Three researchers at the Bitcoin cryptography firm [alloc] init have published a 56-page paper proposing a way to hide the sender, recipient and amount of a Bitcoin transaction without changing Bitcoin’s consensus rules. The paper, titled “Shielded Bitcoin,” is dated September 24, 2026 and was written by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin, according to Cointribune.
The design borrows Zcash’s encrypted notes, public nullifiers that mark a note as spent, and zero-knowledge proofs that show a transfer is valid. Unlike Zcash, Shielded Bitcoin would not run its own blockchain or consensus mechanism. Bitcoin would serve as what the researchers call a neutral publication and ordering layer, while separate software called indexers verifies the proofs, checks for double spends and rebuilds the shielded state.
Also read: Saylor Moves Past CLARITY Act After Senate 49-50 Vote
The paper leaves one central question open: how real BTC enters or exits the system. That mechanism is deferred to a separate paper built on PIPEs v2, earlier [alloc] init research that encrypts a Bitcoin signing key so it can be recovered only with a valid proof, according to Decrypt.
Key facts
- The 56-page paper is dated September 24, 2026 and written by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin of [alloc] init.
- A private transfer would weigh roughly 700 vBytes, against 100 to 200 for an ordinary transaction, meaning it would cost about four times more.
- Zcash’s shielded pools hold 4.9 million ZEC, about 29% of issued supply, up from 7.6% five years ago and 23.3% one year ago.
- Zcash recorded about 63,000 shielded transactions last week, its best week since 2022, with more than $23 billion transferred, the highest since 2021.
- Deposits and withdrawals of BTC are not covered by the paper and are promised in a later document.
How the shielded transfer is meant to work
Value inside the system would sit in encrypted notes. Spending one publishes a marker proving it was used, alongside a mathematical proof that the spender controlled the funds. The amount, sender and recipient stay hidden.
Also read: Germany proposes 25% flat tax on crypto gains starting 2028
Under the plan, Bitcoin keeps its role as a settlement and ordering layer but gives up verifying anything about the private payment itself. That responsibility falls to software anyone can run using PIPEs v2. A Bitcoin confirmation would no longer guarantee that the private payment it carries is valid.
Timing, fees and the number of inputs and outputs remain public. As the paper puts it, Shielded Bitcoin preserves the privacy of who paid whom and how much, not the fact that a shielded transfer happened. The current version uses the Groth16 proof system, whose security depends on an honestly run trusted setup ceremony, and publishes each transfer in an OP_RETURN output, which comes to 625 vbytes for a transfer with two inputs and two outputs. That relies on the larger OP_RETURN default in Bitcoin Core v30, a contested change node operators can reverse, so relay depends on enough nodes and miners keeping it, the paper notes.
Mixed reactions from developers
Developer Vadim Zavodil criticized the proposal on X, arguing that much of its privacy stack had already been implemented by Zcash. Cointelegraph reported that he questioned how much privacy a new system could offer at launch, saying privacy is a function of the crowd and that a brand new metaprotocol starts at zero, so a first private transfer hides in a crowd of one.
The researchers acknowledged a similar limitation in a companion post, saying large deposits do not automatically create a large anonymity set and that observers may narrow down relationships between transfers if a small number of actors create most notes.
Pierre-Luc Dallaire-Demers, founder of the post-quantum cryptography firm Pauli Group, described the construction as interesting but not quantum resistant at all, Cointelegraph reported, adding that he was exploring what a fully post-quantum version could look like. Zerocash co-author and StarkWare CEO Eli Ben-Sasson was more supportive, saying the original intent behind the Zerocash paper was to bring privacy to Bitcoin. He said he had not yet read the Shielded Bitcoin paper but would like to see privacy and scalability through zero-knowledge proofs materialize on Bitcoin’s base layer.
Why it matters
Bitcoin’s base layer has never offered the transaction privacy that Zcash built into its own chain, and this proposal would add it without the consensus change that a soft fork would require. The timing is notable: Zcash’s shielded pools now hide nearly $7.8 billion, and the asset’s price has multiplied by more than 23 over a year on the privacy theme. Zcash’s roots trace back to Zerocoin, a privacy extension proposed for Bitcoin in 2013 that became an independent project in 2016.
For Bitcoin users, the tradeoff is cost and a weaker guarantee than a consensus-enforced design: they would pay roughly four times the normal fee and rely on indexer software, not miners, to confirm the payment is valid. The paper also sketches an optional compliance layer in which a trusted authority certifies approved deposits, letting institutions verify a note’s origins without exposing the transaction graph. Zcash now trades through regulated funds in the U.S. and Europe: Grayscale’s Zcash ETF began trading on NYSE Arca on August 25, and 21Shares listed Europe’s first Zcash exchange-traded product on Euronext Paris and Amsterdam on September 22, Decrypt reported. ZEC was trading at $1,592 on September 25, up 4% over the previous 24 hours, per CoinGecko data cited by Decrypt. Bitcoin itself fell below $84K as the 10-year Treasury yield hit a 19-year high, according to Cointelegraph’s latest coverage.
None of this is financial advice, and crypto markets are volatile and uncertain; readers should verify details independently.
What to watch
The follow-up paper on how BTC moves into and out of the shielded system, which the researchers said will use PIPEs v2 to lock a Bitcoin signature key. Until that design appears, the proposal covers only transfers that are already inside the pool, and the privacy it can actually deliver will depend on how many users adopt it.
Reported by cointribune.com.
Sources: Cointribune, Cointelegraph, Decrypt
