Project Eleven demos ZK recovery proof for BIP-361 quantum

Project Eleven says it has built a zero-knowledge proof prototype meant to enable recovery or migration of bitcoin that could be frozen under the proposed BIP-361 quantum-vulnerability regime. The method depends on BIP-32 hierarchical deterministic wallets, leaving pre-2012 coins — including roughly 1.1 million BTC attributed to Satoshi Nakamoto — outside its reach and offering no live-chain recovery today.

Key Takeaways

BIP-361 proposes blocking new deposits to quantum-vulnerable addresses after three years and freezing remaining funds after five years.
More than 34% of all bitcoin sits in addresses with exposed public keys, the category BIP-361 labels quantum-vulnerable.
Project Eleven and Binius lead developer Jim Posen built a ZK method to authorize a migration transaction by proving knowledge of key material above an address in an HD derivation tree without revealing keys.
The prototype is unaudited, incomplete, not usable on Bitcoin today, and cannot apply to pre-2012 wallets because it relies on BIP-32 derivation trees.

Project Eleven Ships a BIP-361-Style Recovery Proof — With a Hard Cutoff at 2012

Project Eleven says it has funded and built a recovery proof system aligned with the “recovery step” envisioned in BIP-361, the proposal aimed at handling bitcoin considered vulnerable if quantum computers can forge signatures.

The cutoff is structural. The approach requires hierarchical deterministic (HD) wallet derivation trees, introduced with BIP-32, which was assigned on Feb. 11, 2012. Coins held in older wallet formats have no parent key path to prove, which makes them ineligible for this recovery design.

That matters because the most politically sensitive tranche of dormant supply sits in that pre-2012 bucket. The proposal’s own framing includes roughly 1.1 million BTC attributed to Satoshi Nakamoto, mined in 2009 and 2010, with Satoshi described as gone by 2011.

BIP-361’s 3-Year Deposit Block and 5-Year Freeze, and the 34%+ ‘Vulnerable’ Bucket

BIP-361, published in April 2026 by Jameson Lopp and five co-authors, lays out an enforcement timeline rather than a vague warning. It proposes blocking new deposits to quantum-vulnerable addresses after three years, then freezing whatever remains after five years.

The scope is large by design. BIP-361 states that more than 34% of all bitcoin sits in addresses whose public keys have been exposed on-chain, which it treats as quantum-vulnerable. The logic is that after a hypothetical “Q-Day,” signatures stop being a reliable ownership signal because an attacker could derive private keys from exposed public keys and produce valid-looking spends.

A concrete recovery mechanism changes the argument’s center of gravity. If owners can later prove control without revealing secrets, the freeze starts to look less like a permanent burn and more like a lock for users who still have modern wallet material.

Inside the ZK Approach: Proving the Parent Key Path, Not the Spend Key

Project Eleven’s design leans on an asymmetry: quantum attacks target elliptic curve signatures, while modern wallet derivation relies heavily on one-way hashing. In HD wallets, child keys are derived from parent keys in a tree, and the claim is that even if a quantum attacker can compromise a specific exposed key, they cannot “climb” to the parent key that generated it.

The ZK proof is built around that parent path. Project Eleven and Jim Posen constructed a method where a user proves knowledge of key material above the address in the derivation tree, proves it derives the address, and binds the proof to a specific message so it can authorize a migration transaction. The key material itself is not disclosed.

Performance is the headline claim. Project Eleven says that on an M5 MacBook Air, proof generation takes 243 milliseconds on four cores, verification takes 40 milliseconds, memory usage is about 2 GB, and the system requires no GPU and no trusted setup. It also reports a 910 millisecond end-to-end run on CPU alone, including circuit construction, proof generation, and self-checking, which it characterizes as 16x faster, widening to roughly 60x excluding one-time setup.

Adoption Friction: Unaudited Prototype, Limited Address Support, and No Live-Chain Recovery Yet

The market-relevant caveat is readiness. Project Eleven concedes the prototype is unaudited, supports three Bitcoin address types rather than Taproot, roots the proof at the coin-type key rather than the seed, and “recovers nothing on any live blockchain as of today.”

That leaves two separate hurdles. First is security and correctness, which remain unverified without independent review. Second is deployment: any BIP-361-style recovery path implies contentious rule changes before Bitcoin can recognize a proof as an authorization primitive.

Traders should treat the governance surface area as the near-term catalyst. BIP-361 targets a defined and very large “exposed public key” set with a clock attached, so renewed process momentum can create volatility around perceived supply locks even before any implementation exists.

Marcus Hale’s Take: This Makes the Freeze Debate More Actionable — and More Politically Charged

I see Project Eleven’s prototype as a narrative-to-mechanism shift. A freeze proposal is easier to dismiss when the recovery step is hand-wavy. A sub-second, no-trusted-setup proof that can authorize a migration transaction without revealing keys makes the “lock vs. burn” framing concrete for anyone still holding HD wallet material.

The threshold that matters is whether this moves from a benchmarked demo to something Bitcoin can actually validate on-chain, with audits and broader address support. If that path firms up while BIP-361’s 3-year deposit block and 5-year freeze timeline stays in the conversation, the setup starts to look structural rather than narrative-driven, because it re-prices which coins are credibly recoverable and which are politically destined to stay frozen.

Sources

CoinDesk