What to Know

  • Project Eleven says it has funded a zero-knowledge proof system designed to help owners recover bitcoin affected by BIP-361’s proposed freeze of quantum-vulnerable coins.
  • The prototype uses modern wallet key-derivation paths as evidence of ownership after a future quantum computer could make exposed public-key signatures unreliable.
  • Benchmarks cited by Project Eleven show proof generation taking 243 milliseconds on four cores of an M5 MacBook Air, with verification taking 40 milliseconds.
  • The system reportedly uses about 2 gigabytes of memory, needs no GPU, and has no trusted setup.
  • BIP-361, published in April by Jameson Lopp and five co-authors, proposes blocking new deposits to vulnerable addresses after three years and freezing remaining coins after five.
  • More than 34% of all bitcoin is considered vulnerable under the BIP-361 framing because its public keys have been exposed.
  • The recovery approach does not apply to Satoshi Nakamoto’s roughly 1.1 million BTC, because those coins predate BIP-32 wallet trees and seed-based derivation.
  • Project Eleven’s prototype remains unaudited, incomplete, and would require changes to Bitcoin’s rules before it could affect live coins.

A New Recovery Idea for Bitcoin’s Quantum Risk

Bitcoin’s long-running quantum computing debate has gained a new technical proposal from Project Eleven, which says it has funded a zero-knowledge proof system that could help legitimate owners recover coins frozen under BIP-361’s proposed response to quantum-vulnerable addresses. The idea does not eliminate Bitcoin’s quantum problem, and it does not save every category of old coin. It does, however, offer a more concrete recovery path for some users whose wallets were created with modern key-derivation structures.

The proposal centers on a key distinction in cryptography. A sufficiently capable quantum computer could undermine elliptic curve signatures by deriving a private key from an exposed public key. If that happens, a signature from a vulnerable address would no longer prove genuine ownership, because an attacker with the recovered private key could sign just like the original holder. In that scenario, Bitcoin’s normal ownership test would become unreliable for coins whose public keys are already visible onchain.

Project Eleven’s proof system instead leans on hashing and wallet derivation. Modern bitcoin wallets often generate addresses from a tree of keys, with hardened derivation using HMAC-SHA512 in a one-way process. The owner can potentially prove knowledge of key material above the affected address in that tree, while not revealing the sensitive material itself. A quantum attacker who only breaks the exposed address key would not automatically be able to climb back up the derivation path to the higher-level wallet material.

Why BIP-361 Matters

BIP-361 is the proposal that gives this work its immediate market relevance. Published in April by Jameson Lopp and five co-authors, it proposes a staged freeze of bitcoin considered vulnerable to a future quantum attack. Under the plan, new deposits to vulnerable addresses would be blocked after three years, and coins that remained in those addresses would be frozen after five. The framework targets a category described as more than 34% of all bitcoin supply, including the roughly 1.1 million BTC widely attributed to Bitcoin’s pseudonymous creator, Satoshi Nakamoto.

The harshness of a freeze has made BIP-361 controversial among Bitcoin market participants and developers. Bitcoin’s monetary and property-rights appeal rests heavily on the idea that coins remain spendable by anyone who controls the relevant keys. A rule change that strands coins, even for security reasons, would be a dramatic intervention. Supporters of a freeze-oriented framework argue that a post-quantum attacker could otherwise drain vulnerable outputs. Critics argue that immobilizing coins would break expectations around permanent ownership.

The recovery proof changes the framing, at least for a subset of wallets. If a frozen output can later be unlocked by a zero-knowledge demonstration tied to the wallet’s own derivation history, then the freeze begins to look less like destruction and more like quarantine. The owner would not need to reveal a seed phrase or parent key. Instead, the proof would show that the address came from a wallet path the claimant still controls, and the proof could be bound to a specific migration transaction.

How the Zero-Knowledge Method Works

Zero-knowledge proofs allow one party to prove that a statement is true without exposing the underlying secret. In this case, the statement is not simply, “I can sign with this address key.” After Q-Day, that would be insufficient, because a quantum attacker could potentially sign as well. The more useful statement is, “I know the key material higher in the wallet tree that derives this address.”

Project Eleven and Jim Posen, lead developer of the Binius proof system, built the proof around that wallet-tree relationship. The claimant proves knowledge of key material above the address, proves that the relevant derivation path leads to the address being recovered, and binds the proof to a message associated with the migration transaction. This would allow the recovery process to authorize movement of coins without disclosing the seed-level material or related private data.

The reason this distinction matters is that elliptic curve signatures and hashing fail differently under quantum pressure. Shor’s algorithm, published in 1994, is the quantum method at the heart of the concern around elliptic curve cryptography. If applied by a sufficiently advanced quantum computer, it could take a public key and return the corresponding private key. Hashing, by contrast, is not collapsed in the same way. Grover’s algorithm provides a speedup, but it does not reverse a hash outright. A 256-bit hash would be reduced from 2^256 guesses to 2^128 guesses, which remains beyond practical reach under the framing used by Project Eleven.

Speed Makes the Prototype Noteworthy

The benchmark figures are a major reason technical traders and Bitcoin-focused market participants are paying attention to the proposal. Project Eleven says the prototype can generate a proof in 243 milliseconds on four cores of an M5 MacBook Air. Verification reportedly takes 40 milliseconds. The system uses about 2 gigabytes of memory, requires no GPU, and has no trusted setup.

