Rodarmor, encodes everything in a single OP_RETURN output called a runestone: etch a new token, mint an existing one, or transfer balances between unspent outputs. Because the state rides inside ordinary Bitcoin transactions, you need an indexer such as ord to read it, but the base chain treats a runestone as just another spend. The full ruleset, from name encoding to the Terms that cap a mint, lives in the Runes specification.

Rodarmor never pretended he was building high finance. In the run-up to launch he described Runes as a protocol built for degens and memecoins, and in a podcast he framed himself, bluntly, as someone creating a venue for people to create sh*tcoins, a characterization CoinDesk reported at the time. That honesty matters for everything that follows, because it means Runes was optimized for speculative churn, and speculative churn is exactly the kind of fee demand that comes and goes.

The timing was the clever part. Runes went live at block 840,000 on 20 April 2024, the same block that triggered Bitcoin’s fourth halving and cut the subsidy from 6.25 to 3.125 BTC. Miners woke up that day earning half as much new Bitcoin per block, and a brand-new reason for people to compete for block space arrived in the same instant. If you want to understand why miners watch token protocols at all, start with hashprice, mining’s key revenue metric: every satoshi of fee demand is hashprice that does not depend on the subsidy. Runes was, among other things, a bet that memecoins could become part of that non-subsidy income. Checking the bet is the rest of this article.

The Security Budget in Plain Terms

Bitcoin’s security budget is the total amount paid to miners to keep the chain honest: the block subsidy of freshly minted coins plus the transaction fees users attach to their payments. The logic is simple and unforgiving. The more a block is worth, the more hashrate chases it, and the more expensive it becomes for anyone to rent enough hashrate to rewrite recent history. Spend less on security and the cost of attacking the network falls, which is a strange thing to let happen while trillions of dollars and a growing list of regulated products come to rely on the ledger staying immutable.

Put concretely, the security budget is the price of a rewrite. To reverse a confirmed Bitcoin transaction, an attacker has to out-mine the honest network long enough to build a longer chain, which means commanding a majority of the hashrate and burning real money on electricity and hardware to do it. The larger the ongoing reward miners collect, the more hashrate they deploy, and the more an attacker has to spend to overpower them. That used to be an abstraction. It is less abstract now that spot Bitcoin exchange-traded funds, corporate treasuries, and lending desks hold the asset in size, because the people relying on the chain to stay final are no longer just hobbyists. A security budget is insurance, and the premium is scheduled to fall.

Right now the subsidy does almost all of the work. At 3.125 BTC per block and roughly 144 blocks a day, Bitcoin issues about 450 new BTC daily, which at recent prices values the annual security budget near $13 billion, a figure Spark pegs to a $79,000 Bitcoin. Fees are a rounding error on top. The problem is the word subsidy: it is scheduled to vanish. Every 210,000 blocks, about four years, the subsidy halves. It fell to 3.125 BTC in April 2024, it drops to 1.5625 BTC around spring 2028, and it keeps halving until it reaches zero sometime in the 2130s. Spark’s projection has issuance falling to roughly $6.5 billion a year after 2028 and about $3.2 billion after 2032, assuming prices hold.

The idea is that fees are supposed to grow into the space the subsidy vacates. For that to work, a block full of transactions needs to be worth something close to what the subsidy pays today. Spark runs the arithmetic and arrives at an uncomfortable number: to replace the current 3.125 BTC subsidy at Bitcoin’s present throughput, the average transaction fee would need to be about $82, roughly 140 times the $0.57 an average transaction costs now. Fees do not need to hit that overnight, but the gap shows how far a fee-funded Bitcoin is from today’s fee-funded Bitcoin. This is where Runes was supposed to help.

The Day Runes Paid the Miners

For exactly one day, the bet paid off spectacularly. When Runes went live at the halving, the scramble to etch and mint the first tokens turned Bitcoin’s block space into the hottest real estate in crypto. CoinDesk reported that the average Bitcoin transaction fee hit $127.97 on 20 April 2024, a record, and that fees made up around three quarters of per-block miner revenue during the frenzy. A two-years-on retrospective from self-custody firm Ryder put the day’s total miner fee haul near $107 million, and noted that the halving block itself carried more than 37 BTC in fees, worth over $2.4 million at the time, the most anyone had ever paid to be written into a single block.

