Bitcoin's quantum plan may lock old coins forever. Project Eleven wants another exit.

Project Eleven wants Bitcoin to prove wallet ownership after Q-Day. The mechanism is a post-quantum zero-knowledge proof built around wallet key derivation, not the old signature itself.

That's the important shift. After a strong enough quantum computer derives a private key from an exposed public key, a normal Bitcoin signature stops proving much. The attacker and the owner can both sign. Project Eleven's bet is that the attacker still cannot prove knowledge above a hardened BIP-32 step.

At the contract level, this is an identity problem. Bitcoin knows outputs and signatures. It does not know who meant to own a wallet before the signature system broke. Project Eleven is trying to add a new witness: prove the address came from your wallet tree, then move to a post-quantum address.

The numbers make this less academic. U.Today put the exposed set at about 6.9 million BTC, roughly 35% of circulating supply, as of July 16. That figure comes from one source, so treat it as a signpost, not a settled measurement.

BIP-360 is the cleaner engineering path. It defines Pay-to-Merkle-Root, or P2MR, a new bc1z output type that removes Taproot's key-path spend. You keep the script tree idea, but stop putting the long-lived public key in the dangerous place. The tradeoff is larger transactions for less public-key exposure. U.Today estimated a 57% data-size increase, also from one source.

BIP-361 is the pressure mechanism. It pushes users away from quantum-vulnerable outputs, then tightens old ECDSA and Schnorr spending after a deadline. If you're holding coins in an old wallet you cannot move, your bag becomes part of the protocol debate. Rescue it, freeze it, or let the first quantum winner take it. None of those options is clean.

Project Eleven is the first serious attempt to escape that binary. The proposal is still unaudited, and it does not recover funds on any live chain today. Read that twice. A clever proof is not the same thing as accepted Bitcoin consensus.

The code does what the announcement says, plus one harder thing: it reframes lost-coin policy as a proof-system question. That is useful. It is also not enough yet. Bitcoin does not adopt recovery mechanisms because a circuit benchmark looks good.

The next fight is not quantum marketing. It is verifier logic, wallet coverage, proof assumptions, and whether Bitcoin wants any post-deadline recovery path at all. For now, Project Eleven has given the debate a real mechanism. The protocol still has to decide whether recovery is a feature or a new attack surface.