Cardano (ADA) founder Charles Hoskinson argues BIP-361’s zero-knowledge recovery mechanism cannot rescue roughly 1.7 million Bitcoin (BTC) locked in pre-2013 addresses. This includes roughly 1.1 million Bitcoins attributed to Satoshi Nakamoto.
Casa co-founder Jameson Lopp and five co-authors submitted the Bitcoin Improvement Proposal (BIP-361). It seeks to sunset legacy ECDSA/Schnorr signatures, rendering funds on those addresses unspendable.
Hoskinson Flags Fatal Gap in Bitcoin’s Quantum Plan
Estimates indicate that over 34% of Bitcoin is held in addresses potentially vulnerable to future quantum threats, prompting renewed focus on mitigation efforts. TheBIP-361 proposal seeks to address the vulnerability.
The draft phases out legacy Bitcoin signatures in three stages. Phase A blocks new sends to vulnerable addresses. In Phase B, nodes would reject all transactions that rely on ECDSA and Schnorr signatures
Phase C, pending further research, would let holders recover frozen coins. They would submit a zero-knowledge proof of possession of a BIP-39 seed phrase. However, concerns remain over the feasibility of such recovery. In a recent video, Hoskinson stated that,
“1.7 million coins can’t do that. It’s not possible. 1.1 million of which belong to Satoshi.”
He explained that these coins originate from Bitcoin’s early architecture, which predates modern standards like BIP-39 seed phrases and hierarchical deterministic key generation.
As a result, they fall outside the assumptions required for zero-knowledge-based recovery systems, limiting the effectiveness of proposals like BIP-361 for older holdings.
“if you build a ZK system based upon proof of a statement, your bit 39 key, say I have these things, you can recover some of the 8 million Bitcoin, but 1.7 million are on not under this scheme. All of the 2013 Bitcoin and before,” he added.
The limitation is acknowledged in BIP-361 itself, which concedes it is “not possible to construct a proof of HD wallet ownership for UTXOs created before BIP-32 existed.”
“Phase C is also compatible with an ‘Hourglass’ style BIP for spending P2PK encumbered funds, provided such a BIP has activated by the time Phase C activates,” the draft reads.
Hoskinson also disputes the soft-fork classification. He says the plan would require a hard fork. The BIP-361 text acknowledges that consensus rules may eventually need to loosen.
“After Phase B, both senders and receivers will require upgraded wallets. Phase C, if activated in conjunction with Phase B, may be soft forkable, otherwise it would likely require a loosening of consensus rules (a hard fork) to allow vulnerable funds to be recovered,” the authors wrote.
Notably, Lopp acknowledged the discomfort with the proposal, stating that he does not like it himself but considers the alternative even less acceptable.
