What is BIP-361?
In April, Jameson Lopp and five co-authors published BIP-361. The plan aims to freeze bitcoin that is vulnerable to quantum attacks. Under the proposal, new deposits to vulnerable addresses would be blocked after three years. Any coins still sitting in those addresses after five years would be frozen completely. That would affect more than a third of all bitcoin supply, including the roughly 1.1 million BTC attributed to the pseudonymous creator Satoshi.
But the proposal always had a backup plan. A later step promised a recovery path using zero-knowledge proofs. These are cryptographic tools that let someone prove to another person that they know a fact without revealing what that fact is.
Project Eleven builds the tool
Now, a quantum research outfit called Project Eleven says it has built exactly that. And they claim it is fast enough to actually use. This is significant because the so-called Q-Day is approaching. That is the theoretical point when a quantum computer could derive a private key from a public key. Once that happens, an attacker could sign transactions from any address whose public key has ever been exposed.
More than 34% of all bitcoin sits in that category, according to BIP-361. After Q-Day, a signature would prove nothing because the attacker can produce one just as easily as the owner. The blockchain simply could not tell them apart.
How bitcoin signatures work
Bitcoin signatures rely on elliptic curve cryptography. This is a system where a private key generates a public key through math that runs only one way. Anyone can check the public key, but nobody can work backward to the private one. However, Shor’s algorithm, a quantum method published in 1994, can be fed a public key and return the private key that generated it.
Hashing is a different kind of problem. A hash scrambles an input into a fixed-length fingerprint and cannot be run backward. The best quantum attack on hashing, called Grover’s algorithm, only halves the exponent rather than collapsing it. That takes a 256-bit hash from 2^256 guesses down to 2^128. That is still more guesses than a machine making a billion a second could get through in the lifetime of the universe.
Modern wallets are safer
Modern wallets are built on hashing. They generate addresses in a tree structure, deriving each key from its parent. A “hardened” derivation step feeds the parent’s private key through HMAC-SHA512 to produce the child key. That is a one-way function. An attacker who breaks an address after Q-Day ends up holding exactly the key they broke. They cannot climb the tree to the key it came from.
So for most users with modern wallets, the quantum threat might be manageable. But Satoshi’s old coins, mined in the early days, likely use older address types. Those would be frozen under BIP-361, with no recovery path. The proposal offers a way to save most of bitcoin, but not the coins of its founder.
