New protocol promises Bitcoin private transfers without a soft fork

3 hours ago 15

A new research paper is proposing something Bitcoin has never officially had: a way to send bitcoin without broadcasting who paid whom or how much changed hands. The design, published by researchers at Alloc Init and detailed in a paper titled “Shielded Bitcoin: Private Transfers on Bitcoin L1,” aims to bring Bitcoin private transfers to the network’s base layer without a soft fork, without a new blockchain, and without handing custody to any middleman.

Key takeaways

Shielded Bitcoin is a metaprotocol that hides transfer amounts and counterparties on Bitcoin Layer 1, requiring no soft fork or separate blockchain.
Transfers rely on encrypted notes, nullifiers and zero-knowledge proofs to stop double-spending while keeping details private.
No trusted operator or custodian ever holds users’ funds; indexers verify transfers but cannot spend anyone’s bitcoin.
Read-only keys allow selective disclosure to auditors or counterparties without granting spending power.
Entry and exit points, handled through a mechanism called PIPEs, remain observable, which the researchers say could still leak some metadata.

Introducing Shielded Bitcoin for Private Transfers on Bitcoin Layer 1

Bitcoin‘s public ledger is both its strength and its weakness. Every transaction is verifiable by anyone, but that same transparency means amounts, timing and wallet links sit in plain view forever. For treasuries, trading desks and businesses moving large sums, that visibility is a real liability.

Alloc Init frames its research around one narrow question, as described in the paper: can bitcoin move without publicly revealing transfer amounts and counterparties, using Bitcoin as it exists today? The answer they propose is Shielded Bitcoin, a metaprotocol built to strip out trusted operators, interactivity requirements, and the liquidity or collateral demands that plague many bridge-style privacy designs. Crucially, it does this without altering Bitcoin’s underlying consensus rules.

How Shielded Bitcoin Protects Transfer Details Using Zero-Knowledge Proofs

The protocol hides who is sending bitcoin, who is receiving it, and how much is moving, while still letting anyone verify that the system’s rules were followed. It does this by wrapping value into encrypted notes rather than exposing it directly on-chain.

Each note is a small encrypted record holding an amount and a way to reach its owner. When a transfer happens, the sender publishes an encrypted package to Bitcoin along with a compact zero-knowledge proof. That proof confirms three things simultaneously: the notes being spent actually exist, the sender is authorized to spend them, and the amounts entering and leaving balance out — all without revealing which notes they are or what they contain.

To stop the same note from being spent twice, every note carries a unique serial number known as a nullifier. Once a nullifier appears on-chain, it’s marked as used, and any attempt to reuse it gets rejected. Bitcoin itself doesn’t need to understand any of this. It simply stores and orders the encrypted bytes, acting, in the researchers’ words, like a public bulletin board, while separate software applies the Shielded Bitcoin rules to determine the resulting state.

Security and Trust Model Without Custodians or Trusted Operators

At no point does an operator or intermediary hold users’ bitcoin on their behalf. Only a user’s own spending key grants the authority to move their notes, and every transfer must carry a valid proof of that authorization before it’s accepted.

Verification falls to programs called indexers, which watch Bitcoin for shielded transfers, check the proofs, and confirm no serial number has already been used. Indexers hold no special power over the system. Anyone can rerun the same checks independently from the published history, and a dishonest indexer can only delay or serve stale data — it cannot spend a user’s funds. If a wallet’s chosen indexer misbehaves, the user can simply switch to another or replay the transaction history themselves. That built-in redundancy is central to why this approach to Bitcoin private transfers avoids the single points of failure seen in custodial privacy tools.

Selective Disclosure, Entry and Exit Mechanisms, and Trusted Setup Risks

Shielded Bitcoin doesn’t force an all-or-nothing choice between total secrecy and total transparency. A wallet derives multiple keys from one seed: a spending key, plus separate read-only keys — one that detects incoming transfers and another that recovers a user’s own outgoing history. Handing over a read-only key lets an accountant, auditor or counterparty see specific transfer details without ever gaining the ability to spend funds. The researchers note two caveats: a raw viewing key reveals everything it can see, so disclosing a single transfer is often better for narrow audits than sharing a whole key, and there’s no way to prove a discloser has shown absolutely everything.

Moving value into and out of the shielded system — what the paper calls peg-in and peg-out — is handled through a mechanism called PIPEs, short for the team’s broader work on using witness encryption to condition access to Bitcoin signing keys. The full mechanics are being saved for a companion paper. Alloc Init states plainly that it never holds users’ funds, including during these entry and exit movements, since access to bitcoin is meant to be controlled cryptographically rather than through custody.

That said, the paper is upfront about where the privacy model has edges. The zero-knowledge proof system used in the reference implementation, Groth16, requires a one-time trusted setup ceremony, and the security guarantees only hold if at least one participant in that ceremony was honest. And while transfers inside the shielded system stay private, entry and exit points remain visible on-chain — meaning amounts and timing at the boundary could still be linked to later activity by an outside observer.

How Shielded Bitcoin compares to other privacy efforts

Shielded Bitcoin isn’t the only attempt to reduce what Bitcoin exposes publicly. CoinJoin, PayJoin and Silent Payments all work inside Bitcoin’s existing transaction model, making ownership harder to trace, but they leave amounts and much of the transaction graph visible. Zcash is the closest conceptual ancestor, having pioneered the encrypted-note, nullifier and zero-knowledge-proof combination that Shielded Bitcoin borrows — though Zcash runs its own blockchain, while Shielded Bitcoin derives its state entirely from Bitcoin’s history.

The nearest Bitcoin-native comparison is Glass Coin, previously known as Shielded CSV. Both projects try to keep transfer details private without touching Bitcoin’s consensus rules, but Glass Coin relies on client-side validation, where participants themselves hold and pass around private proof data, using Bitcoin mainly to catch double-spends. Shielded Bitcoin takes a different approach: it publishes all the data needed to reconstruct the system’s state directly on-chain, so a wallet can rebuild its state from its own secrets and Bitcoin’s public history rather than depending on private data a user or counterparty might lose.

Why this design matters for Bitcoin’s future

None of these approaches cancel each other out — they represent different bets on how much privacy Bitcoin can absorb without changing its own rules. Shielded Bitcoin’s bet is that publishing everything needed on-chain, rather than relying on private proofs passed between parties, makes the system more durable and less prone to lost data. For institutions moving large sums, that durability could matter as much as the privacy itself.

Still, the researchers flag practical limits worth watching. Big deposits from a handful of actors, or distinctive wallet behavior, could still let outside observers narrow down likely relationships between transfers, even if the contents stay hidden. Shielded transfers also carry a larger on-chain footprint than ordinary Bitcoin transactions, which could translate into somewhat higher fees depending on how a transfer is shaped and published. And because peg-in and peg-out remain observable, the companion paper on PIPEs will need to address how much confidentiality actually survives at the boundary between shielded and ordinary bitcoin.