Bitcoin’s Quantum Recovery Test: Proving an Ancestor Key, Not the Stolen Key

A Project Eleven prototype turns a difficult idea in Bitcoin’s quantum defense into a measurable engineering problem: after a quantum attacker can reproduce a wallet’s exposed private key, can the original owner prove a deeper claim of ownership without disclosing the wallet seed? The answer may be yes for many modern deterministic wallets, but it leaves Bitcoin facing uncomfortable exclusions, new cryptographic assumptions and a governance fight over whether frozen coins are protected property or permanently confiscated value.

Bitcoin’s quantum problem is often told as a race between a future machine and secp256k1, the elliptic curve signature system that protects the network’s coins. That framing is incomplete.

The more difficult problem begins after the cryptography fails.

Imagine a future Q-Day, the shorthand for the point at which a capable quantum computer can derive a Bitcoin private key from an exposed public key. A quantum attacker sees a public key onchain, calculates its corresponding private key, signs a valid transaction and moves the coins. On Bitcoin’s current rules, that transaction is indistinguishable from one signed by the legitimate owner. Both signatures verify. Both spend paths are valid. The chain has no historical memory of who held the secret first.

That is the ownership crisis at the center of BIP-361, the proposed Bitcoin quantum migration plan. Its basic premise is stark: signatures cannot remain the final test of ownership once an adversary can forge them from public data. The proposal therefore contemplates a timed freeze for quantum-vulnerable outputs, followed by a recovery process that uses a different kind of evidence.

Project Eleven’s new zero knowledge prototype makes that recovery process more concrete. Rather than asking a claimant to prove possession of the address private key, which a quantum attacker could also possess, it asks the claimant to prove knowledge of secret material higher in a modern wallet’s derivation tree. Crucially, the claimant need not reveal the seed, the parent key or the derivation path in public.

It is a meaningful advance because it changes the question from “who can sign now?” to “who can demonstrate a pre-quantum provenance path to this coin?”

CoinDesk reported in July that Project Eleven’s prototype generated such a proof in 243 milliseconds on an M5 MacBook Air using four CPU cores, with verification taking 40 milliseconds. The project reported no trusted setup, no GPU requirement and roughly 2 gigabytes of memory use. Those figures do not make the mechanism production ready. The prototype remains unaudited, incomplete and unavailable for live Bitcoin recovery. But they do show that the core proof need not be a theoretical object too expensive for ordinary wallet software.

The real failure mode begins when public keys are visible

Bitcoin has several output designs, and they do not expose the same information at the same time.

A traditional pay-to-public-key-hash output, commonly associated with legacy addresses, commits to a hash of a public key. Until its owner spends it, the public key is usually not visible onchain. Spending the output reveals the public key and a signature, creating the information a sufficiently powerful quantum adversary would need to attack the key.

The same broad principle applies to several newer designs. A coin may be comparatively safer while its public key remains hidden, then become vulnerable once a spend reveals the key. Older pay-to-public-key outputs are different. Their public keys were written directly into the locking script from the beginning. They are exposed for their entire onchain lives.

BIP-361’s concern is not hypothetical dust or a narrow historical edge case. CoinDesk reported that more than 34% of Bitcoin’s supply falls into the category of coins whose public keys have been exposed. Under the proposal’s model, those coins would become candidates for forced migration before a cryptographically credible Q-Day arrives.

The distinction matters because a future quantum theft may not look like a dramatic exploit. It may look like an entirely valid payment.

Suppose Alice spent from an address years ago and later received change back to the same key. Her public key is already onchain. At Q-Day, an attacker derives the private key, signs a transaction sending her remaining balance to a new address and pays a high fee. Miners see a valid transaction. Nodes see a valid transaction. The mempool sees a valid transaction. Nothing in Bitcoin’s existing signature checks says the attacker arrived at the key dishonestly.

That is why merely adding post-quantum signatures to new address types does not resolve the status of legacy, exposed coins. It gives users somewhere safer to migrate. It does not answer what to do if millions of coins are left behind and can later be taken by whoever first obtains quantum capability.

