Bitcoin’s quantum problem gets a recovery tool, but not for Satoshi’s 1.1 million BTC

Project Eleven says it has funded a proof that lets a wallet's own key-derivation path stand in as ownership after quantum computers can forge its signatures. It runs in 243 milliseconds on a laptop.

Bitcoin’s quantum problem gets a recovery tool, but not for Satoshi’s 1.1 million BTC

Tech

Bitcoin’s quantum problem gets a recovery tool, but not for Satoshi’s 1.1 million coins

Project Eleven says it has funded a proof that lets a wallet's own key-derivation path stand in as ownership after quantum computers can forge its signatures. It runs in 243 milliseconds on a laptop.

By

Shaurya Malwa

|

Edited by

Aoyon Ashraf

Jul 19, 2026, 10:00 a.m.

4

min read

Make

preferred on

Share

Share this article

Copy link

X icon

X (Twitter)

LinkedIn

Facebook

Email

Make

preferred on

A statue of Satoshi Nakamoto, a presumed pseudonym used by the inventor of Bitcoin, is displayed in Graphisoft Park on September 22, 2021 in Budapest, Hungary. The statue's creators, Reka Gergely and Tamas Gilly, used anonymized facial features, as Nakamoto's true identify remains unconfirmed. (Photo by Janos Kummer/Getty Images)

Summary

Show

A new zero-knowledge proof system from Project Eleven offers a practical way to recover bitcoin locked under BIP-361’s proposed freeze of quantum-vulnerable coins, including Satoshi Nakamoto’s holdings.

The scheme exploits the fact that quantum computers can break elliptic curve signatures but not the one-way hashing used in modern wallet key derivation, allowing only true owners with seed material to prove control.

Benchmarks show Project Eleven’s prototype is dramatically faster than prior work, but it remains unaudited, incomplete, and would require contentious changes to blockchain rules before it could protect any live coins.

The proposal to freeze bitcoin's quantum-vulnerable coins has always carried an asterisk.

BIP-361

, published in April by Jameson Lopp and five co-authors, would block new deposits to vulnerable addresses after three years and freeze whatever remained after five, stranding coins in more than a third of bitcoin's supply, including the roughly 1.1 million BTC attributed to pseudonymous creator Satoshi Nakamoto.

A later step of that plan promised a recovery path using zero-knowledge proofs, a technology that lets someone prove to another person that they know a fact without ever revealing it.

Quantum research outfit Project Eleven says it has now built exactly that, and made it fast enough to use.

Q-Day is a theoretical point at which a quantum computer could derive a private key from a public key, allowing an attacker to sign transactions from any address whose public key has ever been exposed.

More than 34% of all bitcoin sits in that category, according to BIP-361. After Q-Day, a signature would prove nothing because the attacker can produce one as easily as the owner. The chain cannot tell them apart.

Bitcoin signatures rely on elliptic curve cryptography, a system in which a private key generates a public key through math that runs only one way. Anyone can check the public key, but nobody can work backward to the private one. However, Shor’s algorithm, a quantum method published in 1994 for problems that ordinary computers cannot crack, can be fed a public key and return the private key that generated it.

Hashing is a different kind of problem. A hash scrambles an input into a fixed-length fingerprint and cannot be run backward, and the best quantum attack on it, called Grover's algorithm, only halves the exponent rather than collapsing it, taking a 256-bit hash from 2^256 guesses down to 2^128.

That is still more guesses than a machine making a billion a second could get through in the lifetime of the universe.

Modern wallets are built on hashing. A wallet generates addresses in a tree, deriving each key from its parent, and a "hardened" derivation step feeds the parent's private key through HMAC-SHA512 to produce the child key.

That is a one-way function. An attacker who breaks an address after Q-Day ends up holding exactly the key held, and cannot climb the tree to the key it came from.

Project Eleven and Jim Posen, lead developer of the Binius proof system, built a zero-knowledge proof around it.

The user proves they know the key material sitting above their address in the wallet's derivation tree, that it derives the address in question, and binds the proof to a specific message, so the same proof can authorize the migration transaction. None of the key material is disclosed.

The benchmarks are what make it interesting. On an M5 MacBook Air, generating the proof takes 243 milliseconds on four cores, verification takes 40 milliseconds, and the whole thing uses about 2 gigabytes of memory and no GPU at all. There is no trusted setup.

Project Eleven's runs in 910 milliseconds on the CPU alone, counting circuit construction, proof generation and self-checking, which it puts at 16 times faster. Excluding the one-time setup, which a real prover would build once and reuse, the gap widens to roughly 60 times.

Which brings it back to Satoshi. The entire trick depends on there being a key above a user’s address to prove knowledge of, and that the tree structure arrived with BIP-32, which was assigned on February 11, 2012.

Before it, as

Bitcoin's own documentation puts it

, wallets generated every key independently and at random.

Satoshi mined through 2009 and 2010 and was gone by 2011. Those coins sit in pay-to-public-key outputs with the public key written directly onchain, generated by software that had no seed phrase, no derivation path and no parent key. There is nothing above them in a tree, because trees did not exist yet.

The same gap applies to every other pre-2012 wallet, which is a meaningful share of the oldest and most dormant bitcoin, the exact population BIP-361 was written about.

As such, the company conceded that the prototype is unaudited, supports three Bitcoin address types rather than Taproot, roots the proof at the coin-type key rather than the seed, and recovers nothing on any live blockchain as of today.

But the shape of the argument changes. Lopp has said plainly that he does not like BIP-361 and wrote it because he prefers the alternative less, and the loudest objection to it has been that freezing coins breaks bitcoin's promise of permanent ownership.

That objection assumes the freeze is final. A working recovery proof makes the freeze a lock rather than a burn, and hands the key to anyone who still holds their seed phrase.

Satoshi never had one.

Latest Crypto News

1

Inside Zcash's new node that targets Visa-scale privacy at 50,000 transactions per second

5 hours ago

2

France orders country's internet service providers to block Polymarket

13 hours ago

3

Crypto executives say digital native generations may never need a bank account

16 hours ago

4

DOG Mode explains Bitcoin's next governance fight

18 hours ago

5

Trump targets Brazil's payments system while dollar stablecoins are quietly overtaking country's payments

19 hours ago

6

Here is why a massive $1.6 billion in crypto liquidity is sitting idle and wasting away

19 hours ago

7

Massive bitcoin call spreads target $72,000 by month end, right when the Fed meets

20 hours ago

8

Tokenization has become a strategic priority for 84% of financial firms

21 hours ago

9

Polymarket traders cut Clarity Act passage odds to record low as Senate delay drags on

Jul 17, 2026

10

Stripe and Swift race to control the next generation of global payments infrastructure

Jul 17, 2026

Latest Research

Gate Leads Spot Market Share Gains as CEX Volumes Rise for First Time in Five Months

Gate Leads Spot Market Share Gains as CEX Volumes Rise for First Time in Five Months

CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B.

By

CoinDesk Research

Jul 13, 2026

CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B.

Why it matters

:

CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B.

View Full Report

More From

Tech

Inside Zcash's new node that targets Visa-scale privacy at 50,000 transactions per second

DOG Mode explains Bitcoin's next governance fight

Cardano hands core development to outside teams in decentralization push

Crypto

CD20

$1,752.11

CD20 up 0.88 percent

0.88%

BTC

$64,557.86

BTC up 0.83 percent

0.83%

ETH

$1,873.75

ETH up 1.59 percent

1.59%

XRP

$1.10

XRP up 0.83 percent

0.83%

SOL

$76.21

SOL up 1.74 percent

1.74%