A new cryptographic tool designed to protect bitcoin from future quantum computer attacks would still leave the 1.1 million coins attributed to Bitcoin’s mysterious creator, Satoshi Nakamoto, permanently vulnerable.
Quantum threat to a third of all bitcoin
Quantum research firm Project Eleven says it has funded and helped develop a zero-knowledge proof system that could allow legitimate owners to reclaim coins even after so‐called “Q‐Day” – the point at which quantum computers can forge bitcoin signatures.
The work is closely linked to BIP‐361, a contentious proposal published in April by Jameson Lopp and five co‐authors. That plan would eventually freeze coins held at “quantum‐vulnerable” addresses – those whose public keys have been exposed on the blockchain – after a transition period.
According to BIP‐361, more than 34% of all bitcoin sits in such addresses. That pool includes roughly 1.1 million BTC widely believed to belong to Satoshi Nakamoto, mined in Bitcoin’s earliest years.
The concern is that, once large‐scale quantum computers are available, Shor’s algorithm could be used to derive private keys from exposed public keys, allowing an attacker to sign transactions and move coins at will.
In that scenario, a digital signature would no longer prove ownership: both the rightful holder and a quantum attacker could create valid signatures, and the blockchain would have no way to distinguish between them.
How the recovery proof works
Modern bitcoin wallets, however, introduced a structural defence that quantum computers struggle to break.
Most current wallets use hierarchical key trees, standardised in BIP‐32 in 2012. They generate a master key from a seed phrase, then derive child keys step by step. Crucially, “hardened” derivation uses HMAC‐SHA512 – a hashing-based, one‐way function – on a private key to produce the next key.
Hash functions behave differently under quantum attack than elliptic curve cryptography. While Shor’s algorithm can effectively “reverse” elliptic curve relationships, the best known quantum method for hashes – Grover’s algorithm – only squares the efficiency of brute force. For a 256‐bit hash, that still leaves a search space of 2^128 possibilities, far beyond realistic reach even for extremely powerful machines.
The system developed by Project Eleven with Jim Posen, lead developer of the Binius proof system, builds a zero‐knowledge proof around this wallet structure.
Under their approach, a user proves they know the key material higher up in their wallet’s derivation tree – the keys “above” a vulnerable address – and that this material correctly derives the target address. The proof is cryptographically bound to a specific message so it can authorise a migration transaction. None of the keys themselves are revealed.
Project Eleven says performance is what makes the scheme practical. On an M5 MacBook Air, generating the proof takes around 243 milliseconds on four CPU cores, verification takes roughly 40 milliseconds, and the system uses about 2GB of RAM without relying on a graphics card. There is no trusted setup phase.
The team reports that its own implementation runs in about 910 milliseconds on a standard CPU, including circuit construction, proof generation and internal checks – about 16 times faster than a previous baseline, and around 60 times faster if one‐off setup work is excluded.
Why Satoshi’s coins cannot be saved
The technique, however, has a critical limitation: it only works for coins whose addresses sit inside a BIP‐32‐style derivation tree.
Bitcoin’s earliest wallets, including the software used by Satoshi Nakamoto, predate that system. As Bitcoin’s own documentation states, those wallets generated each key independently and at random. There was no seed phrase, no parent key and no hierarchical tree.
Satoshi is believed to have mined heavily in 2009 and 2010, disappearing from public view by 2011. The associated coins mostly sit in pay‐to‐public‐key outputs, with the public key itself written directly onto the blockchain.
Because there is no “key above” these early addresses, there is nothing for the new proof system to reference. The same is true for many other pre‐2012 wallets, which together account for a significant share of the network’s oldest and least active coins – the very holdings BIP‐361 was designed to address.
Prototype status and ongoing controversy
Project Eleven acknowledges that its current implementation is a prototype. It remains unaudited, supports three existing Bitcoin address types but not Taproot, and roots its proofs at the coin‐type key rather than the original seed. At present, it does not enable recovery of any coins on a live blockchain.
Even so, the research could reshape the debate around BIP‐361. The proposal has drawn fierce criticism because freezing coins is seen as breaking Bitcoin’s guarantee of permanent, sovereign ownership.
Lopp himself has been open about his reservations, saying he does not favour BIP‐361 but considers the alternatives even less appealing.
Much of the resistance rests on the idea that any freeze would be absolute. A practical recovery proof changes that framing: it would make quantum‐vulnerable coins effectively “locked” rather than destroyed, with control resting in the hands of anyone who still possesses their seed phrase.
For Satoshi Nakamoto’s legendary holdings – created before wallet trees and seed phrases existed – that rescue route simply does not apply.
