Hoskinson Rejects BIP‑361 Claims, Says Zero‑Knowledge Recovery Cannot Unlock 1.7M Pre‑2013 BTC

TL;DR:

• Hoskinson warned that BIP-361 cannot recover the 1.7 million BTC pre-2013, including the approximately 1.1 million attributed to Satoshi Nakamoto.
• BIP-361’s recovery mechanism requires BIP-39 seed phrases, a standard that did not exist when those wallets were created.
• Co-author Jameson Lopp acknowledged that the proposal is a contingency plan that requires further research and that he himself does not endorse it enthusiastically.

Charles Hoskinson, founder of Cardano, pointed out that the BIP-361 proposal contains a structural flaw that renders it ineffective at protecting a considerable portion of the Bitcoin supply.

In recent statements, Hoskinson argued that approximately 1.7 million BTC stored in addresses predating 2013 cannot benefit from the recovery mechanism outlined in the proposal, given that those wallets predate the technical standards on which the current system is built.

BIP-361 was presented by Jameson Lopp, co-founder of Casa, alongside five co-authors. The initiative seeks to gradually phase out ECDSA and Schnorr signatures, considered vulnerable to quantum computers. The process is divided into three phases: Phase A blocks new sends to vulnerable addresses, Phase B causes nodes to reject transactions based on those signature schemes, and Phase C contemplates a recovery mechanism through zero-knowledge proofs tied to BIP-39 seed phrases.

Hoskinson Addresses the Problem of BTC Origins

The central point of Hoskinson’s argument is that wallets from the Satoshi Nakamoto era were created with an architecture that does not include BIP-39 seed phrases or hierarchical deterministic key generation. This leaves them outside the proposed recovery scheme. “1.7 million coins cannot do that. It’s not possible. 1.1 million of which belong to Satoshi,” he recently stated.

The BIP-361 text itself acknowledges this limitation by admitting that “it is not possible to construct a proof of ownership of an HD wallet for UTXOs created before BIP-32 existed”. The authors suggest that Phase C could be combined with an “Hourglass“-style proposal to manage funds in P2PK addresses, though this adds uncertainty and complexity to the process.

Hoskinson also questions the classification of the proposal as a soft fork. He argues that the plan would require a hard fork, a position that the BIP-361 text itself does not rule out, noting that activating Phase C independently would likely require “a relaxation of the consensus rules“. Lopp, for his part, acknowledged that he does not like the proposal but considers that the alternative, leaving quantum vulnerabilities unaddressed, is less acceptable.