Bitcoin Quantum Recovery Proof Runs In 243 Milliseconds On A Laptop

Project Eleven has published a Bitcoin quantum recovery proof that answers a question the post-quantum debate has mostly avoided. Everyone accepts that a sufficiently capable quantum computer could derive a private key from an exposed public key and forge signatures. Far less attention has gone to the consequence: once both the attacker and the owner can produce a valid signature, the chain has no way to tell them apart. Project Eleven’s proposal treats that as a problem of ownership, and the distinction changes what a fix looks like.

The mechanism exploits an asymmetry already built into modern wallets. Quantum algorithms threaten elliptic curve signatures. They do not threaten the one way hashing used in BIP-32 hierarchical key derivation. An address is derived from a parent key, which is derived from a seed phrase, through hash functions that run in one direction only. An attacker who breaks the address key holds the child and cannot compute the parent. The owner holds the parent. Chief executive Alex Pruden set out the logic on X: proving knowledge of that parent key, without revealing it, is something only the genuine owner can do.

The Bitcoin quantum recovery proof, built with Jim Posen of the Binius proof system, wraps that argument in zero knowledge. The user proves three things at once: that they know the key material sitting above their address in the derivation tree, that this material derives the address in question, and that the proof is bound to a specific message so it can authorise a migration transaction. No key material is disclosed. There is no trusted setup.

The benchmarks are what moved the conversation. On an Apple M5 MacBook Air using four CPU cores and no GPU, proof generation takes 243 milliseconds, verification takes 40 milliseconds, peak memory sits at 2.1GB and each proof occupies 358 KiB. The prior implementation from Olaoluwa Osuntokun required 14.6 seconds and GPU acceleration. Project Eleven puts the improvement at roughly sixteen times, widening to about sixty times once one time circuit setup is excluded, since a real prover would build that once and reuse it. Three address formats are supported: P2PKH, P2WPKH and P2SH-P2WPKH.

The scale of the exposure explains the urgency. Coinbase’s quantum advisory board warned in June that roughly 7 million bitcoin sit in addresses that would be vulnerable without a post-quantum transition. Active holders can migrate to quantum safe addresses when the option exists. Dormant wallets cannot, because dormancy is precisely the absence of anyone to act.

Which brings the story to its most quotable limitation. The technique needs a reproducible BIP-32 derivation path, and Satoshi Nakamoto’s estimated 1.1 million coins predate that standard. Those addresses were generated before hierarchical deterministic wallets existed, so there is no parent key to prove knowledge of. The recovery layer that could rescue millions of dormant coins cannot touch the most famous dormant coins of all.

Three caveats belong on any assessment. The release is an unaudited prototype. It cannot recover assets on any live chain today. And using it would require protocol level support on Bitcoin, which means a consensus change, which means the sort of debate the network conducts over years. BIP-360 entered formal review in February 2026 and BIP-361 proposes freezing quantum vulnerable coins outright, an idea that has drawn opposition from people who regard confiscation by protocol as worse than theft by quantum computer.

The wider reach is worth noting. The mechanism applies to any chain using BIP-32 style hierarchical derivation, which includes Ethereum and other ECDSA networks. Google research published in March suggested machines capable of breaking current public key cryptography could arrive by 2029, and two US executive orders signed on 22 June set binding federal migration deadlines of 2030 and 2031.

The Bitcoin quantum recovery proof does not make the network quantum safe. It demonstrates that the recovery half of the problem has a workable answer that runs on a laptop in a quarter of a second, which is a considerably better position than the one the debate occupied a week ago.