Bitcoin’s quantum problem gets a recovery tool, but not for Satoshi’s 1.1 million coins

A new zero-knowledge proof system developed by Project Eleven offers a potential method to recover bitcoin coins frozen under BIP-361, a proposed bitcoin protocol change aimed at addressing the threat of quantum computers breaking current cryptographic protections. BIP-361 would freeze bitcoin locked in quantum-vulnerable addresses, which amount to over 34% of the supply, including the roughly 1.1 million bitcoins attributed to Bitcoin's creator, Satoshi Nakamoto. The recovery tool uses zero-knowledge proofs to let a user prove possession of wallet seed material without revealing it, enabling migration of coins locked due to quantum vulnerability.

The system exploits differences between elliptic curve cryptography, which is vulnerable to quantum attacks via Shor’s algorithm, and hash functions used in modern wallet key derivation, which remain more quantum-resistant. Modern hierarchical deterministic wallets (defined by BIP-32 in 2012) use hardened derivation steps involving one-way hash functions so that even if an address key is compromised after a hypothetical quantum "Q-Day," the attacker cannot derive parent keys or other wallet keys. Project Eleven’s zero-knowledge scheme capitalizes on this tree structure to prove control over the wallet keys.

Benchmark testing showed the prototype is significantly faster than previous solutions, generating zero-knowledge proofs in under a quarter of a second and verifying them in milliseconds, without requiring GPUs or trusted setup. This performance improvement makes the approach practically usable. However, the prototype remains unaudited, incomplete, and would require controversial changes to bitcoin’s blockchain rules before being implemented on mainnet.

Importantly, the recovery tool cannot be used for coins mined or held before 2012, including Satoshi Nakamoto’s coins. These early coins do not have hierarchical wallet structures or seed phrases since those standards did not exist, only standalone public keys, meaning no parent key exists to prove knowledge of within the verification system. Thus, while the zero-knowledge proof offers a potential recovery path for quantum-frozen coins created under the modern wallet paradigm, the large and historically significant holdings from Bitcoin’s earliest years remain unrecoverable by this method.

The availability of a recovery path shifts the debate on BIP-361. Previously, the freezing of vulnerable coins was criticized as a final loss of permanent ownership, a core promise of bitcoin. With a working recovery proof, the freeze acts more as a temporary lock that can be undone by rightful owners retaining their seed material, though this still excludes legacy coins without seed phrases. The discussion over how best to address quantum vulnerability continues, balancing security, ownership rights, and the compatibility of proposed solutions with bitcoin’s decentralized protocol.