Project Eleven has developed a zero-knowledge proof that could let Bitcoin holders recover funds restricted under a future quantum-security upgrade without exposing the wallet secrets used to establish ownership.
The post-quantum recovery prototype uses the key-derivation structure of BIP-32 wallets. A holder proves knowledge of private key material above an address in the wallet’s derivation tree, proves that the material generated the affected address and binds the proof to a migration transaction. The parent key and other private data remain hidden.
Testing on an M5 MacBook Air produced a proof in 243 milliseconds using four CPU cores, with verification completed in 40 milliseconds. The process used 2.1 GB of memory, required no GPU and produced a 358 KiB proof without a trusted setup.
The system remains an unaudited prototype. It supports P2PKH, P2WPKH and wrapped SegWit addresses, but not Taproot, and cannot recover funds on Bitcoin without new consensus rules.
BIP-361 Would Restrict Legacy Bitcoin Signatures
The work targets the recovery mechanism proposed under BIP-361, a draft soft-fork framework authored by Jameson Lopp and five other contributors. The proposal has not been approved, scheduled or activated.
Its current version would stop users from sending bitcoin into quantum-vulnerable script types about 160,000 blocks, or roughly three years, after activation. Two years later, nodes would tighten the conditions for spending through legacy ECDSA and Schnorr signatures.
Funds that failed to migrate would need to satisfy a quantum-safe rescue protocol designed to distinguish their original owners from attackers capable of deriving private keys from exposed public keys. The draft identifies hardened BIP-32 derivation paths as one potential source of that ownership asymmetry.
More than 34% of bitcoin had revealed a public key onchain by March 1, the proposal estimated. A narrower Glassnode assessment placed exposed supply at 6.04 million BTC, while the broader debate has often used figures approaching 7 million BTC.
A sufficiently capable quantum computer running Shor’s algorithm could theoretically derive an elliptic-curve private key from a revealed public key. Bitcoin does not face that capability from publicly known quantum hardware today.
Satoshi-Era Coins Lack BIP-32 Recovery Paths
Project Eleven’s method cannot establish ownership of bitcoin generated before hierarchical deterministic wallets became available. BIP-32 was introduced in 2012, after Satoshi Nakamoto had stopped publicly participating in Bitcoin development.
The roughly 1.1 million BTC commonly attributed to Satoshi were mined in 2009 and 2010 through pay-to-public-key outputs. Those keys were generated independently and have no seed phrase, parent key or hardened derivation path that could support Project Eleven’s proof.
The same limitation affects other pre-BIP-32 wallets holding early dormant bitcoin. BIP-361 supports a separate “Hourglass” mechanism for certain P2PK funds because its authors do not currently consider a comparable ownership-recovery proof possible for those outputs. The treatment of Satoshi’s quantum-exposed holdings would therefore remain a separate consensus decision even if the Project Eleven system reached production.
Be the first to comment