ZK proof unlocks path to recover quantum-threatened Bitcoin
Project Eleven has built a fast zero-knowledge proof prototype that could save modern Bitcoin wallets from a proposed quantum-computing freeze, though it cannot rescue Satoshi Nakamoto's 1.1 million coins.
Project Eleven, a quantum research group, has developed a zero-knowledge proof system that allows owners of modern Bitcoin wallets to reclaim their coins if a future quantum computer compromises the network's cryptography. The prototype runs in 243 milliseconds on a standard laptop, bypassing the need to trust a third party.
The tool targets a vulnerability outlined in BIP-361, a controversial proposal published in April by Jameson Lopp and five co-authors. Because quantum algorithms like Shor's can eventually derive private keys from exposed public keys, BIP-361 suggested freezing over 34% of the total Bitcoin supply—including roughly 1.1 million BTC belonging to Satoshi Nakamoto—after a five-year window.
Rather than relying on elliptic curve signatures that quantum computers can easily forge, Project Eleven's proof exploits the hashing functions used in modern wallet key derivation. While quantum attacks can halve the complexity of a 256-bit hash via Grover's algorithm, the resulting 2^128 guesses remain computationally impossible. By proving knowledge of a parent key in a wallet's derivation tree without revealing the key itself, a user can authorize a migration transaction even if an attacker can forge their signature.
Benchmarks demonstrate the system's practical viability. On an M5 MacBook Air, generating a proof takes 243 milliseconds and verifying it takes 40 milliseconds, using just 2 gigabytes of memory and no GPU. Project Eleven claims this makes the process 16 to 60 times faster than previous attempts.
However, the technology cannot save all vulnerable coins. The recovery trick requires a hierarchical wallet structure, which did not exist before BIP-32 was assigned in February 2012. Satoshi's early coins, along with all other pre-2012 wallets, were generated randomly with no seed phrase or parent key.
The prototype remains unaudited, lacks support for Taproot addresses, and currently roots proofs at the coin-type key rather than the seed. However, it fundamentally alters the debate around BIP-361 by addressing the loudest objection to the proposal: that freezing coins breaks Bitcoin's promise of permanent ownership. A working recovery proof transforms that theoretical freeze into a reversible lock for anyone who retained their seed phrase.
