A New York cryptography research group has outlined a way to hide Bitcoin payment details on the base chain itself, without asking miners or node operators to adopt a protocol upgrade.
The design, called Shielded Bitcoin, comes from [alloc] init researchers Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin.
It borrows the encrypted-note model made familiar by Zcash, then parks that model on Bitcoin as it exists today.Bitcoin’s ledger is public by design.
Amounts, timing, and links between spends are visible, and wallets can often be tied to people or firms.
That transparency is a feature for auditability and a liability for treasuries, trading desks, and anyone who wants to move value without broadcasting a full financial trail.
Soft-fork proposals that would bake stronger privacy into consensus have not landed.
Shielded Bitcoin tries a different route: treat Bitcoin as a bulletin board that stores and orders encrypted bytes it cannot read.Inside the system, value lives in notes—small encrypted records that hold an amount and a way for the owner to claim it.
Those notes never appear in readable form on chain.
When Alice pays Bob, she creates an encrypted note only Bob can open, then publishes a transfer as ordinary Bitcoin data.
The payload includes the encrypted outputs, a one-time serial number (a nullifier) for each note she is spending, and a compact zero-knowledge proof.
The proof asserts that the spent notes exist, that she is authorized to spend them, and that incoming and outgoing amounts balance—without revealing which notes or how much they contain.
Independent indexer software watches the chain, checks each proof, and rejects reused nullifiers.
Anyone can rerun the same checks from published history.
No indexer, miner, or observer can spend another user’s notes.
Spending authority stays with the user’s spending key.
Separate viewing keys can detect incoming payments or recover outgoing history, which allows selective disclosure to an accountant or counterparty without handing over the ability to move funds.
What remains public is limited but real.
Outsiders can see that a shielded transfer happened, when it happened, how many notes were consumed and created, the fee, and the carrier Bitcoin transaction.
They cannot see amounts, the shielded sender and recipient, or which prior notes were spent.
The team is clear that a recognizable wallet paying the publication fee can still leak who posted the envelope.
The authors contrast the design with CoinJoin, PayJoin, and Silent Payments, which still leave amounts and much of the transaction graph visible, and with Zcash itself, which runs its own chain.
They also distinguish it from client-side-validation systems that keep proofs off-chain and risk loss of private data.
Shielded Bitcoin publishes enough on Bitcoin that a wallet can later reconstruct state from its keys and the public history.Important work remains unfinished.
Peg-in and peg-out—moving ordinary bitcoin into the private pool and back out—are reserved for a companion paper based on the group’s PIPEs research, which uses witness encryption so that no operator ever holds user funds. The current paper does not claim that entry and exit will be private.
Other caveats include a trusted setup for the Groth16 proofs used in the reference profile, a larger on-chain footprint (on the order of four times a typical payment), and the usual anonymity-set limits: unusual amounts, timing, and thin usage can still shrink privacy.
The proposal is research, not a live product. If it holds up under review, it would let users keep bitcoin’s settlement and security while moving value with far less public metadata—without a soft fork, federation, or bridge operator.
