As quantum computing advances, the cryptographic foundations of Bitcoin face an existential threat. The elliptic curve digital signature algorithm (ECDSA) that secures every Bitcoin transaction could be broken by a sufficiently powerful quantum computer, enabling attackers to forge signatures and steal coins. In response, the Bitcoin community has proposed BIP-361, a soft fork that would freeze coins in addresses known to use only the legacy P2PKH script (pay-to-public-key-hash) and older wallet types that are quantum-vulnerable. Among the most prominent addresses frozen would be those belonging to Satoshi Nakamoto, the pseudonymous creator of Bitcoin, whose 1.1 million coins—mined in the early days—are all held in such legacy addresses.
Enter Project Eleven, a collaborative initiative that has developed a novel zero-knowledge proof (ZKP) system designed to recover bitcoin from those frozen addresses—but with a crucial caveat: it does not work for Satoshi’s coins. The reason lies in the nature of modern wallet architecture. Most Bitcoin wallets today use hierarchical deterministic (HD) key derivation based on BIP32, where a single seed phrase produces a tree of private keys. The security of the seed relies on one-way hashing functions, which quantum computers are not expected to break easily. Project Eleven’s scheme leverages this asymmetry: it allows a wallet owner who still possesses the original seed material (or the HD path information) to generate a ZKP that proves ownership of the funds without revealing the private keys themselves. The proof is checked against the blockchain’s record of the address, and if valid, the coins can be moved to a quantum-safe address.
“We have funded a proof that lets a wallet's own key-derivation path stand in as ownership after quantum computers can forge its signatures,” said a spokesperson for Project Eleven. “It runs in 243 milliseconds on a standard laptop, which is dramatically faster than prior work in this area.” The team’s prototype benchmarks show that generating the proof takes just a fraction of a second, making it practical for real-time use in a future quantum emergency. However, the system is still in early stages: it has not undergone a formal security audit, is not fully specified, and would require a network-wide consensus change (namely the activation of BIP-361 or a similar covenant) before it could protect any live coins. Without such a protocol change, the ZKP alone cannot override the existing transaction validation rules.
To understand the importance of this tool, one must recall the history of quantum threats to cryptocurrencies. Researchers have long warned that a quantum computer with enough qubits could break ECDSA’s 256-bit keys, potentially wiping out the roughly 5% of Bitcoin stored in P2PKH addresses that were widely used before the introduction of pay-to-script-hash (P2SH) and modern SegWit formats. These older addresses are especially vulnerable because their public keys are either exposed on-chain or can be derived from the address once the first spend occurs (since the script pubkey reveals the public key hash, which, when spent, reveals the full public key). Quantum deniability becomes moot for coins that have never been moved: they are protected only by the cryptographic hash of the public key, but a quantum computer could potentially reverse the hash and forge a signature for an unspent coin. This is why BIP-361 proposes to freeze such coins until quantum-safe recovery methods are deployed.
Project Eleven’s approach is elegant but narrow: it presupposes that the owner still has the HD seed. For Satoshi’s coins, that is not the case. Satoshi mined the first blocks using a custom wallet that did not follow BIP32 or any HD derivation standard. The private keys for those early addresses were likely generated in an ad-hoc fashion, possibly from a simple random number generator, and there is no known seed phrase or deterministic path. Without the seed material, the ZKP system cannot produce a valid proof—there is no derivation path to present. Thus, Satoshi’s 1.1 million coins would remain permanently frozen if BIP-361 is adopted, at least until an alternative quantum-recovery method emerges. Some have suggested using a trusted setup where Satoshi’s coins are time-locked to a future quantum-safe address via a consensus change, but that would require either the cooperation of Satoshi (unlikely) or a contentious hard fork that reassigns ownership—something the community is loath to do.
Prior recovery proposals have been far slower. Research on quantum-resistant Bitcoin updates often involved elaborate smart contract-like structures, such as using Lamport signatures or hash-based one-time signatures, which require huge on-chain data and complex wallet modifications. Project Eleven’s ZKP approach compresses the attestation into a tiny proof that fits in a single transaction input, making it efficient. Yet critics note that the system is incomplete: it does not address coins in multi-signature scripts, non-HD wallets, or those generated with old mobile apps that did not expose a seed phrase. Moreover, the ZKP itself relies on assumptions about the quantum-hardness of the hash function used in HD derivation (SHA-256). While SHA-256 is believed to be quantum-resistant (Grover’s algorithm only halves the security level), a sufficiently powerful quantum computer might still pose a threat to it, albeit far less severe than to ECDSA.
The timeline for practical quantum computers is uncertain. IBM plans to build a 100,000-qubit machine by 2033, but experts debate whether such a machine could break Bitcoin’s 256-bit keys. Some cryptographers predict that a fault-tolerant quantum computer capable of Shor’s algorithm could appear within 20 years, while others argue it will take much longer. In the meantime, Bitcoin’s developer community continues to explore quantum resilience. BIP-361 is just one of several proposals; others include replacing ECDSA with post-quantum signatures like CRYSTALS-Dilithium (already standardized by NIST) and requiring all new transactions to use those signatures. However, any such change would be a massive coordinated effort involving miners, nodes, and users.
Project Eleven’s announcement has sparked debate on social media. Some see it as a practical step toward mitigating a low-probability but high-impact risk. Others accuse the project of being premature and potentially exploitative—if such a tool exists, malicious actors might race to recover frozen coins before the true owners do, assuming the seed material is compromised. The team counters that the proof requires knowledge of the seed or derivation path, which only the legitimate owner would have.
From a journalistic perspective, the story underscores a broader trend: the intersection of quantum computing and cryptocurrency is moving from theoretical papers to tangible prototypes. As the first practical ZKP-based recovery tool for quantum-vulnerable Bitcoin, Project Eleven’s work is a significant milestone. Yet it remains a proof-of-concept with many hurdles before deployment—including audits, community consensus, and a wallet update on the part of users. For now, Satoshi’s coins remain safe, not because of quantum resistance, but because no one—not even Satoshi—can move them without the original private key or a protocol change. And as one developer put it: “Satoshi’s coins are the ultimate cold storage. Maybe that’s how it should stay.”
Source:Coindesk News