Project Eleven's Bitcoin Q-Day Recovery Solution: How to Prove Wallet Ownership After Quantum Attacks

2026/07/22 17:20:00

Introduction

Project Eleven has developed a post-quantum zero-knowledge proof that lets Bitcoin users prove ownership of their wallets using key derivation paths even after a quantum computer cracks the private keys on Q-Day. This solution addresses the core post-attack challenge: distinguishing legitimate owners from attackers who can forge signatures.

Quantum computers running Shor’s algorithm threaten ECDSA signatures securing Bitcoin. Once public keys are exposed on-chain — through legacy P2PK outputs or address reuse — a cryptographically relevant quantum computer (CRQC) can derive private keys. Both attackers and owners could then generate identical signatures, breaking the "not your keys, not your coins" principle.

Project Eleven's July 2026 proposal shifts proof of ownership from compromised signatures to the wallet's hierarchical deterministic (HD) structure under BIP-32. Legitimate owners prove knowledge of a parent key higher in the derivation tree without revealing it. Quantum attackers, limited to the derived child private key, cannot reconstruct or prove control of that parent.

What Is Q-Day and Why Does Bitcoin Face Immediate Quantum Risk?

Q-Day refers to the moment a fault-tolerant quantum computer can break current public-key cryptography like secp256k1 ECDSA used by Bitcoin. Project Eleven's 2026 Quantum Threat Report places the baseline scenario in 2033, with optimistic arrival in 2030 and pessimistic in 2042, based on progress in error correction and qubit scaling from Google and others.

Recent demonstrations show acceleration. In April 2026, researcher Giancarlo Lelli won Project Eleven's 1 BTC Q-Day Prize by breaking a 15-bit elliptic curve key on publicly accessible ~70-qubit hardware — a 512x improvement over the prior 6-bit record. While far from 256-bit production keys, it proves the attack class is practical on cloud quantum systems.

Approximately 7 million BTC (roughly 35% of supply, valued at hundreds of billions) sit in quantum-vulnerable addresses with exposed public keys, per mid-2026 trackers like Project Eleven's Bitcoin Risq List and similar analyses. This includes ~1.9–2 million BTC in always-exposed formats like P2PK and P2TR, plus reuse-exposed coins.

The primary risk is not preventing key derivation but recovering assets afterward. Migration to post-quantum signatures (e.g., NIST's ML-DSA) requires protocol changes and user action. Many holders — especially of dormant or lost wallets — will miss the window, leaving coins claimable by anyone with the derived private key.

How Project Eleven's Key Derivation Proof Works

Project Eleven's solution uses zero-knowledge proofs (ZKPs) on the BIP-32 derivation path to prove parent-key control without exposure. Developed with Jim Posen (Binius maintainer) and based on "signature lifting" research, it enables post-Q-Day recovery.

In a standard HD wallet:

A seed phrase generates a master private key.
Hardened derivation produces child keys for addresses.
A quantum computer derives a child private key from an exposed public key but cannot reverse hardened steps to the parent or seed.

The proof lets a user demonstrate:

Knowledge of a specific parent key in the tree.
Correct BIP-32 derivation to the target address private key.
Binding to a migration message or transaction.

Proof generation takes ~243 ms on an M5 MacBook Air (4 cores); verification is ~40 ms. It runs efficiently and integrates with existing wallet structures.

This is a fallback for users who miss proactive migration. It requires blockchain-level support for accepting such proofs in recovery transactions or consensus rules but operates without revealing secrets.

Comparison to Other Quantum Mitigation Approaches

Proactive tools like Project Eleven's Yellowpages already let users register post-quantum ownership proofs today. Users generate quantum-resistant keys (e.g., ML-DSA/SLH-DSA) linked to existing addresses via timestamped, verifiable proofs — without moving coins. These pre-commit to future migrations and provide ownership evidence pre-Q-Day.

Protocol-level changes, such as BIP proposals for post-quantum signatures or address freezing (e.g., temporary halts on vulnerable UTXOs), face coordination challenges across nodes and users. Freezes risk controversy over "confiscation," especially for Satoshi-era coins.

Seed-phrase ZK proofs offer another layer, proving ownership of BIP-39 mnemonics without revelation for recovery or authentication.

Project Eleven's derivation proof complements these by providing a wallet-specific recovery mechanism post-migration deadline. It targets the asymmetry: quantum breaks expose leaf keys, but derivation trees preserve owner-only knowledge higher up.

Approach	Proactive/ Reactive	Requires Protocol Change	Helps Dormant Wallets	Key Strength
Yellowpages Registration	Proactive	No (off-chain proof)	Yes (via pre-proof)	Timestamped PQ link
Derivation Path ZKP	Reactive (post-Q-Day)	Yes (for acceptance)	Yes	Proves parent control
Post-Quantum Signatures (e.g., ML-DSA)	Proactive	Yes (soft/hard fork)	Limited	New signature scheme
Address Freezing (BIP-361 style)	Reactive	Yes	Partial	Prevents spends

Challenges and Implementation Requirements

The proof is a prototype — unaudited and needs protocol integration. Bitcoin would require soft-fork or consensus updates to recognize derivation-based recovery transactions. Without this, exchanges, custodians, or forks might honor proofs voluntarily.

Performance is promising on consumer hardware, but scaling for high-value claims demands optimization and security audits. False positives/negatives must be eliminated, as must side-channel risks in proof generation.

Adoption hinges on education. Many users underestimate exposure from past address reuse. Hardware wallets and exchanges must support derivation proofs and hybrid signing during transition.

Project Eleven emphasizes layered defense: migrate what you can now via Yellowpages, prepare ZK tools for recovery, and push ecosystem-wide post-quantum readiness.

Conclusion

Project Eleven's Bitcoin Q-Day recovery solution marks a significant step toward post-quantum resilience by enabling proof of wallet ownership via key derivation paths after signatures become forgeable. Combined with proactive tools like Yellowpages, it addresses both prevention and recovery for the estimated 7 million vulnerable BTC.

Q-Day timelines point to 2030–2033, but accelerating demonstrations and research demand action now. Users who register proofs, avoid reuse, and support protocol upgrades will best protect assets. The crypto ecosystem must collaborate on migrations to preserve trust in digital ownership.

Bitcoin's decentralized nature offers flexibility, but it also requires individual responsibility. Tools from Project Eleven and similar efforts provide practical paths forward. Prepare today to safeguard your holdings through the quantum transition.

FAQs

What makes an address quantum-vulnerable on Bitcoin?

Addresses become vulnerable when their public key is exposed on-chain, either by design (P2PK, P2TR) or through spending/reuse that reveals it. Quantum computers can then derive the private key.

Can Project Eleven's solution recover lost seed phrases?

No. It requires knowledge of the derivation path and parent keys from an existing seed or wallet structure. Lost seeds still need traditional recovery methods.

How soon should I migrate my Bitcoin holdings?

Begin proactive registration with tools like Yellowpages immediately. Full protocol migrations may take years, but reducing exposure now limits risk.

Does this affect Ethereum or other chains similarly?

Yes, ECDSA chains face parallel issues, though EdDSA-based chains (like some alternatives) have different derivation properties. Project Eleven works across ecosystems.

Is trading Bitcoin on KuCoin safe during quantum uncertainty?

KuCoin maintains strong security, but always withdraw to self-custody wallets with fresh addresses and quantum preparations for long-term holding. Use small test transfers first.