BIP-361’s answer is aggressive by Bitcoin standards. CoinDesk reported that the proposal would block new deposits to vulnerable address types after three years and freeze remaining coins after five years. The timeline is intended to create an orderly migration rather than a panic once quantum hardware becomes credible. It is also why the proposal is politically explosive.

A freeze turns an exposed coin from an immediately stealable asset into a locked claim. The recovery proof is the proposed key to that lock.

Why a signature cannot prove ownership after Q-Day

The quantum threat is asymmetric across Bitcoin’s cryptographic building blocks.

Bitcoin’s elliptic curve signatures depend on the difficulty of deriving a private key from its public key. On ordinary computers, that reverse calculation is infeasible. A public key can be published widely, and the private key remains secret.

A sufficiently capable quantum computer running Shor’s algorithm changes that equation. It could, in principle, calculate the private key from an exposed secp256k1 public key. At that point, signatures lose their evidentiary value. The legitimate owner and the quantum thief can both create valid signatures over the same transaction.

Hash functions present a different challenge. Grover’s algorithm offers a quadratic speedup for brute force search, but it does not deliver the same collapse in security that Shor’s algorithm creates for elliptic curve systems. CoinDesk summarized the practical distinction this way: a 256-bit hash facing Grover’s algorithm has a security margin comparable to 128 bits of brute force work, still astronomically beyond practical attack capability.

That gap is the opening for a recovery mechanism.

Modern hierarchical deterministic wallets do not create every address as an unrelated random key. They derive keys through a structured tree. A seed can produce a master secret. That master secret can produce account-level material. An account-level secret can produce branch and address keys. A wallet can therefore regenerate a vast collection of addresses from one backup.

Hardened derivation is particularly important. In a hardened BIP-32 derivation step, child key material is derived using the parent private key as part of an HMAC-SHA512 operation. An attacker who obtains a child private key cannot work backward through that one-way process to discover the parent key. In the quantum scenario, this gives the genuine wallet owner something the attacker lacks.

The attacker may obtain the address private key from the public key. But they do not automatically obtain the parent secret, the account-level secret or the wallet seed.

That is the difference between proving control of a compromised leaf key and proving a provenance path from a deeper secret.

What Project Eleven’s proof is actually asserting

A zero knowledge proof does not establish ownership in a philosophical or legal sense. It establishes that a mathematical statement is true, without revealing the secret inputs that make it true.

For this use case, the statement can be described in plain language:

I know secret key material at an approved ancestor point in a hardened wallet derivation tree. When the wallet’s published derivation rules are applied to that secret material, the result is the specific key or public key associated with this frozen UTXO. I also bind this claim to this exact recovery transaction.

That last sentence is essential.

Without transaction binding, a valid proof might be reusable. A third party could copy it and submit a different transaction directing the recovered coins elsewhere. A recovery system must ensure that the proof is specific to the destination, the amount, the frozen UTXO or UTXOs being claimed, and ideally an anti-replay commitment such as a unique transaction digest.

Project Eleven’s prototype binds the proof to a specific message so the proof can authorize the migration transaction rather than float independently as a generic ownership artifact. CoinDesk reported that the proof establishes knowledge of the secret material above the address, confirms that the material derives the relevant address and discloses none of the underlying key data.

This is not the same as proving that someone knows a BIP-39 recovery phrase. A BIP-39 phrase may be the practical backup a user holds, but it is not automatically the cryptographic object that must be reproduced inside the circuit. A production design must specify exactly where the proof roots its claim and exactly which derivation functions it verifies.

Project Eleven’s prototype currently roots the proof at the coin-type key rather than the original wallet seed, according to CoinDesk. That is a pragmatic engineering choice. It reduces the amount of wallet initialization logic the circuit must reproduce, while still requiring knowledge of secret material above the vulnerable address key. But it also narrows the statement being proved. The circuit is not necessarily showing that the claimant knows the mnemonic backup itself. It is showing they know an authorized ancestor secret from which the relevant coin path can be derived.

For a user, the practical effect could be seamless. A wallet that still has the seed could derive the required ancestor key locally, generate a proof and prepare the recovery transaction. The user would never type a seed phrase into a website, disclose a parent key to a miner or publish their whole wallet structure onchain.

For Bitcoin, however, the exact statement is protocol law. Small ambiguities become attack surfaces.

