A quantum lifeline for lost Bitcoin, but Satoshi's untouched

On 19 July 2026, the Boston- and Toronto-based Project Eleven said it had finished funding and reproducing a cryptographic result that lets a Bitcoin wallet prove ownership of its funds using only the wallet's own key-derivation path, after a sufficiently powerful quantum computer has demonstrated the ability to forge the signatures protecting it. The verification runs in 243 milliseconds on a consumer laptop, according to the company. The announcement is the most concrete delivery yet on a problem the Bitcoin community has discussed, mostly in the abstract, since at least 2017.

What the company has done is narrow a gap between two longstanding fears. The first is that a fault-tolerant quantum computer, once operational, will be able to derive a private key from a public key exposed on-chain, giving an attacker the ability to move any coins still secured by legacy signature schemes. The second is the practical scramble that would follow: who, exactly, can prove they own what, and how, in a chain whose history is immutable and whose lost-coins problem is already politically untouchable. Project Eleven's argument is that a wallet can recover access by proving knowledge of the seed from which its addresses were derived, rather than relying on the signature that a quantum adversary can forge. The proof is small enough to fit in a normal Bitcoin transaction.

A migration that may never come

The result arrives against a backdrop of Bitcoin developer sentiment that has, for nearly a decade, treated quantum risk as a tail concern rather than an operating one. The network's most-cited upgrade proposal, often labelled QRAMP, would move coins into hash-based signature schemes that are believed to resist quantum attack. It has not been merged, and adoption would require cooperation from the holders of legacy coins, including, critically, those who cannot sign anything.

The roughly 1.1 million BTC often attributed to Satoshi Nakamoto sits inside that unmoveable pile. The early blocks used pay-to-public-key (P2PK) outputs that expose the public key on-chain directly, leaving those coins, in the standard account, the most exposed of any large stash to a sufficiently capable quantum adversary. Project Eleven's tool does not address that case. A P2PK wallet has no recoverable key-derivation path in the manner the proof assumes; the seed that generated the public key is the very thing a quantum attacker would derive independently from the public key itself. The company is explicit on the limit: its recovery path is for wallets whose public keys have not yet been exposed, which means a non-trivial subset of legacy wallets, not the entire vulnerable population.

The framing matters. Roughly a quarter of all Bitcoin that will ever exist has not moved in more than a decade. Much of it is presumed lost; some of it is held by entities with no incentive to disclose their positions. The political question of what to do with dormant coins under a quantum emergency, freeze them, force-migrate them, leave them to be swept, has been almost entirely deferred. Project Eleven's contribution is to make the non-Satoshi subset of that problem tractable in code. The Satoshi subset remains, by design, out of reach.

What the proof does, and does not, change

The recovery path Project Eleven funded is not a new signature scheme. It is a zero-knowledge argument that a wallet knows the extended private key from which its current addresses were derived, built so that the argument itself does not require revealing the key on-chain. The wallet proves, in effect, "I am the same entity that generated this address hierarchy," without publishing anything a quantum adversary could later lift and forge against.

That distinction is the heart of the announcement. The threat model is asymmetric: a quantum computer powerful enough to break secp256k1 signatures would break any signature published today, but would not, in principle, break a hash-based zero-knowledge proof whose security rests on different hardness assumptions. The trade-off is bandwidth. The proof is heavier than a standard ECDSA signature and adds bytes to every transaction. On today's fee market that cost is small; on a congested one it is non-trivial, and Project Eleven's published benchmarks do not yet address the worst-case block-by-block pressure of a mass migration.

The clock the industry is not yet racing

Industry estimates of when a fault-tolerant quantum computer capable of breaking secp256k1 might exist cluster in the late 2030s, with wide error bars. That horizon is far enough out that the migration problem is treated, in most operational Bitcoin roadmaps, as something to plan for rather than to execute. Project Eleven's tool pushes that planning slightly into the executable, but only for the subset of holders who can act. The far larger political problem, dormant coins and the question of who decides their fate in a crisis, remains exactly where it was a year ago.

What the sources do not specify, and what the broader field has not yet answered, is whether a coordinated, network-wide migration to hash-based signatures is operationally feasible before the threat window opens, or whether the practical answer will be a messier combination of voluntary migration, opportunistic theft of exposed keys, and a politically charged argument over what to do with the coins that cannot move on their own. Project Eleven has narrowed one part of that problem. It has not narrowed the part the public is most likely to be asked about.

Desk note: Monexus framed this as a tool release with a stated boundary, not as a solution to the dormant-coins question. The Satoshi-attributed stash is named in the source material; the project's own limits on legacy P2PK outputs are the newsworthy edge.