Shielded Bitcoin proposal enables private transfers without soft fork

Researchers at Alloc Init have released a paper describing a metaprotocol called Shielded Bitcoin that would allow private Bitcoin transfers using zero‑knowledge proofs while leaving Bitcoin’s consensus rules unchanged.

How the system works

In the design, ordinary Bitcoin transactions carry encrypted notes, nullifiers and a zero‑knowledge proof. Bitcoin nodes continue to publish and order transaction data as usual, but they do not enforce the privacy rules. Separate programs called indexers read the ordered data, verify the proofs, check that nullifiers have not been used before, and update the state of the shielded system. Invalid shielded data can still appear on‑chain; the indexer simply rejects it from the Shielded Bitcoin state.

Key components borrowed from Zcash

The proposal adopts the note model, encrypted notes, nullifiers and zk‑SNARK style proofs that underpin Zcash. Nullifiers allow an indexer to detect double‑spending without revealing which note was spent, preserving unlinkability between inputs and outputs.

Privacy guarantees and limitations

Shielded Bitcoin would hide sender, receiver and amount information from public view. However, observers would still see when a shielded transaction occurs, its fee, data size, and the number of notes created or consumed. The anonymity set depends on the number of participants and their usage patterns; early adoption may offer limited privacy.

Cost and performance considerations

Founder Misha Komarov estimates that a shielded transaction would occupy roughly 700 virtual bytes, compared with 100–200 bytes for a typical Bitcoin transaction, potentially raising miner fees to about four times the normal rate.

Open questions

• Quantum resistance: experts note that the current construction is not quantum‑secure and would need further work if Bitcoin adopts post‑quantum signatures.
• Entry and exit mechanisms: the paper focuses on transfers within the shielded pool; a separate forthcoming paper will detail how BTC can be moved into and out of the pool using the PIPEs protocol.
• Indexer trust: a dishonest indexer could provide stale or incomplete data, though it would not gain control of users’ spending keys.

Next steps

The team is gathering technical feedback and plans to present further details at the Bitcoin Treasuries Conference in September 2026. No mainnet launch date has been announced.