Shielded Bitcoin could give BTC Zcash-like privacy

On Sept. 24, researchers Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin of the group [alloc] init published a paper proposing Shielded Bitcoin, a metaprotocol designed to conceal senders, recipients and amounts for BTC-denominated transfers while using Bitcoin mainnet to publish protocol data. The design adapts techniques from Zcash, including encrypted notes, public nullifiers and zero-knowledge proofs, but does not alter Bitcoin’s consensus rules or create a new blockchain.

Under the proposal, value would be represented as encrypted notes denominated in BTC. When a transfer occurs, a sender would publish an “envelope” to the Bitcoin chain that contains encrypted outputs, public nullifiers that mark prior notes as spent, and a zero-knowledge proof that proves ownership and that inputs equal outputs. The current implementation profile uses OP_RETURN to carry the protocol payload, and the researchers note other publication methods are possible.

Bitcoin miners and full nodes would not validate the encrypted state. Instead, independent implementations that follow the Shielded Bitcoin rules would scan Bitcoin blocks, read envelopes in their recorded order, and replay them to build a shared private state consisting of a note tree and a set of spent notes. Bitcoin would provide the timestamped history and final ordering needed to reconstruct that private state.

The proposal is presented as an alternative to existing privacy techniques on Bitcoin such as CoinJoin, PayJoin and Silent Payments. Those techniques can obscure linkages between addresses but typically leave amounts and some transaction details visible. Shielded Bitcoin is designed to hide amounts, links between transfers and participant identities within the private layer.

The paper lists several open problems. Peg-in and peg-out mechanisms for moving ordinary BTC into and out of the shielded system are not specified. The researchers expect those flows to draw on earlier PIPEs v2 work but have not published a detailed construction. A distinctive deposit or withdrawal amount, or timing pattern, could still connect activity between the shielded layer and on-chain transactions.

Other unresolved choices include the final zero-knowledge proof system, the format for publishing envelopes and methods for light clients to verify shielded state without replaying large portions of Bitcoin history. Some metadata would remain visible on Bitcoin transactions that carry envelopes: timing, fees, counts of inputs and outputs and other characteristics could provide analysts with clues. The paper also proposes viewing capabilities that would let users selectively disclose transaction details for auditing or compliance while retaining control of funds.

Industry reactions noted possible consequences for privacy-focused tokens. André Dragosch, head of research at Bitwise Europe, called Shielded Bitcoin a “potential headwind for privacy coins.” Zcash has seen increased shielded activity and a recent price rise: weekly shielded transactions reached about 62,379, nearly 5 million ZEC were held in shielded pools and the network settled more than $23 billion in transfer volume in its strongest recent week.

Sam Callahan, director of strategy and research at OranjeBTC, framed the work as fitting a view that Bitcoin can accumulate functionality over time without changing its core rules, emphasizing decentralization, security and monetary policy as the network’s central features.

Researchers and developers will need to define secure, private peg flows, finalize the protocol’s technical choices and test whether the system resists practical deanonymization methods before Shielded Bitcoin could see wider use. The proposal keeps Bitcoin’s consensus intact while anchoring encrypted transfer data to the mainnet for ordering and timestamping.