Bitcoin’s oldest vulnerability didn’t disappear when the network grew into a trillion-dollar asset. The risk that quantum computers could one day forge digital signatures and steal coins from exposed addresses has lingered since the beginning. Now a group called Project Eleven has funded a proof-of-concept that offers a recovery path—but only for wallets that use a specific key derivation structure. And the most famous stash on the network doesn’t qualify.
According to the original report , the proof runs in 243 milliseconds on a laptop. It leverages the wallet’s own key-derivation path—the hierarchical deterministic (HD) path defined in BIP32—to assert ownership after a quantum attacker has forged the corresponding signatures. The concept, funded by Project Eleven, aims to give users a way to reclaim coins trapped in addresses once their public keys become exposed on-chain.
The tension between progress and protection has always been asymmetric in Bitcoin. A quantum-capable adversary wouldn’t need to break the entire network; they could simply target any address whose public key is visible. That includes practically all spent-from addresses in pay-to-public-key-hash (P2PKH) and, critically, the early pay-to-public-key (P2PK) outputs that still hold a significant number of coins—including the roughly 1.1 million BTC attributed to Satoshi Nakamoto.
The Derivation Path Fix
Modern HD wallets generate keys deterministically from a master seed, following a structured path such as m/44′/0′/0′/0/0. That path becomes an alternative credential: if you can prove you know the path and the master seed, you can reassert control over coins even if the original public key was compromised. In essence, the path acts as a second authentication factor. The proof-of-concept demonstrates that this credential can be used to construct a valid transaction within 243 milliseconds on standard hardware.
That mechanism doesn’t work for Satoshi’s coins. Those early outputs were created using raw public keys, without any hierarchical derivation path that a modern wallet would recognize. They remain locked in a pre-BIP32 world. The proof is not a silver bullet; it’s a tool for the post-HD era of Bitcoin, which began years after Satoshi disappeared. Rolling out such a recovery mechanism would likely require a soft fork or at least broad community consensus, something Bitcoin’s governance process rarely delivers quickly.
Satoshi’s Coins and the Quantum Clock
The 1.1 million BTC sitting in Satoshi-era addresses represent a permanent test case. If a quantum computer ever reaches the threshold where it can derive private keys from public keys in a reasonable time frame, those coins would become instantly stealable. The absence of a derivation path makes the new recovery tool irrelevant for them. Whether Satoshi’s coins should be considered a donation to the quantum future or a ticking clock for Bitcoin’s security model is a debate that flares up regularly among core developers.
Meanwhile, developer activity across blockchains remains high, underscoring that security research is not stagnant. Top 10 Blockchains by Developer Activity This Week includes networks with strong protocol research, and Bitcoin’s own developer community has been exploring proposed solutions like Lamport signatures and post-quantum cryptography for years. The Project Eleven proof adds another piece to that evolving puzzle.
What Remains Unknown
Several questions are left open. First, how would users securely present their derivation path without exposing the master seed? The proof likely handles this cryptographically, but implementing it in practice introduces new attack surfaces. Second, would miners and node operators support a protocol change that might be perceived as enabling recovery of lost coins—a concept that carries its own philosophical baggage in Bitcoin’s immutability culture? And third, the exact timeline for quantum threats remains speculative. Breakthroughs in quantum error correction could compress the window for coordinated protocol upgrades.
For now, the project offers a practical illustration that Bitcoin’s scripting flexibility can be used to address quantum risks—provided the coins sit in wallets built after a certain point. The real test will be whether the community can move from a proof-of-concept to a live network upgrade before the threat becomes real. Satoshi’s coins, however, will likely remain the network’s silent exception.
