The development of quantum computers capable of executing Shor’s algorithm with a sufficient number of logical qubits will transform elliptic curve cryptography from a security pillar into a structural vulnerability.
Bitcoin, whose digital signature infrastructure relies on ECDSA and Schnorr, faces a scenario where a private key can be derived from its corresponding public key within a computationally viable timeframe. Q-Day, as referenced in the literature, does not constitute a science fiction hypothesis but a time horizon with quantifiable research milestones.
The Bitcoin ecosystem has responded with BIP-361, titled “Post Quantum Migration and Legacy Signature Sunset“, published in April 2026 with five coauthors. The proposal establishes a three-phase migration schedule: a three-year period during which new deposits to vulnerable legacy addresses will be blocked, followed by a total freeze of remaining balances in those addresses after five years. The affected perimeter is considerable. More than 34% of the total Bitcoin supply, equivalent to approximately 7 million BTC, resides in addresses with exposed public keys on-chain.
Project Eleven has developed a prototype recovery tool based on zero-knowledge proofs that addresses the proof-of-ownership problem following Q-Day. The system leverages the hierarchical deterministic key derivation structure defined in BIP-32, standardized in 2012.
The implementation, developed with collaboration from Jim Posen, a principal maintainer of the Binius proof system, allows a user to demonstrate knowledge of the wallet seed without revealing the seed itself or the derived private keys. The prototype executes proof generation in 243 milliseconds on a MacBook Air M5, with a verification time of 40 milliseconds.
The scheme rests upon a fundamental cryptographic distinction
While elliptic curve cryptography is vulnerable to Shor’s algorithm, the hash functions employed in address derivation from public keys (in P2PKH, P2SH, P2WPKH formats) remain resistant to quantum attacks based on current knowledge.
The zero-knowledge proof demonstrates that the proponent knows the key material at a higher level of the BIP-32 derivation tree, thereby establishing a verifiable chain of custody that does not require exposure of the private key. The mechanism transforms the BIP-361 freeze from a permanent loss of funds into a reversible lock for users who possess their wallet seed.
The limitation of the system is structural and admits no solution within the proposed technical framework. Pay-to-Public-Key (P2PK) addresses, used in the early years of Bitcoin, do not employ the BIP-32 hierarchical derivation scheme.
In these addresses, the public key itself constitutes the address, and no tree structure exists from which to derive a seed-based proof of knowledge. The approximately 1.1 million BTC attributed to Satoshi Nakamoto, mined between 2009 and 2010, reside in P2PK addresses. The Project Eleven tool cannot be applied to these UTXOs for a purely technical reason: the absence of the data required to construct the proof.
Wallets predating 2012 that did not implement BIP-32, along with all P2PK addresses that have never been migrated to hashed-public-key formats, share the same limitation. The Coinbase Advisory Council Report estimated in June 2026 that approximately 1.7 million BTC are located in P2PK addresses. These UTXOs, like those of Satoshi, would remain permanently inaccessible under the BIP-362 scheme if not migrated before the established deadlines expire.
The Project Eleven prototype presents features that require additional technical consideration. The implementation has not been audited by third parties.
The system is incomplete in its current state and would require modifications to blockchain consensus rules for operational deployment. These modifications do not constitute a minor adjustment.
The nature of the proposed changes has generated debate over whether BIP-361 should be classified as a soft fork or a hard fork. The distinction has practical implications for the activation process and the level of consensus required.
The decision to freeze coins in vulnerable addresses introduces a tension with the principle of permanent ownership underlying Bitcoin’s design. The fundamental objection to BIP-361 is not technical but normative: the protocol would intervene to restrict the spending of UTXOs that, at the time of freezing, belong legitimately to their holders.
Proponents of the proposal argue that the measure is necessary to protect the network as a whole and that the five-year grace period provides sufficient time for action. Opponents point out that any mechanism preventing a legitimate owner from spending their coins, even with prior notification, constitutes a violation of the immutability promise of ownership.
