TL;DR
- Researchers published a 56-page specification for Zcash-style private Bitcoin transfers, hiding sender, receiver, and amount.
- The protocol, called Shielded Bitcoin, uses zero-knowledge proofs and encrypted notes, and requires no changes to the network’s consensus rules.
- The mechanism for entering and withdrawing BTC from the shielded system is pending and will be detailed in a separate paper based on BTC PIPEs v2.
Researchers at cryptography firm [[alloc] init]] published a 56-page design for implementing private Bitcoin transfers without modifying the network’s consensus rules.
The protocol, called Shielded Bitcoin, hides the sender, receiver, and amount of each transaction, and was authored by Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin.
The design borrows core elements from Zcash: encrypted notes and zero-knowledge proofs. Each transfer includes a proof attesting that the sender controls the notes being spent and that the input and output amounts are balanced. A public marker called a nullifier allows the software to reject double spends without revealing which note was used.
Shielded Bitcoin vs. Other Privacy Alternatives
Unlike Zcash, which enforces its own rules through its blockchain, Shielded Bitcoin publishes transfers as data on the BTC network. The chain records them without validating them; it is the indexers—external software—that verify the proofs and reconstruct the shielded state. The paper contrasts this approach with Shielded CSV, a 2025 proposal in which each owner must custody their own transaction data, which generally cannot be recovered from the chain.
The authors acknowledge that some information remains public: timestamps, fees, and the number of inputs and outputs. “Like Zcash and Monero, Shielded Bitcoin preserves the privacy of who paid whom and how much, not that a shielded transfer occurred,” the paper states.
The current version uses the Groth16 proof system, whose security depends on a trusted setup ceremony conducted honestly. Each transfer is published in an OP_RETURN output, weighing 625 vbytes for a transaction with two inputs and two outputs. This mechanism depends on the increased OP_RETURN limit introduced in BTC Core v30, a contested change that node operators can revert.
Papers and the Road Ahead
The paper does not cover how BTC enters or exits the shielded system. That mechanism was reserved for a separate paper based on BTC PIPEs v2, prior research by [[alloc] init] that encrypts a signing key for BTC so that it can only be recovered with a valid proof.
Scott Odell, the firm’s chief operating officer, described the project as a contribution toward making BTC private without modifying it. The design also includes an optional regulatory compliance layer, in which a “trusted authority” certifies approved deposits for institutional use, without exposing the transfer graph.
