Bitcoin's Quantum Freeze Gets a Recovery Tool, Just Not for Satoshi

Bitcoin's plan to survive quantum computers now comes with a way to hand people their coins back. Project Eleven, a quantum research outfit, says it has built the recovery step that BIP-361 only promised, using zero-knowledge proofs, and made it fast enough to actually run. The catch is baked into the cryptography: it cannot rescue the roughly 1.1 million BTC attributed to Satoshi Nakamoto.

What the freeze does

BIP-361, published in April by Jameson Lopp and five co-authors, is blunt about the tradeoff. It would block new deposits to quantum-vulnerable addresses after three years and freeze whatever remains after five, stranding more than a third of all bitcoin. The threat it answers is Q-Day, the theoretical moment a quantum computer can pull a private key out of a public one.

Bitcoin signatures rely on elliptic curve cryptography, math that runs only one way. Shor's algorithm, published in 1994, runs it backward, feeding on an exposed public key and returning the private key that made it. More than 34% of all bitcoin sits in that exposed category, per BIP-361. After Q-Day, a signature proves nothing. An attacker can forge one as easily as the owner signs, and the chain cannot tell them apart.

Why hashing is the loophole

Not all of bitcoin's cryptography breaks the same way, and the recovery tool lives in the gap. Hashing scrambles an input into a fixed fingerprint and refuses to run backward. The best quantum attack on it, Grover's algorithm, only halves the exponent, dragging a 256-bit hash from 2^256 guesses down to 2^128. That is still more tries than a machine testing a billion a second could finish before the universe ends.

Modern wallets are built on that asymmetry. A wallet derives each key from its parent in a tree, and a hardened step runs the parent's private key through HMAC-SHA512, a one-way function, to produce the child. Crack an address after Q-Day and you hold only that address's key. You cannot climb back to the parent. That unreachable parent is the secret an owner proves knowledge of, through a zero-knowledge proof, to claim the coins before a thief moves them.

The coins left frozen

The trick needs a hidden parent key to point at, and Satoshi's coins never had one. That is the asterisk the plan always carried. Project Eleven can give owners a fast way to prove their claim and pull frozen coins back, but the roughly 1.1 million BTC attributed to Satoshi Nakamoto have nothing to prove. Five years after the rule bites, they freeze, and no proof can thaw them.