The mechanics of that spike explain why it could not last. Etching and minting a rune is a two-step commit-and-reveal dance, and in the first hours after launch thousands of people raced to etch the shortest, most desirable names before anyone else could, each bidding up the fee to land in an early block. The halving block itself carried a prestige premium: being written into block 840,000 was a collectible in its own right, so bidders paid absurd sums for the privilege. None of that was recurring demand. It was a one-time land grab for scarce names and a famous block number, the on-chain equivalent of opening-night ticket prices. Once the names were claimed and the novelty wore off, the premium had nothing left to feed on.

For that window, Runes transactions were roughly 90% of all Bitcoin network fees. Nearly 7,000 runes were etched in the first 48 hours, according to a one-year retrospective from BlockEden. If you were a miner watching your subsidy get cut in half, this was the dream scenario: a new, organic, fee-paying use of the chain arriving to make up the difference. It was proof of concept that token issuance could, in principle, pay for Bitcoin’s security. The trouble is that a proof of concept is not a business model, and a single day is not a budget.

From Ninety Percent to Under Two

The decline was almost as fast as the launch. Within a week the average fee had fallen back from over $100 to the mid-teens, and within a month Runes accounted for under 20% of Bitcoin’s fees rather than the opening 90%. By early 2026, Ryder’s retrospective put Runes at less than 2% of Bitcoin’s network fees. BlockEden framed the whole arc in three words that have aged well: explosive launch, rapid decline, quiet building, with roughly two thirds of individual tokens trading below the price they minted at. The protocol kept working exactly as designed. The fee demand it was supposed to generate did not stick around.

That last row is where things sit today. A near-empty mempool and a one-satoshi floor mean miners are collecting almost nothing in fees, and whatever Runes activity remains is buried in the noise. For a protocol whose entire reason to exist, from the miner’s point of view, was to generate fees, that is a difficult look.

The Cambridge Numbers

The clearest measurement of the problem does not come from a crypto influencer or a token project. It comes from the Cambridge Centre for Alternative Finance, whose researchers Wenbin Wu and Alexander Neumueller published a study in 2026 titled Paying for Bitcoin’s security as the subsidy fades. Their headline figure is stark: over the 90 days to 4 October 2026, transaction fees made up just 0.67% of total miner revenue, and fees have stayed below 5% of miner revenue throughout Bitcoin’s entire history. Another way to read that 0.67% is that the block subsidy, the part that halves away, still supplies more than 99% of what secures the network.

The Cambridge team flagged something worse than the low level, though: the instability. They found that fee revenue swings about 11.7 times more from day to day than the price of Bitcoin itself. A security budget built on fees that volatile is not really a budget, it is a lottery. Miners can plan around a predictable subsidy; they cannot plan around a fee base that might be large during a memecoin frenzy and near zero the following Tuesday. The researchers packaged their work into a Security Budget Health Indicator that tracks five separate vulnerability dimensions, including the fact that mining is concentrated enough that the top three pools produced 60.8% of blocks and the top six produced 83.0% in a recent one-month sample. Spark’s own research reaches the same neighborhood from a different angle, putting fees at 0.43% of miner revenue in September 2026, up slightly from a 0.52% baseline in late 2025 but far below the 1% to 3% range Bitcoin saw between 2019 and 2022. Whichever number you prefer, the message is identical: fees are not filling the gap, and they are not even close.

The June Revival Was Traffic, Not Fees

It would be unfair to say nothing happened after the 2024 crash. In the summer of 2026 Runes came back to life, at least on the activity charts. CoinDesk analyst James Van Straten reported in late June that Bitcoin transaction counts had blasted past 820,000 in a day, a two-year high, driven by more than 600,000 runestones a day, with Runes briefly accounting for around a quarter of network fees again. For a few weeks it looked like the protocol had found a second gear.

Look closely, though, and the revival was about throughput, not value. Those were hundreds of thousands of cheap transactions competing for space in an otherwise empty mempool, not a sustained bidding war that lifted the fee per block to anything like April 2024 levels. The burst faded. By the time the leaves turned, the mempool was back at one satoshi per virtual byte and the revival was a line in a chart rather than a line in a miner’s income statement. The episode proved that Runes can still generate a wave of demand on command. It also proved that the wave recedes just as quickly, which is precisely the pattern that makes fees such an unreliable foundation.