Project Eleven also says a broader run on CPU alone, including circuit construction, proof generation, and self-checking, takes 910 milliseconds. The group characterizes that result as 16 times faster than prior work. When excluding the one-time setup that a real prover would build once and reuse, the gap is described as roughly 60 times. Those figures matter because a recovery mechanism must be practical enough for broad wallet use if it is ever to support a live-chain migration.

Still, the prototype should not be mistaken for an active Bitcoin safety feature. Project Eleven has acknowledged that the work is unaudited and incomplete. It currently supports three Bitcoin address types rather than Taproot, roots the proof at the coin-type key rather than the seed, and recovers nothing on any live blockchain today. Any implementation would also require contentious changes to Bitcoin’s rules, which means social consensus would matter as much as cryptographic engineering.

Why Satoshi’s Coins Are Left Out

The most prominent limitation is also the most symbolically important: the approach does not help Satoshi Nakamoto’s coins. The roughly 1.1 million BTC attributed to Satoshi are believed to come from Bitcoin’s earliest period, when wallet software generated keys independently and at random rather than from seed-based derivation trees. Satoshi mined through 2009 and 2010 and was gone by 2011, while BIP-32, the standard that introduced hierarchical deterministic wallet structures, was assigned on February 11, 2012.

That timing gap is decisive for this recovery method. The proof requires something above the address in a derivation tree. Satoshi-era pay-to-public-key outputs have the public key written directly onchain and were generated by software that had no seed phrase, no parent key, and no derivation path. There is no higher wallet node to prove knowledge of, because the relevant wallet tree did not exist for those coins.

The same issue applies to other pre-2012 wallets. Many of the oldest and most dormant bitcoin outputs are precisely the ones most exposed in a quantum scenario and most likely to lack modern recovery evidence. For those coins, the proposed proof system cannot create a derivation history after the fact. A zero-knowledge proof can protect secrets and verify relationships, but it cannot prove a relationship that never existed.

What This Means for Bitcoin Holders

For holders using modern wallets with seed phrases and hierarchical derivation, Project Eleven’s work points toward a possible future in which vulnerable coins are not automatically lost if Bitcoin adopts a freeze framework. The owner’s seed material and derivation path could become the basis for proving legitimate control when signatures alone are no longer trusted. That would be a meaningful shift in the debate over quantum preparedness.

For older coins, especially pre-BIP-32 coins, the outlook remains more difficult. If Bitcoin’s community ever chose to freeze vulnerable outputs after a quantum threshold, recovery would depend on what kind of wallet history the owner can demonstrate. Coins with no derivation tree may remain outside the reach of this specific solution. That creates a sharp divide between modern wallet users and early holders whose coins were created under Bitcoin’s original key-generation model.

The broader takeaway is that Bitcoin’s quantum debate is moving from abstract risk toward concrete migration mechanics. Project Eleven’s prototype does not settle BIP-361, does not protect live funds today, and does not resolve the fate of Satoshi-era coins. But it gives market participants a clearer example of how frozen coins could potentially be unlocked by their rightful owners without returning to trust in exposed signatures.

Frequently Asked Questions (FAQs)

What is Project Eleven proposing for Bitcoin?

Project Eleven says it has funded a zero-knowledge proof system that could help owners recover bitcoin frozen under BIP-361’s proposed response to quantum-vulnerable coins. The system uses wallet key-derivation evidence rather than relying only on signatures from exposed public keys.

What is BIP-361?

BIP-361 is a proposal published in April by Jameson Lopp and five co-authors. It would block new deposits to vulnerable addresses after three years and freeze remaining coins after five, targeting coins that may become unsafe after a sufficiently advanced quantum computer appears.

Why are some bitcoin coins considered quantum-vulnerable?

Coins are considered vulnerable when their public keys have been exposed onchain. If a future quantum computer can derive private keys from those public keys, an attacker could create valid signatures that Bitcoin’s current rules could not distinguish from the owner’s signatures.

How fast is Project Eleven’s prototype?

Project Eleven says proof generation takes 243 milliseconds on four cores of an M5 MacBook Air, while verification takes 40 milliseconds. A broader CPU-only run that includes circuit construction, proof generation, and self-checking is described as taking 910 milliseconds.

Does the recovery tool work on live Bitcoin today?

No. The prototype is unaudited, incomplete, and does not recover coins on any live blockchain today. It would also require changes to Bitcoin’s rules before it could become part of an actual recovery process.

Why does the method not help Satoshi Nakamoto’s coins?

Satoshi’s coins are associated with Bitcoin’s earliest period, before BIP-32 hierarchical wallet trees and seed-based derivation. Because those coins were generated without a parent key or derivation path, there is no higher wallet material for this proof system to use as evidence of ownership.

What is Q-Day in this context?

Q-Day refers to a theoretical point when a quantum computer could derive a private key from an exposed public key. After that, ordinary signatures from vulnerable addresses would no longer be reliable proof of ownership.

Does this mean frozen bitcoin would be burned?

Not necessarily for modern wallets. If a recovery proof can be implemented, some frozen coins could potentially be migrated by owners who still hold the necessary seed material. However, coins without modern derivation paths may not be recoverable through this specific method.

What remains unresolved?

The main unresolved issues are technical review, Bitcoin rule changes, address-type support, Taproot coverage, and community consensus. The proposal also does not solve the problem for early pre-2012 wallets that lack derivation-tree evidence.

Photo by Jakub Zerdzicki on Pexels