A Bitcoin signature proves control of a key.
But what happens if a future quantum computer can manufacture that same signature?
Project Eleven says a wallet may have one more way to prove who got there first: its family tree.
The quantum-security firm has funded a post-quantum zero-knowledge proof that traces an address back through the wallet key-derivation path that created it. The prototype generated that proof in 243 milliseconds on an M5 MacBook Air using four CPU cores.
It verified in 40 milliseconds, required no GPU and kept the higher-level private key material secret.
That is a real technical result. It is not a live Bitcoin rescue system.
The code is early and unaudited. Bitcoin does not recognize the proof, no existing blockchain supports recovery with it today, and the current design cannot rescue the old P2PK coins commonly associated with Satoshi Nakamoto.
Those limits are not footnotes. They define what has actually been built.
“Q-Day” is shorthand for a future point when a cryptographically relevant quantum computer can break the elliptic-curve math behind Bitcoin signatures. No publicly known machine can do that today.
If such a machine arrives, a public key exposed onchain could become a target. An attacker might be able to derive its private key and produce a transaction with a perfectly valid signature.
The legitimate owner could sign, too.
At that point, the network would see two mathematically valid claimants and no reliable way to tell which one possessed the wallet before the attack.
Project Eleven approaches that problem from one level higher in the wallet. Instead of asking only whether someone knows the private key attached to an address, the proof asks whether that person knows private material above the address in a BIP-32 hierarchy and can demonstrate that the hierarchy really produced the key.
The owner does not disclose that parent material. A zero-knowledge circuit proves the derivation and binds the result to a message, which means a future recovery rule could use the same proof to authorize a particular move into a post-quantum address.
An attacker who recovered only the exposed address key would not have the higher-level secret above a hardened derivation step. Project Eleven’s argument is that quantum key recovery does not let the attacker reverse that hash-based ancestry.
The address-level key may be compromised. The wallet history behind it may still separate the owner from the thief.
@projecteleven has unveiled an early prototype designed to help #Bitcoin owners prove wallet ownership after the arrival of quantum computers capable of forging digital signatures.
“After Q-Day, once a quantum computer can derive an ECC private key from its public key, a valid signature no longer proves ownership — both the quantum adversary and the legitimate owner can produce identical signatures,” said @apruden08, CEO of Project Eleven.
The protocol allows users to prove a link between an address and its seed phrase via zero-knowledge proof, enabling fund transfers to a post-quantum address. The mechanism is currently unaudited, not active on the Bitcoin network, and would require a protocol upgrade. It cannot recover assets that have already been stolen.
— Mpost Media Group (@mpost_io) July 17, 2026
The benchmark is fast enough to move this idea beyond a thought experiment.
Project Eleven reports 243 milliseconds for proof generation on four cores of an Apple M5 processor, 40 milliseconds for verification and a fixed proof size of 358 KiB. Peak proving memory was 2.1 GB, with no graphics processor and no trusted setup.
The headline number needs one qualification. The 243 milliseconds covers proof generation, not every first-run step.
The published benchmark also lists about 630 milliseconds to build the circuit and prover, a setup that does not depend on a particular wallet and can be reused.
Self-checking took another 37 milliseconds. Project Eleven uses 910 milliseconds as its conservative full comparison against earlier work.
That earlier comparable implementation took 14.6 seconds with GPU acceleration, according to the technical note. The new CPU-only version therefore cuts the conservative comparison by roughly 16 times.
Speed solves only one part of the problem.
Bitcoin’s BIP-32 specification describes hierarchical deterministic wallets: one seed can generate a tree of parent and child keys instead of forcing a wallet to create and back up an unrelated secret for every new address. The proposal was assigned in 2012 and is now a foundation of modern wallet design.
A BIP-32 “extended key” includes a key and a chain code. Normal and hardened derivation steps create descendants with different security properties.
That hardened step is the critical barrier here. Even if a hypothetical quantum attacker recovers the private key at the exposed address, the attacker does not automatically obtain the private ancestor on the other side of the hardened derivation.
The prototype privately takes an extended key above the address, proves one hardened step and then two non-hardened levels, and produces a public digest that the verifier can match to the address. The secret path stays on the owner’s machine.
For a standard BIP-44 wallet path, the circuit begins above the account level rather than all the way back at the seed. That narrower proof is enough to establish the ancestry the recovery rule would need.
It also limits who can use it.
The current code supports three Bitcoin address families: P2PKH, native SegWit P2WPKH and wrapped SegWit P2SH-P2WPKH.
