Researchers Publish 'Zcash-Style' Design for Private Bitcoin Transfers

Researchers from a cryptography development team have released a 56‑page specification for "Shielded Bitcoin," a protocol that enables private transfers on Bitcoin’s base layer without altering its consensus rules. The design adapts Zcash’s encrypted notes and zero‑knowledge proofs to hide the sender, recipient, and transaction amount.

How Shielded Bitcoin Works

Value is stored in encrypted notes. Each transfer includes a zero‑knowledge proof that the spender controls the notes and that inputs equal outputs. A public marker called a nullifier prevents double‑spending while keeping the specific note anonymous. Transfers are published on Bitcoin as data (via OP_RETURN outputs) and are verified by off‑chain indexers, which rebuild the shielded state.

Differences from Prior Proposals

The paper contrasts Shielded Bitcoin with the 2025 Shielded CSV proposal, which required users to retain their own transaction data. In Shielded Bitcoin, timing, fees, and the number of inputs/outputs remain visible, but the identities and amounts are concealed, similar to Zcash and Monero.

Peg‑In and Peg‑Out Mechanisms

The current specification covers only internal transfers. Methods for moving Bitcoin into and out of the shielded pool are deferred to a separate paper that will build on the team’s earlier PIPEs v2 research, which encrypts a Bitcoin signing key and releases it only with a valid proof.

Technical Details

• Uses the Groth16 zero‑knowledge proof system, which requires a trusted setup ceremony.
• Each transfer is recorded in an OP_RETURN output, occupying about 625 vbytes for a transaction with two inputs and two outputs.
• Relies on the larger OP_RETURN default introduced in Bitcoin Core v30; continued relay depends on node operators and miners maintaining this setting.

Potential Compliance Layer

An appendix proposes an optional compliance framework where a "Trust Authority" certifies approved deposits, allowing institutions to verify note origins without exposing the full transfer graph. Notes lacking such certification would still be valid.