Bitcoin Storm
Economic Model

Bitcoin Storm is a deterministic five-year on-chain capital protocol running on the Internet Computer (ICP). Participants commit $100 in exchange for a permanent protocol slot. At Year 5, the protocol settles deterministically — no mid-cycle events, no discretionary actions, no managerial adjustments.

The total Bitcoin distribution at Year 5, if fully funded, is 2,100 BTC — structured as one BTC for every 10,000 of the 21 million Bitcoin that will ever exist.

Registration window. General registration is open from launch through the end of Month 48. From Month 48 + 1 day through Year 5 settlement (Month 60), the canister rejects new participant entries regardless of remaining capacity below the 10,000,000-participant cap. This guarantees that every participant — including the last to register — has at least twelve months of locked capital exposure before settlement. The founding-cohort window (the first 1,000,000 participants) closes independently the moment the millionth slot is filled, which may occur substantially earlier than Month 48.

For every $100 entry:

• $5 is consumed by the Operating Fee Reserve — this is the one-time, non-refundable operational contribution. It funds five years of protocol operations (certification, development, compliance, infrastructure, governance). It is disclosed at registration. It is never refunded.
• $95 is held in ICP on the participant's behalf as part of the Participant Pool. This is the participant's capital position in the protocol.

At full 10,000,000-participant subscription

3.1 Pool valuation

At the close of the five-year cycle, the Participant Pool's ICP holding is valued in USD at the Year 5 market price. Any unspent portion of the Operating Fee Reserve flows into this Pool Value at this point.

3.2 Profit calculation

Where Cost Basis = count(actual participants) × $95.

3.3 BTC threshold test

The protocol distributes Bitcoin only if profit is sufficient to cover the full 2,100 BTC obligation at Year 5 market price.

• If Profit ≥ BTC Threshold → Scenario 3 applies (BTC purchased)
• If 0 < Profit < BTC Threshold → Scenario 2 applies (no BTC; all profit to cash split)
• If Profit ≤ 0 → Scenario 1 applies (no BTC, no founder fee; pool shared pro rata)

3.4 Three scenarios

3.5 Charitable earmark on settlement distribution

The protocol carries a 10% charitable earmark on participant profit at Year 5 settlement. The earmark is applied only to the profit portion of each participant’s pro-rata cash distribution, never to the return of cost basis. Participants who recover less than their $100 entry receive their entire diminished distribution without any earmark.

• If the participant’s pro-rata cash distribution is at or below $100, no earmark applies. The participant receives their full distribution outright.
• If the participant’s pro-rata cash distribution is above $100, 10% of the amount above $100 arrives locked in the participant’s Storm wallet, earmarked for charitable direction. The remainder — the $100 cost basis return plus 90% of the profit portion — is delivered to the participant outright.
• The earmark applies to the cash component only. Bitcoin won via the founding draw or the daily draw is delivered to winners outright, without an earmark.
• The locked portion is the participant’s, legally and financially. The protocol holds it solely until the participant directs it.
• The participant has 12 months from settlement to direct the locked portion to a qualifying charity from the published Storm Charity Registry. The participant may direct to a single charity or split across several.
• On confirmation, the protocol transfers the locked portion directly on-chain to the chosen charity’s wallet. The transaction is permanent, public, and verifiable.
• If undirected after 12 months, the locked portion is automatically distributed equally to the top three most-nominated qualifying charities, by participant count.
• The earmark cannot be redirected, borrowed against, used for any protocol purpose, or reduced by any operator action after launch.

If the protocol is unprofitable, nobody wins Bitcoin — but no participant's capital has been consumed to pay Bitcoin to anyone else. Losses, where they occur, are caused by ICP market movement alone.

5.1 Founding draw — 275 BTC, 275 winners

• Sealed at the moment the 1,000,000th founding participant registers.
• Exclusive to the first 1,000,000 participants (the "founding million").
• Drawn against the full 1,000,000 founding slot universe. If any winning slot was never filled, the VRF re-draws against actual founding participants so no winning slot is wasted.
• Resolved at Year 5 settlement if profit is sufficient to fund the full 2,100 BTC purchase.
• Odds: 1 in 3,636 for each founding-million participant.

5.2 Daily draw — 1,825 BTC, 1,825 winners

• 1,825 daily slots, one per day for five years (5 × 365 = 1,825).
• Each slot sealed by VRF on the day it runs, against the full 10,000,000-participant universe.
• Every participant — founding or not — competes against the same sealed slot universe for every daily draw. Joining early confers no probability advantage in the daily draw.
• Unfilled slots (if fewer than 10M participants) are re-drawn against actual participants at Year 5.
• Resolved at Year 5 settlement if profit is sufficient to fund the full 2,100 BTC purchase.
• Per-draw odds at full 10M enrolment: 1 in 4,000,000 for a founding-million participant (3 tickets), 1 in 12,000,000 for a non-founder (1 ticket).
• Cumulative cycle odds: approximately ~1 in 2,200 for a founding-million participant versus ~1 in 6,600 for a non-founder — the 3× ticket weighting yields exactly 3× per-draw advantage and approximately 3× cumulatively across the 1,825-day cycle.

