Project Eleven, a research firm focused on quantum risks to bitcoin, has built a cryptographic proof that lets a Bitcoin wallet owner confirm ownership of coins after a theoretical quantum attack without ever revealing the private key. On an M5 MacBook Air, generating that proof takes 243 milliseconds, and verification takes another 40.
The technology is meant to close the biggest gap in BIP-361, the plan to freeze bitcoin's quantum-vulnerable addresses. The stakes are not abstract. A third of the entire coin supply is at stake, along with the trust exchanges and custodians place in old cold wallets. The catch is that the tool won't work for Satoshi Nakamoto's roughly 1.1 million BTC, and the reason sits in how the network's earliest wallets were built.
What Project Eleven actually built
A zero-knowledge proof lets one party show another that it holds certain information without ever revealing that information. Jim Posen, lead developer of the Binius proof system, worked on the project. A user proves they know the key material sitting above their address in the wallet's derivation tree, and binds that proof to a specific message. The same proof then authorizes the migration transaction to a new, quantum-resistant wallet, so no separate confirmation is needed.
None of the key material is exposed to an outside observer in the process. According to the company, the version working now runs 16 times faster than the earlier build. Strip out the one-time setup a real user only runs once and reuses afterward, and the gap widens to 60 times. No trusted setup is required at all, and the whole thing runs on a CPU with no GPU involved. By comparison, earlier attempts at similar bitcoin proofs typically needed either a powerful graphics card or many seconds of waiting.
Why a quantum computer threatens bitcoin
Q-Day is the theoretical point at which a quantum computer can derive a private key from a public one. That becomes possible through Shor's algorithm, published back in 1994 for problems ordinary computers cannot solve in a reasonable time.
Bitcoin signatures rely on elliptic curve cryptography. A private key generates a public key through math that only runs one way. Anyone can check a public key, but no ordinary computer can work backward to the private one. Shor's algorithm can reverse exactly that math. More than 34% of all bitcoin sits in addresses whose public key has already been exposed on-chain, for instance through any outgoing transaction. After Q-Day, a signature from such an address would prove nothing, since an attacker could produce the same signature as the real owner, and the network could not tell them apart.
Hashing is a different story. A hash compresses input data into a fixed-length fingerprint, and reversing that operation is not possible even in theory. The best quantum attack on hashing, Grover's algorithm, only halves the exponent instead of collapsing it entirely. A 256-bit hash drops from 2 to the power of 256 possible guesses down to 2 to the power of 128. That is still a number a computer making a billion guesses a second could not get through in the lifetime of the universe.
BIP-361 freezes coins after three years, then again after five
BIP-361 was published in April by researcher Jameson Lopp and five co-authors. The document would block new deposits to vulnerable addresses three years after adoption, then freeze whatever remains after five years. More than a third of bitcoin's total supply falls under the rule, including roughly 1.1 million BTC attributed to Satoshi Nakamoto.
A later stage of the plan promised a recovery path through zero-knowledge proofs specifically. An owner would be able to reclaim coins by proving ownership without exposing the key. Project Eleven has now shown that piece is technically achievable and runs fast, rather than staying a theoretical promise for later. That takes away part of the criticism aimed at BIP-361, since opponents previously had reason to ask whether the promised recovery mechanism existed at all.
Why the wallet's derivation tree is the whole trick
Modern software wallets build addresses as a tree. Each child key derives from its parent through the HMAC-SHA512 function, a process that cannot be run backward. Project Eleven's proof depends entirely on that structure. An owner shows they hold the key one level above a compromised address, and cracking that higher key through a quantum attack on the lower level is not mathematically possible.
The whole construction rests on the BIP-32 standard, assigned on February 11, 2012. Before that date, wallets generated every key independently and at random, with no hierarchy linking them. Satoshi mined coins through 2009 and 2010, then went quiet by 2011, before the standard even existed. Those coins sit in pay-to-public-key outputs with the public key written directly on-chain, generated by software that had no seed phrase, no derivation path and no parent key.
Proving anything about those coins is simply not possible. There is no tree above them, because the concept of a tree did not exist when they were created. The same gap applies to every other pre-2012 wallet, a meaningful share of the oldest and longest-dormant bitcoin, exactly the population BIP-361 was written about.
What still isn't ready for deployment
Project Eleven itself admits mass adoption is still a way off, and lists specific limits of the current version.
- The prototype has not passed an independent security audit yet
- Only three address types are supported, Taproot remains outside the scope
- The proof is rooted at the coin-type key rather than the full seed
- It has never run against a live blockchain, only in lab conditions
A freeze becomes a lock, not a burn
Lopp has repeatedly said he does not actually like BIP-361. He wrote the document only because he liked the alternatives even less. The main objection to the plan has always been that freezing coins breaks bitcoin's promise of permanent ownership, the promise the network has run on since launch.
That objection assumed the freeze was final and the coins were gone for good. A working recovery proof turns it into a lock rather than a burn, and hands the key back to anyone who still holds a seed phrase, say in a hardware wallet. For the rest of the network, that removes the main ethical argument against BIP-361. Satoshi never had a seed phrase, so the 1.1 million BTC will most likely stay frozen for good. The next move belongs to bitcoin's core developers. They still have to decide whether to put BIP-361 and Project Eleven's proof up for community vote, and when.
Comments
Your email address will not be published. Required fields are marked *