Statement binding is the line between recovery and a new theft vector

The soundness of the system depends on the circuit proving enough, but not proving too much.

Consider a weak statement: “I know a parent key that can derive some child key.” That is insufficient. It does not identify a particular frozen output. A proof for one wallet branch could become a loose credential that a malicious claimant tries to apply elsewhere.

Consider a stronger statement: “I know ancestor secret A, and under derivation path P it produces child public key Q, which is committed in frozen UTXO X.” This connects the private witness to a specific onchain coin.

Still, the recovery transaction needs binding. The final statement should include a hash or equivalent commitment to a migration transaction that names a destination output using a post-quantum safe spending condition. If the claimant changes the destination, the proof should no longer verify.

That construction gives validators a narrow task. They need not know who the owner is. They need not inspect a seed phrase. They need not recreate a wallet. They check that the UTXO is frozen, that the public statement identifies it, that the proof verifies, and that the transaction being mined matches the commitment embedded in the proof.

The claimant’s secret material remains on the prover’s machine.

This setup has a business implication beyond the protocol itself. It creates a new category of wallet resilience product.

Hardware wallet makers could identify vulnerable coins, map whether the wallet has enough derivation history to create a proof, generate recovery packages offline and help users migrate in batches. Custodians could audit their backup structures well before any Q-Day. Enterprise treasuries could test recovery workflows across multiple signer systems, key shards and dormant accounts.

The product is not quantum magic. It is custody hygiene, cryptographically expressed.

The limits start with what a wallet can prove

The recovery scheme relies on an ancestor secret existing.

That sounds obvious, but Bitcoin’s oldest coins expose the fault line.

BIP-32 was assigned in 2012. Before hierarchical deterministic wallets, wallet software commonly generated keys independently and stored them in local key pools. An old wallet could own hundreds or thousands of private keys without a seed-based derivation tree linking them to a shared root. The private key controlling an address might be the only secret ever associated with that address.

For those coins, a quantum attacker who derives the address key may have exactly the same secret as the original owner. There is no higher hardened ancestor key to distinguish them. No seed-based provenance proof can be constructed because no such provenance path existed.

CoinDesk reported that Satoshi Nakamoto’s early mining coins fall into this category. The coins were created with software that predated BIP-32, used independent key generation and placed public keys directly in pay-to-public-key outputs. The recovery design therefore cannot establish the missing historical link for them.

The problem extends beyond Satoshi. Charles Hoskinson argued in April that roughly 1.7 million pre-2013 bitcoin could be outside a BIP-39 seed-based recovery framework, including roughly 1.1 million bitcoin commonly attributed to Bitcoin’s pseudonymous creator. His estimate and conclusion remain part of an active debate, but the central technical point is sound: a proof system cannot recover an ancestor secret that an older wallet never had.

There are other difficult categories.

Some users may have created deterministic wallets but lost the seed while retaining an exported address private key. They can spend today, but in a post-quantum recovery model they may not be able to prove control of a parent path. Some wallets may use nonstandard derivation rules, imported keys or mixed key pools. Multisignature wallets need a clear specification of whether one signer, a threshold of signers or a distinct wallet-level recovery secret is required. Custodial systems may have complex key management policies that do not resemble a consumer BIP-32 tree.

Then there is Taproot.

CoinDesk reported that Project Eleven’s current prototype supports three Bitcoin address types and not Taproot. That limitation is not merely a feature checklist item. Taproot is a major part of Bitcoin’s modern script and signature design, and a migration architecture that cannot handle it would be incomplete for active users and future wallet development.

A full design must define which address types qualify, what exact derivation rules are admitted, how key aggregation affects the proof statement, and whether script-path spending cases need separate circuits. The more designs it supports, the more useful it becomes. The more designs it supports, the harder it becomes to audit and reason about.

The trust assumptions do not disappear, they move

Zero knowledge proofs are powerful because they minimize disclosure. They do not eliminate trust or risk.

First comes cryptographic soundness. Bitcoin would be trusting that a verifier accepts proofs only when the claimant actually possesses valid secret witness data. A bug in the circuit, an error in the derivation logic or a flaw in the proof system could create false recoveries. That risk is materially different from a normal wallet bug because a consensus rule could validate a theft forever.