A Spike Is Not a Budget

Here is the heart of the matter. Security costs money every single block, forever. Hashrate has to be paid whether or not anyone is minting a memecoin that afternoon. A revenue source that shows up for a weekend and disappears for a quarter cannot underwrite a cost that never takes a day off. That is why the Cambridge finding about volatility matters more than the finding about level. A fee base 11.7 times more jittery than the Bitcoin price forces miners to size their operations against the subsidy, the predictable part, and to treat fees as a bonus. As the subsidy shrinks, that mental model stops working, and nothing stable has arrived to replace it.

The problem gets quietly worse because of where Bitcoin’s activity is heading. Spark puts it plainly: every transaction successfully moved off-chain is a subtraction from the fee base that was supposed to replace the subsidy. Lightning payments, exchange-internal transfers, and issuer-run token rails all take volume that might have paid an on-chain fee and settle it somewhere cheaper. That is wonderful for users and for scaling, and it is a slow leak in the security budget. Contrast this with proof-of-stake networks, where block producers earn ongoing issuance plus fees plus the maximal extractable value that flows through every busy block. Bitcoin deliberately has almost no MEV and a disappearing subsidy, which leaves fees as the only lever, and fees are the lever that keeps slipping.

The Block-Space Fight Over What Counts as Real Demand

There is a political layer on top of the economics, and it cuts in a strange direction. Through 2025 and into 2026, Bitcoin ran through a loud argument about whether data-carrying transactions belong on the chain at all. Developer Peter Todd’s pull request 32359 removed the old roughly 80-byte limit on arbitrary data in an OP_RETURN, and Bitcoin Core version 30, shipped in October 2025, raised the default data size a node will relay to about 100,000 bytes. This is relay policy, not a consensus rule, so nothing was forced on anyone, but a chunk of the community treated it as a surrender to spam and migrated to the more restrictive Knots implementation, whose share of listening nodes climbed into the low twenties as a protest vote.

Sit with the irony for a moment. If you believe fees have to save Bitcoin once the subsidy fades, then data demand, inscriptions, tokens, and all the rest, is not spam at all. It is the paying customer. Every byte someone is willing to buy is a byte of security budget. The node operators trying to filter that traffic out are, in budget terms, trying to fire the only customers who show up when the mempool would otherwise be empty. Runes itself is mostly a bystander in this particular fight, because a plain runestone fits comfortably inside the old limit and rides the witness discount lightly, but the dispute frames the deeper question: does Bitcoin want the kind of activity that pays its bills, or does it want to stay lean and bet that price appreciation alone keeps the lights on?

Does BTCfi Change the Arithmetic?

The most credible case that Runes becomes durable fee demand runs through BTCfi, the small but real effort to build lending, trading, and programmable finance on Bitcoin itself. Liquidium lets holders borrow against Runes and Ordinals as collateral using hand-signed transactions and discreet log contracts, with no wrapping and no bridge. Alkanes, built by Oyl Corp, compiles smart contracts to WebAssembly and executes them through an indexer, aiming to give Bitcoin swaps and automated market makers without a new chain. Alec Taggart, who leads Alkanes, frames the ambition as a matter of identity rather than imitation: Bitcoin, he argues, does not need to copy Ethereum to evolve, because it is a native system built for those who believe Bitcoin is enough.

There is a catch that matters for the security-budget argument specifically. Much of what makes BTCfi programmable does not execute on Bitcoin at all. Alkanes compiles its contracts to WebAssembly and runs them through an off-chain indexer, so the heavy computation happens in software that watches the chain rather than in the chain’s own validation, a trust assumption that purists are right to flag. Liquidium leans on discreet log contracts and hand-signed transactions to keep custody with the user, which is elegant, but a loan opened and later closed is still only a handful of on-chain transactions. Even in the bullish case where BTCfi becomes genuinely useful, the fee footprint it leaves on the base layer is thin by design, because the whole point is to minimize what has to touch Bitcoin.

