A quantum recovery tool for frozen bitcoin — that can't reach Satoshi's coins

Project Eleven, a quantum-focused research outfit, says it has funded a working zero-knowledge proof that would let owners reclaim bitcoin frozen under a proposed defense against quantum computers — but by its own design the tool cannot recover the oldest and most famous coins, including the roughly 1.1 million BTC attributed to Satoshi Nakamoto. CoinDesk reported the work on July 19.

The context is BIP-361, published in April by Jameson Lopp and five co-authors. It would block deposits to quantum-vulnerable addresses after three years and freeze whatever remains after five — coins whose public keys are exposed on-chain and could, after a theoretical "Q-Day," be reverse-engineered into private keys via Shor's algorithm. BIP-361 puts that exposed share at more than 34% of all bitcoin. The plan always promised a later recovery path using zero-knowledge proofs; Project Eleven, working with Binius developer Jim Posen, says it has now built one.

The scheme leans on a distinction: quantum computers break elliptic-curve signatures but not one-way hashing. Modern wallets (since BIP-32, assigned February 11, 2012) derive keys in a tree via hardened HMAC-SHA512 steps. An owner can prove — without revealing anything — that they know the key material above their address in that tree, binding the proof to a specific migration transaction. An attacker who cracked the address alone cannot climb the tree.

The catch is structural. Satoshi mined in 2009–2010, before key trees existed; those coins sit in pay-to-public-key outputs with no seed, no derivation path, no parent key to prove knowledge of. The same gap applies to every pre-2012 wallet — precisely the dormant population BIP-361 targets. A working recovery proof, as CoinDesk frames it, turns the freeze "into a lock rather than a burn," but only for holders who still have their seed phrase. Satoshi never had one.

Key facts

• Proof generation runs in 243 ms on four cores of an M5 MacBook Air; verification 40 ms; ~2 GB RAM, no GPU, no trusted setup (Project Eleven, via CoinDesk).
• Project Eleven claims its system is 16× faster than prior work — up to ~60× excluding one-time setup (Project Eleven's own figures).
• BIP-361: published April 2026 by Lopp + 5 co-authors; freezes vulnerable coins after 5 years; >34% of supply exposed.
• Supports three address types, not Taproot; roots the proof at the coin-type key, not the seed.

The real-world read This is a benchmark and a claim, not a shipping defense. Project Eleven concedes the prototype is unaudited, incomplete, doesn't cover Taproot, and "recovers nothing on any live blockchain as of today" — and enabling it would require contentious consensus changes. The speed comparisons (16×/60×) are the company's own, an interested party marketing its result; treat them as unverified until audited. Note too Lopp's own position: he has said he doesn't even like BIP-361 and wrote it because he likes the alternatives less — hardly a ringing endorsement of the freeze this tool is meant to soften. And the headline limitation is real, not spin: the coins most cited to justify freezing are the exact coins this can never unfreeze.

Not financial advice.

Sources

• CoinDesk (Tier 2, July 19, 2026) — sole report; provided the benchmarks, mechanics, and Project Eleven's claims. It in turn cites BIP-361 (Lopp et al., primary), Bitcoin's own documentation on pre-BIP-32 key generation, and the February 11, 2012 BIP-32 assignment date. No sponsored or marketing material was used, though the performance figures originate with Project Eleven itself.