Second comes implementation security. Wallet software must generate the proof without leaking the seed, ancestor key, derivation path or side-channel data. Hardware wallets and offline signing devices become especially important. A user who types a recovery phrase into a rushed web interface during a migration period could lose coins despite the elegance of the underlying mathematics.

Third comes policy design. Bitcoin must define the recovery window, the destination requirements and the treatment of contested claims. If an owner can recover to any ordinary address, the recovery transaction may simply recreate a quantum-vulnerable output. If the protocol requires a defined post-quantum output format, it must decide which cryptographic scheme is sufficiently mature and how future upgrades work.

Fourth comes consensus legitimacy.

BIP-361 is described by its authors as a soft fork proposal, but critics argue that freezing coins that remain valid under old rules is substantively closer to a hard fork in effect. Hoskinson made that argument publicly, saying the approach changes the expectations attached to existing coins. CoinDesk also reported that BIP-361 co-author Jameson Lopp has described the plan as a contingency concept he hopes never needs to be activated.

The technical distinction matters less to a coin holder than the practical one: can a transaction that would previously have been valid become unspendable by consensus rules? If yes, Bitcoin would be choosing collective security against quantum seizure over the current principle that possession of a valid key is enough to spend.

That choice may be defensible. It is not costless.

From permanent freeze to recoverable lock

The Project Eleven prototype changes the argument around BIP-361 because it weakens the claim that a freeze is necessarily a burn.

Without recovery, freezing vulnerable coins means the network deliberately immobilizes assets, potentially forever. The case for that is defensive: better to lock coins than let an attacker with quantum hardware seize and liquidate them. The objection is equally direct: Bitcoin should not retroactively redefine ownership or punish people who miss a migration deadline.

With a workable provenance proof, a frozen UTXO can instead become a recoverable lock for a broad class of modern wallet users. The holder who preserved wallet backup material has a path forward. The quantum thief has a private key but lacks the parent secret that the proof demands.

That is a better technical outcome, but it does not solve the distributional problem. It divides Bitcoin’s holders into those with a provable wallet ancestry and those without one. In many cases, the dividing line tracks history rather than responsibility. The oldest wallets, including the most symbolically significant coins, may be least able to use the recovery path.

Adam Back has advocated a different emphasis: build optional quantum-resistant features early, give users time to migrate and avoid a forced freeze if Bitcoin can coordinate when a threat becomes real. CoinDesk reported that he has argued for controlled preparation rather than waiting for a crisis, while BIP-361 embodies the opposing view that pre-scheduled enforcement may be necessary because emergency consensus could arrive too late.

Both camps agree on the underlying engineering objective. Bitcoin needs a destination for coins protected by cryptography that can survive a quantum future. They disagree on whether the network should compel the journey, and on what it should do with people who cannot make it.

The practical test for wallet owners

The most useful question for a Bitcoin holder is not whether they own a seed phrase in the abstract. It is whether they can produce a verifiable derivation path from retained wallet secret material to every UTXO they expect to recover.

That means asking:

1. Was this wallet created as a deterministic wallet with a recoverable backup?

2. Does the backup reproduce the account and address history where the coins reside?

3. Are any funds held on imported single keys, old paper wallets or pre-BIP-32 software?

4. Have public keys already been exposed through prior spending?

5. Does the wallet support the address type and derivation scheme that a future recovery circuit accepts?

6. Is the backup protected well enough that generating a recovery proof does not become the moment it is stolen?

Those are not questions users should wait to answer during an emergency. They are inventory questions for wallet vendors, custodians, exchanges and long-term holders today.

Project Eleven has not delivered a finished Bitcoin quantum recovery system. It has delivered something arguably more important at this stage: evidence that the most delicate component can be made practical on consumer hardware.

The core insight is simple, even if the circuit is not. In a quantum world, knowing an exposed address key may no longer demonstrate anything unique. Knowing the secret history that produced that key still might.

Whether Bitcoin chooses to encode that distinction into consensus is not a matter of proof speed alone. It will be a test of the network’s ability to balance immutability, property rights, cryptographic realism and the inconvenient truth that some of its oldest coins have no ancestry left to prove.