Project Eleven Proposes Bitcoin Recovery After Q-Day

Most work on post-quantum Bitcoin asks how to stop an attack before it happens. Project Eleven is asking a different question: if your key already gets cracked, how do you prove the coins are still yours? Its new proof of concept sits on the recovery side of that split, and that framing is what makes it worth reading closely.

The following is based on reporting by Cryptonomist and a thread posted on X by Project Eleven CEO Alex Pruden. Do note that the prototype hasn’t been audited, and it’s not a product you can use today.

What Q-Day breaks

Q-Day is the point when a quantum computer can take a Bitcoin public key and work out the matching private key. Bitcoin leans on elliptic-curve cryptography, which assumes that reversing that math is too hard to bother trying. A capable quantum machine removes that assumption.

Any wallet with an exposed public key on-chain becomes reachable. An attacker derives the private key, signs a transaction, and moves the funds. The owner may not notice until the money is gone.

The damage runs deeper than theft. Once a quantum machine can generate a valid signature for any wallet, a signature stops meaning anything. As Pruden wrote:

“After Q-Day, once a quantum computer can derive an ECC private key from its public key, a valid signature no longer proves ownership. Both the quantum adversary and the legitimate owner are able to produce identical signatures.”

So the real owner and the thief hold the same proof. That’s the issue Project Eleven is going after.

How Project Eleven proves ownership after Q-Day

The idea is to stop relying on signatures at all. Instead, the owner proves control of something higher up in the wallet’s key-derivation path: the parent key or seed the wallet’s private keys were generated from.

Here is why that’s so important. A quantum computer can crack a child private key from its public key, but it cannot run the derivation in reverse. It cannot rebuild the seed phrase sitting above that key. Only the actual owner knows it. Pruden wrote:

“So even after Q-Day, an attacker who’s broken your address’s private key does not hold, and can’t compute, the seed phrase it was derived from. Proving you know that parent key, without revealing it, is something only the real owner can do.”

The proof shows knowledge of the parent key without exposing it. That keeps the seed safe and still separates the owner from an attacker.

The implementation was built with Binius, an open-source zero-knowledge system. Jim Posen, its lead maintainer, wrote the code with funding from Project Eleven. The approach builds on “signature lifting,” a technique proposed by researchers Alon Sattath and Robert Wyborski.

Why recovery is as important as prevention

Prevention has an obvious limit. It only helps people who act in time.

The clean plan is for every Bitcoin holder to move funds into a quantum-resistant wallet before Q-Day. That will not happen for everyone. Coinbase’s quantum advisory council has estimated that around 7 million BTC could end up vulnerable if owners fail to migrate. That number is the council’s estimate, not a settled figure, and it depends on assumptions about who moves and who doesn’t.

For the people who miss the window, this proof gives a fallback. They can show ownership through derivation instead of through a signature a quantum machine could also forge. Pruden writes:

Read this carefully. This doesn’t stop theft. It gives a legitimate owner a way to prove, after the fact, that they are the real owner. Prevention and recovery answer two different questions, and this answers the second one.

Where this sits in the wider effort

Other work is moving in parallel. In February, Bitcoin developers pushed BIP-360, a quantum-resistant proposal, into formal review. In March, BTQ Technologies published a working implementation on its Bitcoin Quantum testnet so developers could try the approach.

Both efforts run into the same wall. A network-wide Bitcoin upgrade needs agreement from miners, node operators, and developers across a decentralized system. That kind of coordination has taken years in the past, and there is no reason to expect this to be quicker.

The takeaway

Project Eleven’s proof of concept is early. It is unaudited, and it would require changes at the Bitcoin protocol level before anyone could rely on it. Treat it as a demonstration that the derivation-based approach can work, not as protection you can switch on.

What it adds to the conversation is a shift in focus. Prevention assumes people prepare. Recovery accepts that many will not, and asks what a quantum-resistant wallet strategy owes to the holders who fall through. For a general reader, the practical step has not changed: understand your wallet’s derivation path and follow any credible migration guidance well before Q-Day.