Taproot is not yet supported. Neither is the original P2PK output type.
Project Eleven says the architecture could later be extended to Taproot, more accounts, multiple assets and other BIP-32-compatible chains. The same general method could also be adapted to wallets using SLIP-0010 derivation on networks such as Solana.
That is future work, not current coverage.
Decrypt independently reported that the implementation was developed with Jim Posen, lead maintainer of the Binius zero-knowledge system, and builds on earlier “signature lifting” research. Its most useful role would be as a fallback for an owner who failed to move before a future quantum-migration deadline.
That ordering matters. A post-Q-Day recovery tool should not be mistaken for the first line of defense.
The cleaner defense is to give users quantum-resistant destinations and enough time to move before ordinary signatures become questionable. Recovery is for wallets that miss the window, cannot safely reveal a public key during migration or remain dormant until later.
Even then, a proof on a laptop does nothing unless the blockchain agrees to honor it.
Bitcoin would need explicit verification logic and rules defining which outputs qualify, what transaction the proof may authorize, when the recovery path opens and how competing claims are handled. Another chain could put a dedicated verifier into a smart contract, but the policy questions would remain.
Audits would come before any of that. A flaw in a recovery circuit could turn a safety valve into a new path for theft.
The Satoshi exception is technically important, although any exact estimate of Satoshi Nakamoto’s holdings remains an estimate rather than a proven balance sheet.
Bitcoin’s earliest coins were created before BIP-32 standardized hierarchical deterministic wallets. Many of the mining rewards associated with the Satoshi era also use P2PK outputs, which place the public key directly in the output’s locking condition.
The current prototype does not support P2PK. More fundamentally, those old coins do not come with the BIP-32 ancestry this proof is designed to verify.
Someone may possess the original private key for an early output. After the hypothetical quantum break, however, knowledge of that address-level key would no longer prove that the claimant possessed it first.
Without a supported parent derivation path, the proof has no higher branch to test.
That does not prove the coins are lost, nor does it decide what Bitcoin should do with them. It means this particular recovery primitive does not settle their ownership.
The gap leads straight back to Bitcoin’s hardest quantum-policy fight: whether exposed legacy coins should remain spendable, be frozen, face a special recovery process or be handled some other way.
Cryptography can create options. It cannot choose the legitimacy rule for a decentralized network.
A separate proposal, BIP-360, shows the difference between protecting future outputs and recovering old ones.
The draft would add Pay-to-Merkle-Root, or P2MR, an output type with nearly the same programmable spending-tree function as Taproot but without its key-path spend. Its goal is to reduce long-exposure risk by avoiding an elliptic-curve key that sits publicly available for a future attacker.
BIP-360 is a consensus-layer soft-fork proposal that was assigned in December 2024 and remains in draft status. Its own security section draws a line between long-exposure attacks on keys that remain visible for a long time and short-exposure attacks on a key revealed while a transaction waits for confirmation.
P2MR addresses the first problem. The draft says broader short-exposure protection may still require post-quantum signatures, a larger change than removing one spend path.
BIP-360 is still a draft. It does not activate Project Eleven’s proof, protect every spending scenario or supply missing wallet ancestry to Satoshi-era outputs.
The two efforts attack different points on the timeline.
One tries to give future holders a safer place to put coins. The other asks how a modern wallet that failed to move could prove its history after ordinary signatures became ambiguous.
A serious migration plan may need both prevention and recovery, plus a separate answer for ancient coins that fit neither path.
There are practical constraints beyond consensus. A 358 KiB proof is compact for some zero-knowledge systems but large in Bitcoin terms. Designers would have to decide how much of it is transmitted, verified and stored, whether proofs can be batched, and who pays the computational cost.
The reported 40-millisecond verifier suggests raw speed may be manageable. It does not answer network-level bandwidth, denial-of-service or implementation-security questions.
Wallets and custodians would also need to preserve the right higher-level key material. A recovery standard that works mathematically can still fail operationally if users deleted the very ancestry they must prove.
That is why this prototype matters now, even if Q-Day remains hypothetical.
Bitcoin migrations take years. Wallet support, hardware changes, consensus review, audits and user education move far more slowly than a benchmark on a laptop.
Project Eleven has not solved Bitcoin’s quantum problem. It has isolated one ugly part of it and shown that a legitimate modern wallet may be able to prove something a future attacker cannot forge.
The proof took 243 milliseconds.
Turning it into a rule that Bitcoin trusts—and deciding what happens to coins with no derivation history—will take much longer.
Continue reading...
[ H/T WLT Report ]
