Bitcoin's Quantum Recovery Tool Cannot Unlock Satoshi's 1.1 Million Coins

A zero-knowledge proof system called Project Eleven has built a technical path to recover bitcoin from quantum-vulnerable addresses if owners hold their seed phrases, but the mechanism reveals a hard architectural limit: it cannot recover Satoshi Nakamoto's approximately 1.1 million BTC or any other bitcoin generated before 2012.

More than 34 percent of all bitcoin sits in quantum-vulnerable address category, meaning addresses whose public key has been exposed on-chain. BIP-361, a proposal published in April by Jameson Lopp and five co-authors, would block new deposits to these addresses after three years and freeze whatever remained after five years. The freeze addresses an existential risk: Shor's algorithm, a quantum method published in 1994, can derive a private key from a public key. Grover's algorithm, the best quantum attack on hashing, halves the exponent rather than collapsing it, reducing a 256-bit hash from 2^256 guesses down to 2^128, still computable by a sufficiently advanced quantum computer.

Project Eleven and Jim Posen, lead developer of the Binius proof system, built a zero-knowledge proof around key derivation hashing that allows owners to prove knowledge of their keys without exposing them. On an M5 MacBook Air, generating the proof takes 243 milliseconds on four cores, with verification taking 40 milliseconds, using about 2 gigabytes of memory and no GPU, according to CoinDesk's reporting. The CPU-only version runs in 910 milliseconds counting circuit construction, proof generation and self-checking, which the source claims is 16 times faster than prior work, or roughly 60 times faster excluding one-time setup.

But the recovery mechanism depends entirely on a derivation tree: the chain of parent keys from which child keys are derived. BIP-32 hierarchical wallet derivation was assigned on February 11, 2012. Before that date, Bitcoin wallets generated every key independently and at random with no seed phrase, no derivation path, and no parent key. Satoshi mined through 2009 and 2010, so those coins sit in pay-to-public-key outputs with the public key written directly on-chain. Without a parent key above the address to prove knowledge of, the recovery proof has nothing to prove. The same gap applies to every wallet created before 2012.

Project Eleven's prototype remains unaudited and incomplete. It supports only three Bitcoin address types rather than Taproot, the most modern standard. It roots the proof at the coin-type key rather than the seed, a design choice not explained as final. As of the article's date, the system recovers nothing on any live blockchain.

Jameson Lopp has stated plainly that he does not like BIP-361 and wrote it because he prefers the alternative less. A working recovery proof makes the freeze a lock rather than a burn, handing the key to anyone who still holds their seed phrase, and permanently excluding anyone whose coins predate the hierarchical derivation standard.