Researchers have outlined a proposed Bitcoin privacy architecture that would conceal transaction amounts, counterparties, and the specific notes being spent without requiring a Bitcoin soft fork, a separate blockchain, or trusted operators.
Called Shielded Bitcoin, the metaprotocol would publish encrypted transaction data and zero-knowledge proofs to Bitcoin. Separate software would verify those proofs and derive the system’s state from the transaction history recorded on the Bitcoin network.
The proposal comes from Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin of Alloc Init. The researchers describe it as a way to add shielded transfers around Bitcoin’s existing consensus rules rather than modifying the Bitcoin protocol itself.
Bitcoin acts as a public data layer
Under the proposed design, Bitcoin would not directly interpret or validate the Shielded Bitcoin state.
Instead, the system represents value through encrypted records called notes. Each note contains an amount and information needed for its owner to access the funds, with the contents hidden from public observers.
When a user makes a transfer, the transaction publishes encrypted notes, unique serial numbers known as nullifiers, and a zero-knowledge proof to Bitcoin.
The proof is designed to establish that the transaction is valid without revealing which notes were spent or how much value was transferred.
Software known as indexers would monitor Bitcoin for the published data, verify the proofs, and maintain the resulting note state. Because the relevant data and verification rules are publicly available, the researchers say users can independently reproduce the state rather than relying on a central operator.
Zero-Knowledge proofs hide transaction details
The proposed transfer mechanism is designed around three core checks.
First, the spender must prove they are authorized to spend the notes being consumed. Second, the notes must exist in the system’s state. Third, the value entering and leaving the transaction must balance.
The proof allows those conditions to be checked without exposing the underlying amounts or identifying the notes being spent.
Nullifiers provide the system’s double-spend protection. A unique nullifier is generated when a note is spent, allowing indexers to reject a subsequent transaction attempting to spend the same note.
The researchers compare Bitcoin’s role to a public bulletin board that records and orders the data, while independent software applies the Shielded Bitcoin rules.
Wallets use separate spending and viewing keys
The proposed system separates spending authority from the ability to view transaction information. A wallet can derive a spending key as well as read-only keys that allow incoming or outgoing transaction information to be recovered. Those viewing keys do not provide the ability to spend funds.
The design would therefore allow users to selectively disclose transaction information, such as showing an accountant incoming transfers or providing details of an individual transaction to a counterparty. The researchers note that a viewing key can expose all information accessible through that key, making transaction-specific disclosure preferable for some audits.
Public blockchain data still reveals activity
Shielded Bitcoin would not make transactions invisible on Bitcoin.
Observers would still be able to see that a Shielded Bitcoin transaction occurred, when it was published, the number of notes involved, the transaction fee, and the Bitcoin transaction carrying the data.
The encrypted amounts, shielded sender and recipient, and specific notes being spent would not be publicly readable under the proposed system.
The Bitcoin wallet used to pay the transaction fee could still provide information about the party that published the transaction, meaning privacy at the shielded layer would not necessarily conceal every aspect of the user’s interaction with Bitcoin.
Entry and exit remain a separate problem
The researchers have not yet specified the full mechanism for moving bitcoin into and out of the shielded system in the paper described here. A companion paper is expected to address those transactions using PIPEs, a construction based on witness encryption that the researchers say can condition access to Bitcoin signing keys.
The proposed approach is intended to avoid holding users’ bitcoin through a custodial operator. However, the researchers distinguish the privacy properties of transfers within Shielded Bitcoin from those of entering and exiting the system.
That distinction is important because publicly visible amounts and timing at the system’s boundaries could potentially provide information for linking activity.
Design differs from existing privacy systems
The proposal takes a different approach from several existing Bitcoin privacy mechanisms. CoinJoin and PayJoin operate within Bitcoin’s existing transaction model and can make ownership relationships harder to infer, but transaction amounts and other elements of the transaction graph remain publicly observable.
Silent Payments are designed to improve recipient privacy without requiring recipients to publish reusable addresses, but they do not create a general encrypted-note system.
The researchers identify Zcash as a closer architectural precedent because it uses encrypted notes, nullifiers, and zero-knowledge proofs. Shielded Bitcoin differs by deriving its state from Bitcoin data rather than operating on a separate blockchain with its own consensus system.
Another Bitcoin-native proposal, Glass Coin, uses client-side validation, where participants maintain and exchange private transaction data and proofs. Shielded Bitcoin instead publishes the data required to reconstruct its shared state to Bitcoin.
The approaches involve different trade-offs rather than representing mutually exclusive systems.
Privacy does not eliminate inference risks
The researchers acknowledge that hiding transaction contents does not prevent all forms of transaction analysis.
For example, distinctive wallet behavior, concentration of activity, or repeated use of recognizable Bitcoin wallets to pay publication fees could provide information that helps observers link transactions.
The size and timing of deposits and withdrawals could also provide additional signals once the system’s entry and exit mechanisms are considered.
Shielded transfers would also require more on-chain data than ordinary Bitcoin transactions, potentially increasing the fees associated with publishing them. The researchers say the exact footprint would depend on the transaction structure and publication method.
Proof system requires setup assumption
The reference implementation described by the researchers uses Groth16 for its zero-knowledge proofs. Groth16 requires a one-time trusted setup ceremony. Under the proposed security model, the researchers’ guarantees depend on at least one participant in that ceremony behaving honestly.
Other zero-knowledge proof systems could remove or change that setup requirement, but they involve different tradeoffs in areas such as proof size and computational requirements. The choice of proof system remains part of the deployment considerations for the proposed architecture.
Researchers plan companion work on Bitcoin access
The current proposal focuses on private transfers within the Shielded Bitcoin system rather than the complete lifecycle of Bitcoin moving into and out of it. The forthcoming PIPE-based work is intended to address that boundary, including its security, confidentiality, liveness, and failure properties.
For now, the central proposal is to use Bitcoin as the public ordering and data layer while moving transaction-state verification and privacy logic into a separate metaprotocol.
That architecture would allow the researchers’ proposed shielded transfers to operate without changing Bitcoin’s consensus rules through a soft fork.
Also Read: ZetaChain Holders Approve Plan to Shut Down Layer 1 and Move ZETA to Solana
