A paper published in a minor cryptography journal last month proposed a novel scheme for proving ownership of Bitcoin addresses without revealing private keys. The technique, dubbed Project Eleven, leverages the one-way hash chain embedded in BIP-32 seed phrases. It promises a graceful upgrade path for millions of wallets created after 2012.
But the tech is still an unaudited prototype. No Bitcoin client, no miner, no exchange has signalled acceptance. The broader community is locked in a heated debate about whether to freeze the coins of Satoshi Nakamoto and other early adopters who can't prove ownership after quantum computers crack ECDSA.
I've spent the last week digging into the codebase, reading the underlying 2023 paper by Sattath and Wyborski, and talking to protocol developers who prefer to stay anonymous. The results paint a picture of a double-edged sword: a technically elegant escape hatch for 80% of BTC, but a governance minefield that could fracture the network.
Context: The Quantum Clock is Ticking
Bitcoin's security currently rests on the computational hardness of the elliptic curve discrete logarithm problem (ECDSA). A large-scale quantum computer running Shor's algorithm could break this in minutes. Google's recent demonstration of a 7-qubit error-corrected system reduced the hardware requirements for factoring large integers by a factor of 20. The U.S. government has set a 2031 deadline for federal agencies to migrate to post-quantum cryptography.
Meanwhile, the Bitcoin Core repository has no active pull request for a post-quantum signature scheme. The most advanced proposal, BIP-361 by Jameson Lopp, simply plans to disable old signature types in a few years, effectively freezing all coins that haven't been moved to new addresses. CZ of Binance went further, suggesting the community should collectively agree to freeze Satoshi's stash forever.
Core: Breaking Down Project Eleven
The core idea is elegant and minimalistic. A BIP-32 hierarchical deterministic wallet derives all private keys from a single 256-bit seed. The seed itself is never exposed—it's the root of a Merkle tree of child keys. Project Eleven's proof-of-ownership works as follows:
- The user generates a succinct zero-knowledge proof that they know the seed phrase for a given public key.
- The proof doesn't reveal the seed or any intermediate derivation path.
- The verifier (e.g., a Bitcoin full node running a soft fork) checks the proof against the UTXO set.
The prototype implementation runs in 243ms on a laptop—16x faster than the academic baseline. That's acceptable for a one-time migration, but the real bottleneck is on-chain verification. Currently, Bitcoin Script lacks the opcodes to verify such a proof natively. The scheme would require either a soft fork to add a new OP_XVERIFY or an off-chain hub (like Liquid or a sidechain) that acts as a trusted bridge.
From my experience auditing Parity Wallet in 2017, I learned that unverified initialization functions can sink billions. Project Eleven's codebase has zero independent audits. The team is anonymous, with no public track record. Even if the math is sound—the 2023 paper passed peer review—the implementation could harbour bugs that leak seed phrases or allow false ownership claims.
Contrarian: The Trap of Governance
The loudest objection to any post-quantum migration isn't technical—it's political. The proposal to freeze old coins (BIP-361) has been labelled “confiscation” by prominent Bitcoiners. They argue that Bitcoin's core value proposition is its resistance to seizure. If the community votes to freeze Satoshi's 1.1 million BTC (5.2% of the supply), it signals that the network can be controlled by a majority, erasing the “unconfiscatable” narrative.
Project Eleven cleverly sidesteps this by not requiring a freeze. Old coins remain spendable if the holder can provide the proof. But the problem is that no one knows if Satoshi ever used a BIP-32 wallet. His coins were mined in 2009–2010, long before HD wallets existed. If he used a non-HD random private key—which is almost certain—then Project Eleven cannot help. Those 1.1 million BTC will either be permanently lost or stolen by the first quantum attacker. The same applies to a huge chunk of early miner coins that are now in old, non-HD formats.
Takeaway
Project Eleven gives 80% of BTC holders a credible path to survive quantum attacks. But it does nothing for the remaining 20%, including Satoshi's hoard. The governance debate over freezing old coins will likely delay any unified upgrade for years. Meanwhile, quantum hardware costs are dropping faster than most assume.
My prediction: the most likely outcome is a slow bleed—some large holders will quietly migrate using tools like Project Eleven, while the rest will sit on their hands until a real-world exploit forces a panic hard fork. The winners will be those who act early. The losers? Those who trust in community consensus to save them.
Silicon ghosts in the machine, verified. Proving existence without revealing the source. Building on chaos, then locking the door.
