Bitcoin’s quantum problem gets a recovery tool, but not for Satoshi’s 1.1 million coins

Bitcoin signatures rely on elliptic curve cryptography, a system in which a private key generates a public key through math that runs only one way. Anyone can check the public key, but nobody can work backward to the private one. However, Shor’s algorithm, a quantum method published in 1994 for problems that ordinary computers cannot crack, can be fed a public key and return the private key that generated it.

Hashing is a different kind of problem. A hash scrambles an input into a fixed-length fingerprint and cannot be run backward, and the best quantum attack on it, called Grover’s algorithm, only halves the exponent rather than collapsing it, taking a 256-bit hash from 2^256 guesses down to 2^128.

That is still more guesses than a machine making a billion a second could get through in the lifetime of the universe.

Modern wallets are built on hashing. A wallet generates addresses in a tree, deriving each key from its parent, and a “hardened” derivation step feeds the parent’s private key through HMAC-SHA512 to produce the child key.

That is a one-way function. An attacker who breaks an address after Q-Day ends up holding exactly the key held, and cannot climb the tree to the key it came from.

Project Eleven and Jim Posen, lead developer of the Binius proof system, built a zero-knowledge proof around it.

The user proves they know the key material sitting above their address in the wallet’s derivation tree, that it derives the address in question, and binds the proof to a specific message, so the same proof can authorize the migration transaction. None of the key material is disclosed.

The benchmarks are what make it interesting. On an M5 MacBook Air, generating the proof takes 243 milliseconds on four cores, verification takes 40 milliseconds, and the whole thing uses about 2 gigabytes of memory and no GPU at all. There is no trusted setup.

Project Eleven’s runs in 910 milliseconds on the CPU alone, counting circuit construction, proof generation and self-checking, which it puts at 16 times faster. Excluding the one-time setup, which a real prover would build once and reuse, the gap widens to roughly 60 times.

Which brings it back to Satoshi. The entire trick depends on there being a key above a user’s address to prove knowledge of, and that the tree structure arrived with BIP-32, which was assigned on February 11, 2012.

Before it, as Bitcoin’s own documentation puts it, wallets generated every key independently and at random.

Satoshi mined through 2009 and 2010 and was gone by 2011. Those coins sit in pay-to-public-key outputs with the public key written directly onchain, generated by software that had no seed phrase, no derivation path and no parent key. There is nothing above them in a tree, because trees did not exist yet.

The same gap applies to every other pre-2012 wallet, which is a meaningful share of the oldest and most dormant bitcoin, the exact population BIP-361 was written about.

As such, the company conceded that the prototype is unaudited, supports three Bitcoin address types rather than Taproot, roots the proof at the coin-type key rather than the seed, and recovers nothing on any live blockchain as of today.

But the shape of the argument changes. Lopp has said plainly that he does not like BIP-361 and wrote it because he prefers the alternative less, and the loudest objection to it has been that freezing coins breaks bitcoin’s promise of permanent ownership.

That objection assumes the freeze is final. A working recovery proof makes the freeze a lock rather than a burn, and hands the key to anyone who still holds their seed phrase.

Satoshi never had one.