5.3 Founding cohort combined advantage

This is the founding cohort's only structural advantage. They pay the same $100 entry, hold the same $95 capital position, and share in the same pro-rata Pool Value at Year 5. The only difference is the extra sealed VRF entry.

The founder's compensation is 20% of residual profit only — the profit remaining after BTC is purchased (Scenario 3) or 20% of total profit if no BTC is purchased (Scenario 2).

No management fee. No participation fee. No carry on gross pool. The founder's upside is aligned exclusively with participant upside — both scale with the same Pool Value variable.

• $50M at full 10M subscription (scales with actual subscription size).
• Held in ICP throughout the cycle.
• Consumed across the five years to fund: TriCert certification programme (~$1.4M), development team (~$4.5M), compliance/legal (~$3M), infrastructure and operations, governance. Total operational consumption: approximately $18M over five years.
• Recoverable to participants at Year 5. Any unspent balance in the Operating Fee Reserve at the close of the cycle is added to Pool Value before the settlement waterfall runs. It therefore flows pro-rata into every participant’s distribution alongside the Participant Pool itself. The Reserve is not a sunk operational budget that disappears at Year 5 — whatever is not spent comes back to participants.
• This creates an aligned incentive: every dollar the founder does not spend on operations during the cycle is a dollar that returns to participants at settlement. Operational discipline directly increases the participant distribution.

How operations cash is accessed once the canister is locked

The canister is immutable from launch. The Reserve is not. The architecture separates the two cleanly:

• The Reserve is held in a canister-controlled ICP wallet, distinct from the Participant Pool wallet.
• Disbursement rules are hardcoded at deployment alongside everything else: a monthly disbursement cap, a list of whitelisted recipient address categories (development team, audit firms, legal counsel, infrastructure providers, marketing partners), and a pause-on-anomaly trigger.
• Management does not have direct withdrawal authority. To draw from the Reserve, an operational invoice is submitted against a whitelisted address category; the canister verifies the request against the hardcoded rules and releases ICP to the named recipient address.
• The whitelisted address list itself is set at deployment and is immutable. Categories are immutable; specific addresses within a category can be updated only via a documented multi-signature governance event (three independent signers, public on-chain proposal, time-locked execution) — allowing the team to rotate to a new audit firm or development contractor without giving anyone unilateral access to drain the Reserve.
• Every disbursement is recorded on-chain. The Reserve’s balance and full transaction history are publicly verifiable at every moment of the cycle.

This is the same architectural pattern used by the participant pool side: the canister enforces the rules, the team operates within them, no party (including the founder) can act unilaterally outside the rules.

The pause-on-anomaly trigger

The pause-on-anomaly trigger is an automatic circuit breaker. The canister continuously checks each disbursement request against a set of hardcoded anomaly rules; if any rule is triggered, disbursements freeze automatically before the suspicious transfer completes.

What counts as an anomaly — rules set at deployment:

• A disbursement that would exceed the monthly cap for the category in question.
• Multiple disbursement requests in a very short time window (suggests an automated or scripted attempt).
• A request to an address that was added to the whitelist recently and has not yet had a normal disbursement history against it.
• A request during a defined frozen window (the rules can include weekend, holiday, or pre-settlement periods where no operational disbursement is expected).
• A request that would push total cycle-to-date spend above a defined percentage of the remaining Reserve.

When triggered, the trigger fires on-chain, visibly, and disbursements are paused. Unfreezing requires the same three-signer governance event used for whitelist rotation: independent signers, a public on-chain proposal explaining what happened, and a time-locked execution period before the unfreeze takes effect. No single party can override the pause unilaterally — including the founder.

The trigger is defensive infrastructure. Most of the time it sits armed and quiet, simply verifying that each disbursement falls within the agreed operational profile. Its presence makes a single compromised request, mistyped address, or scripted attack unable to drain the Reserve before counterparties have time to investigate.

Founder benefit from the unspent Reserve

The unspent Reserve at Year 5 flows into Pool Value before the settlement waterfall runs — meaning the standard waterfall mechanics apply to it as they apply to the rest of the pool. In practice this means:

• Participants receive their cost basis return first, then 80% of any profit attributable to the unspent Reserve, pro-rata.
• The founder receives 20% of that profit via the standard Performance Fee — the same 20% applied to any other profit at settlement, not a separate or additional fee.

