Project Eleven claims it has developed a proof that allows a wallet's key-derivation path to serve as ownership verification after quantum computers can replicate its signatures, executing in 243 milliseconds on a laptop.
By Shaurya Malwa|Edited by Aoyon Ashraf Jul 19, 2026, 10:00 a.m. 4 min readMake preferred on ShareShare this articleCopy linkX (Twitter)LinkedInFacebookEmailMake preferred on A statue of Satoshi Nakamoto, the assumed pseudonymous creator of Bitcoin, is displayed in Graphisoft Park on September 22, 2021, in Budapest, Hungary. The creators of the statue, Reka Gergely and Tamas Gilly, used anonymized facial features, as Nakamoto's true identity is still unverified. (Photo by Janos Kummer/Getty Images)SummaryShow- Project Eleven's new zero-knowledge proof system provides a viable method to recover bitcoin locked due to BIP-361’s proposed freeze on quantum-vulnerable coins, which includes Satoshi Nakamoto’s assets.
- This method takes advantage of the fact that quantum computers can break elliptic curve signatures, but not the one-way hashing used in current wallet key derivation, allowing only genuine owners with seed material to demonstrate control.
- Despite the impressive speed of Project Eleven’s prototype compared to previous efforts, it is still unaudited, incomplete, and would necessitate contentious alterations to blockchain protocols before it could recover any active coins.
The idea of freezing bitcoin's quantum-vulnerable coins has consistently included a caveat.
BIP-361, introduced in April by Jameson Lopp and five co-authors, suggests halting new deposits to at-risk addresses after three years and freezing any remaining balances after five years, which would leave a significant portion of bitcoin’s supply inaccessible, including the estimated 1.1 million BTC linked to the pseudonymous creator Satoshi Nakamoto.
A subsequent aspect of that proposal included a recovery mechanism utilizing zero-knowledge proofs, a technology that enables an individual to demonstrate knowledge of a fact without disclosing it.
Project Eleven, a quantum research organization, asserts it has successfully created such a proof and optimized its speed for practical use.
Q-Day refers to a hypothetical moment when a quantum computer could derive a private key from a public key, allowing an attacker to sign transactions from any address with an exposed public key.
According to BIP-361, over 34% of all bitcoin falls into this category. After Q-Day, signatures would become meaningless as an attacker could generate one just as easily as the legitimate owner, making it impossible for the blockchain to distinguish between them.
Bitcoin signatures utilize elliptic curve cryptography, where a private key produces a public key through a mathematical process that is one-directional. While anyone can verify the public key, reversing the process to find the private key is impossible. However, Shor’s algorithm, a quantum technique introduced in 1994 for solving problems that traditional computers cannot, can take a public key as input and yield the corresponding private key.
On the other hand, hashing presents a different challenge. A hash transforms an input into a fixed-length output and cannot be reversed, with the most effective quantum attack, Grover's algorithm, merely reducing the exponent rather than nullifying it, changing a 256-bit hash from 2^256 possibilities to 2^128.
Even this reduced number of possibilities exceeds what a computer operating at a billion guesses per second could process within the age of the universe.
Modern wallets are constructed on hashing principles. A wallet creates addresses in a hierarchical structure, deriving each key from its parent. A "hardened" derivation step takes the parent's private key and processes it through HMAC-SHA512 to yield the child key.
This is a one-way function. If an attacker compromises an address after Q-Day, they will only possess the key for that address and cannot trace back to the parent key.
Project Eleven, along with Jim Posen, the lead developer of the Binius proof system, has established a zero-knowledge proof around this concept.
The user can demonstrate that they possess the key material that is situated above their address within the wallet's derivation tree, that it leads to the specific address in question, and ties the proof to a particular message, allowing the same proof to authorize a migration transaction. No key material is revealed in the process.
The performance metrics are particularly noteworthy. On an M5 MacBook Air, generating the proof requires 243 milliseconds on four cores, verification takes 40 milliseconds, consuming about 2 gigabytes of memory without any GPU involvement. No trusted setup is needed.
Project Eleven's system operates in 910 milliseconds solely on the CPU, factoring in circuit construction, proof generation, and self-checking, which they claim is 16 times quicker than previous methods. When excluding the one-time setup, which a proper prover would create once and reuse, the speed advantage increases to nearly 60 times.
This brings the focus back to Satoshi. The entire premise relies on having a key above a user's address to validate knowledge of it, and the tree structure was introduced with BIP-32, which was established on February 11, 2012.
Prior to this, as Bitcoin's own documentation states, wallets generated each key independently and randomly.
Satoshi mined bitcoin from 2009 to 2010 and faded from the scene by 2011. Those coins remain in pay-to-public-key outputs with the public key recorded directly on-chain, created by software that lacked a seed phrase, derivation path, or parent key. Consequently, there is no higher key in a tree structure, as such trees did not exist back then.
This same limitation applies to other wallets created before 2012, which constitute a significant portion of the oldest and least active bitcoins—the very demographic BIP-361 addresses.
Thus, the company acknowledged that their prototype is unaudited, supports only three Bitcoin address types instead of Taproot, roots the proof at the coin-type key rather than the seed, and currently cannot recover anything on any live blockchain.
However, the nature of the argument shifts. Lopp has openly expressed his discontent with BIP-361, stating he wrote it because he favors the alternative less, and the primary criticism against it has been that freezing coins undermines bitcoin's commitment to permanent ownership.
This critique presumes that the freeze is absolute. A functional recovery proof transforms the freeze into a lock rather than a loss, providing the key to anyone who still retains their seed phrase.
However, Satoshi never had one.