The theory is sound. Loans get opened and repaid, positions get liquidated, pools get rebalanced, and each of those is an on-chain transaction that pays a fee whether or not anyone is chasing a memecoin pump. Recurring economic activity is exactly the kind of non-speculative, always-on demand a security budget could lean on. The scale is the problem. Spark’s landscape work puts BTCfi’s total value locked at a peak near $9 billion in October 2025, a fraction of that today, with the share of circulating Bitcoin working in DeFi measured in parts per thousand against the double-digit percentages normal on Ethereum. Even if BTCfi grows several times over, it would have to grow by orders of magnitude, not percentages, before the fees it throws off register against a multi-billion-dollar security bill. BTCfi might eventually matter. It does not move the needle in 2026.

One Dog, Thin Books

The shape of the Runes market tells you why the fee demand is so fragile. Nearly everything is concentrated in a single token. CoinGecko shows DOG•GO•TO•THE•MOON at a market cap around $82.9 million, roughly four fifths of the whole category once you discard a plainly broken reading for one micro-cap. DOG at least has a clean story: it was a 100% fair airdrop, etched as rune 840000:3 and handed out to early Ordinals users with no team allocation and no presale, and it now trades across Bitcoin, Solana, and StarkNet. After DOG the drop-off is a cliff: MAGIC•INTERNET•MONEY near $12.5 million, then a scatter of tokens worth a few million or less.

There is a further twist that cuts straight against the fee thesis. DOG is not only a Bitcoin token; it trades across Solana and StarkNet and on centralized exchanges such as Kraken and Gate, and a large share of its day-to-day volume changes hands on those venues rather than on Bitcoin itself. When someone swaps DOG on a Solana decentralized exchange or inside an exchange’s internal ledger, Bitcoin collects nothing. So even the single rune that justifies the whole category routes much of its activity away from the base layer it was born on, wonderful for traders chasing cheap fills and quietly corrosive for the Bitcoin fee base that Runes was supposed to feed.

The glitch is worth a sentence, because it is diagnostic. One wolf-themed token showed a market cap near $31.5 million on CoinGecko while every other tracker put it near a million, a thirty-fold disagreement on the same asset on the same day. That does not happen in a liquid market. It happens when there is so little real trading that different venues and indexers cannot agree on a price. A market where the second and third names are worth a few million dollars and a stray reading can be off by 30 times is not a market that generates broad, deep, recurring transaction fees. It generates occasional bursts around whichever token is briefly in fashion, and otherwise sits still. Much of what remains is best understood as collectibles held in self-custody hardware wallets, parked rather than traded, which is fine for holders and useless for a fee base.

What Would Actually Close the Gap

There are only a handful of ways out, and Runes is relevant to some of them. The first is price. Because the subsidy is denominated in Bitcoin, a high enough price keeps the dollar value of the security budget up even as the coin issuance halves; the roughly $13 billion a year today exists because 450 BTC is worth a lot, not because fees are healthy. The bull case is simply that Bitcoin keeps appreciating faster than the subsidy shrinks. It is also a bet that has to pay off forever, every four years, which is a lot to ask of any asset.

The second is durable fee demand, which is the lane Runes, Ordinals, and BTCfi are supposed to fill, and so far have not. The third is raw scaling: the resource site budget.day lays out the optimistic math that if Bitcoin processed around 500 transactions per second, the average fee needed to replace the current subsidy would fall to a feasible $0.81, rather than the $82 implied at today’s throughput. The catch is that 500 transactions per second means dramatically bigger or faster blocks, a change Bitcoin’s culture has resisted for a decade. The same resource collects the pessimistic read, citing Bitcoin developer James O’Beirne to the effect that the network may have only two halvings left before the shortfall becomes a serious problem. Optimists reply that adoption and higher prices will carry the fee base in time. Nobody has a proof. What everyone shares is a countdown: 2028, then 2032, then 2036, each one cutting the predictable part of miner revenue in half again.