The position of Satoshi’s holdings in this scheme adds an additional dimension to the debate. The exclusion of these coins from the recovery solution is not the result of a governance decision but a consequence of address format evolution. The Bitcoin network cannot, through consensus, create a BIP-32 seed for an address generated before the existence of that standard.
The only pathway for these coins to be spent in a post-quantum environment requires the private key holder (Satoshi or whomever possesses the keys) to sign a migration transaction before Q-Day renders the ECDSA signature scheme insecure.
BIP-361 establishes that, three years after activation, new deposits to vulnerable addresses will no longer be permitted. Five years after activation, remaining balances in those addresses will be frozen. The schedule assumes that holders of vulnerable UTXOs will take proactive action to migrate their funds to addresses with post-quantum signature schemes.
Experience with other migration events on blockchain networks suggests that a non-negligible fraction of holders will not perform the migration within the established period, whether due to key loss, lack of awareness, or prolonged inactivity.
The performance of the Project Eleven prototype is a relevant data point for evaluating the solution’s viability at scale. 243 milliseconds for proof generation and 40 milliseconds for verification represent a significant improvement over previous prototypes, but the system still requires validation under production conditions with the full UTXO set of the network. The scalability of the zero-knowledge proof scheme to handle millions of addresses remains an open question that can only be answered through network-scale implementations.
The United States government’s investment in quantum computing, with 2 billion dollars allocated, has moved the debate from academic circles into public policy agendas. Google’s 2026 advances, which reduced the hardware requirements for quantum attacks by a factor of 20, indicate that the reduction of the gap between the current state and Q-Day is not linear and can accelerate through innovations in qubit architecture and error correction.
The acceleration compresses the available timeline for migration and increases the probability that a significant fraction of UTXOs will remain permanently frozen.
The case of Satoshi’s coins raises a question that transcends technical and governance considerations: what does Bitcoin ownership mean when the protocol can, through consensus, declare certain UTXOs inaccessible? The answer to this question will define, in part, the evolution of Bitcoin as a value system.
If the network can freeze coins for cryptographic security reasons, the principle that the protocol does not interfere with user ownership is modified de facto. If, on the contrary, a mechanism is found that preserves the accessibility of all UTXOs, including P2PK ones, the solution will require a fundamentally different cryptographic approach than the one proposed by Project Eleven.
Academic literature has explored alternative schemes for post-quantum migration of Bitcoin, including hash-based signature systems such as WOTS-Tree and hybrid schemes such as PQ-Derived Schnorr.
These approaches offer paths for the transition to quantum-resistant signatures but do not solve the problem of existing UTXOs in legacy formats. The migration of these coins requires, in all cases, a transaction signed with the current scheme before Q-Day renders the scheme insecure.
The impossibility of recovering Satoshi’s coins through the Project Eleven scheme does not imply their permanent loss. If the holder of the private keys corresponding to those addresses (Satoshi or a third party) signs a migration transaction before Q-Day, the coins can be moved to addresses with post-quantum schemes.
The Bitcoin development community faces a decision with long-term implications. The implementation of BIP-361, with its freezing deadlines, and the adoption of the Project Eleven recovery tool, once audited and completed, will define the standard for quantum risk management in cryptocurrencies.
The precedent set by Bitcoin will influence the approach adopted by other blockchain networks facing the same cryptographic threat.
The solution proposed by Project Eleven solves the recovery problem for the majority of Bitcoin holders, namely those whose wallets use the BIP-32 standard. The prototype demonstrates that it is possible, through zero-knowledge proofs, to establish ownership of UTXOs without exposing private keys in an environment where digital signatures have lost their validity. The observed performance, with generation and verification times in the millisecond range, suggests that the solution is computationally viable for implementation at scale.
The exclusion of P2PK addresses, including those of Satoshi, is not a design flaw of the tool but an inherent limitation of the available data structure. The Project Eleven solution cannot create information that does not exist; it cannot derive a proof from a seed when the address was generated without one.
The technical limitation is, in its essence, a reminder that the evolution of Bitcoin standards has consequences for backward compatibility and that the design of recovery systems must account for the heterogeneity of address formats present on the network.
Be the first to comment