This is the source of the aligned-incentive design: every dollar the founder saves on operations during the cycle becomes a dollar of unspent Reserve at Year 5 — appreciated by ICP’s price path over five years — that returns 80% to participants and 20% to the founder. The founder is rewarded for operational discipline, and the upside compounds with ICP appreciation in lockstep with participants.

The structural protections against under-spending essential work sit elsewhere: the independent audit budget is separately scoped and ring-fenced from the Reserve (the audit firm contracts directly with the founder rather than the canister); the marketing partner’s retainer is a contractual obligation in the commercial relationship and is paid regardless of canister discipline; the operational categories themselves are whitelisted with their own minimum-spend expectations. The discipline incentive applies within a properly-budgeted operation; it cannot be used to skip essential work.

Operations Reserve — estimated upside as ICP appreciates

Because the Reserve is held in ICP and operational spending is denominated in USD, both halves benefit as ICP appreciates: the unspent ICP itself appreciates with the price, and ongoing operational spend costs progressively less ICP. The table below shows the estimated unspent Reserve balance at Year 5 settlement under a range of ICP price paths.

Assumptions: $50M initial Reserve at full 10M subscription, denominated in ICP at $5 spot (10M ICP held). Operational consumption $18M over the cycle, denominated in USD and spent through monthly drawdown at the then-spot ICP price. ICP price path modelled as linear interpolation from the start price to the end-of-cycle multiple. Real-world price paths are not linear; the table is indicative, not predictive. The numbers are estimates of the Reserve’s contribution alone — the Participant Pool produces a separate distribution governed by the threshold and waterfall mechanics in §04 and §05.

At $100K BTC reference

At other BTC prices

Higher BTC prices at Year 5 make the threshold harder to clear, because the cost of buying 2,100 BTC rises.

The protocol is structurally distinct from three common regulatory categories:

• Not a fund. No pooled investment scheme with managerial discretion. No NAV. No redemption. No portfolio rebalancing. Participants hold a fixed, non-transferable slot for five years, bound to a single deterministic settlement event.
• Not a lottery. Bitcoin prizes are not funded by participant consideration. Participant capital is senior and returned at Year 5. Bitcoin is purchased only from profit above cost basis. Non-winners do not forfeit their $95 to fund a prize pool.
• Not a deposit-taking business. No principal guarantee. No promised yield. No promised outcome. The $100 entry is explicitly at risk.

Launch is conditional on

1. Satisfactory legal opinion from Gibraltar counsel on regulatory classification
2. Required authorisations obtained (GFSC and any other relevant jurisdictions)
3. Gibraltar operating entity established with named directors and designated compliance officer
4. Independent code audit completed and report published

The first 1,000,000 participants are the founding cohort. Eligibility for the founding draw closes permanently the moment the 1,000,000th slot is filled.

The founding cohort's structural advantage has two components: (i) exclusive entry to the founding draw (275 winners, 1 in 3,636 odds per founder), and (ii) 3× ticket weighting in every daily draw for the full five-year cycle (1 in 4,000,000 per draw at full enrolment, versus 1 in 12,000,000 for a non-founder). Combined, this produces approximately a 4.8× probability advantage of winning any BTC across the cycle, and an equivalent ~4.8× expected-value ratio in BTC terms. The 3× weighting closes at the same moment the founding draw closes; every participant from 1,000,001 onwards has standard single-ticket weighting.

This advantage exists only for the first million. It is not purchasable, not replicable, not transferable, and closes permanently when the last founding slot is filled.

Two registration windows operate in parallel and close independently. The founding-cohort window (slots 1 through 1,000,000) closes the moment the millionth slot is filled — likely well before the end of Month 48. The general registration window (slots 1,000,001 through 10,000,000) closes at the end of Month 48, regardless of remaining capacity. The Month 48 cutoff exists to ensure every participant has at least twelve months of locked-capital exposure before Year 5 settlement; without it, a participant entering on the day before settlement would receive an equal pro-rata share of five years of capital appreciation they took no part in financing. Late entry is permitted up to the cutoff; entry past Month 48 is not.

• No principal return. The $5 Operating Fee is consumed regardless of outcome. The $95 Participant Pool is exposed to ICP market risk.
• No specific Bitcoin distribution. If Year 5 profit is insufficient, no Bitcoin is purchased.
• No specific financial outcome. The protocol is deterministic, but outcomes depend on ICP market performance across the cycle.
• No management guarantee. The founder cannot alter the protocol post-launch, but also cannot adjust for adverse conditions. The canister runs as coded.
• No specific charitable destination. The 10% earmark applies only to the profit portion of each participant’s settlement distribution — never to the return of cost basis. Participants below cost basis contribute nothing. Where the earmark applies, it is directed by the participant from a published registry of qualifying charities. The protocol does not direct charitable distribution on the participant’s behalf and does not guarantee that any specific cause receives any specific amount.