Memecoins, the SEC, and the Fee Base

Regulation does not threaten Runes the way it threatens a token with a company behind it, and that is largely good news for the protocol. In the United States, the SEC’s Division of Corporation Finance issued a staff statement in February 2025 saying that meme coins are generally not securities, because they are bought for entertainment and speculation rather than as an investment in a common enterprise. Most runes fit that description almost perfectly, and the agency has in any case spent 2026 recalibrating its posture, as our coverage of SEC crypto enforcement after the comment window details. An issuerless, fair-launch token with no team and no promises is a hard target for a securities regulator.

The subtler effect runs through the fee base. The very issuerlessness that protects a rune from the SEC causes friction in Europe, where the MiCA regime generally expects an identifiable issuer and a published whitepaper before a regulated venue will list a token; a rune that nobody issued has nobody to file that paperwork, so compliant exchanges may simply decline to carry it. Add the compliance load now landing on the DeFi and BTCfi rails, which our piece on DeFi compliance and the FATF clock covers, and the practical result is fewer regulated on-ramps for exactly the tokens that would need deep, broad markets to ever generate meaningful fees. Regulation will not kill Runes. It may quietly keep the fee base small, which is the outcome that matters for the security budget.

What to Watch Into 2027

The security-budget question will not resolve this year, but several near-term signals will show whether the picture is improving or decaying.

• The Bitcoin price through the December Federal Reserve meeting and into year-end, because the dollar value of the security budget rides almost entirely on price, not fees.
• The five-letter Runes name unlock at block 980,000, due around mid-December 2026, and whether a fresh etching wave produces a fee burst that lasts longer than a weekend.
• BTCfi total value locked at Liquidium, Alkanes, and their peers, the likeliest source of steady, non-speculative on-chain fee demand from this ecosystem.
• The next halving, due around spring 2028 at block 1,050,000, which cuts the subsidy to 1.5625 BTC and turns an abstract debate into a line-item cut.
• Fresh readings of the Cambridge Security Budget Health Indicator and Spark’s fee-share figures, to see whether fees climb off the floor or stay there.
• The relay-policy fight over data-carrying transactions, because whether Bitcoin welcomes or filters that traffic decides whether the fee-paying customers are even allowed in the door.

Runes answered the question it was built to answer: Bitcoin can carry native fungible tokens with no bridge and no sidechain, and the spec is simple enough that anyone can read it. The harder question, the one the halving timing implied, was whether those tokens could help pay for the chain’s security as the subsidy fades. The honest scoreboard is the mempool, and right now it is nearly empty. Runes proved the plumbing works. It has not yet proved it can pay the bills.

Frequently Asked Questions

Do Bitcoin Runes pay Bitcoin’s miners?

For one day they did. When Runes launched at the halving on 20 April 2024, minting demand briefly made up around 90% of all Bitcoin network fees and handed miners roughly $107 million in a single day. That intensity faded within weeks, and by late 2026 Runes are a small part of a fee market that itself sits under 1% of total miner revenue.

What is Bitcoin’s security budget?

The security budget is the total value paid to miners to secure the network each block, made up of the block subsidy of newly minted coins plus transaction fees. In late 2026 it runs near $13 billion a year, but more than 99% of that still comes from the subsidy, which is scheduled to halve roughly every four years until it reaches zero.

When is the next Bitcoin halving and what happens to the subsidy?

The next halving is due around spring 2028 at block 1,050,000, when the block subsidy drops from 3.125 BTC to 1.5625 BTC. The subsidy keeps halving every 210,000 blocks, about four years, falling toward zero by roughly the year 2140, which is why fees are expected to take over as the main source of miner revenue.

Can transaction fees replace the Bitcoin block subsidy?

Not at today’s usage. Spark estimates the average transaction fee would need to reach about $82, roughly 140 times the current $0.57, to replace the subsidy at Bitcoin’s present throughput. Fees could close the gap through a much higher Bitcoin price, far greater transaction volume, or durable on-chain demand, but none of those has arrived yet.

What is the biggest Bitcoin Rune?

DOG•GO•TO•THE•MOON is by far the largest, with a market cap near $82.9 million in early November 2026, roughly four fifths of the entire Runes category. It was a 100% fair airdrop to early Ordinals users, with no team allocation or presale, and it now trades across Bitcoin, Solana, and StarkNet.

By Marcus Okafor, senior markets writer at HOGE Wire, covering Bitcoin’s base layer and the economics that secure it.