Researchers at Alloc Init have proposed, in a September 24 paper, private Bitcoin transfers using zero-knowledge proofs without requiring a soft fork.
- Shielded Bitcoin would hide senders, receivers and amounts without changing Bitcoin’s consensus rules or code.
- Indexers would verify zero-knowledge proofs and nullifiers while Bitcoin only publishes and orders transaction data.
- Researchers say the published design still leaves Bitcoin deposits and withdrawals for a forthcoming paper.
- Misha Komarov estimates shielded transfers could cost roughly four times ordinary Bitcoin transaction fees initially.
- Critics question early anonymity and quantum resistance, while researchers acknowledge privacy depends heavily on usage.
Alloc Init’s researchers Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin published Shielded Bitcoin as a metaprotocol that uses Bitcoin to publish and order encrypted transaction data. Bitcoin nodes would not need to understand or enforce the privacy system’s rules.
Called Shielded Bitcoin, the proposed system borrows core ideas from Zcash, including encrypted notes, nullifiers and zero-knowledge proofs. It would conceal shielded senders, receivers, transferred amounts and links to earlier notes while leaving Bitcoin’s existing consensus rules unchanged.
The proposal remains research, not deployed Bitcoin software. Alloc Init has not announced a mainnet launch date, while a separate mechanism for moving BTC into and out of the shielded system remains under development. Founder Misha Komarov described the underlying technique as experimental during an interview published September 24.
Shielded Bitcoin moves privacy checks outside consensus
Under the proposed architecture, Bitcoin would function as what the researchers describe as a neutral publication and ordering layer. A shielded transaction would place encrypted notes, nullifiers and a zero-knowledge proof into data carried by an ordinary Bitcoin transaction.
Separate programs called indexers would read the data in Bitcoin’s established transaction order. An indexer would verify the zero-knowledge proof, check whether each nullifier had appeared before and update its view of the shielded system when the transaction passes those checks. Invalid shielded data could still enter the Bitcoin blockchain because Bitcoin itself would not enforce the metaprotocol. The indexer would simply reject it from Shielded Bitcoin’s state.
A sender would consume encrypted notes representing previously received value and create new notes for recipients. The proof would establish that the sender controls valid notes, has not created value from nothing and has balanced transaction inputs and outputs without exposing the underlying amounts or notes.
As crypto.news explained in its recent guide to zero-knowledge proofs, ZK systems can prove that a computation followed specified rules without revealing the private information used in that computation. Shielded Bitcoin applies that model to Bitcoin transfers, while its indexers handle verification outside Bitcoin consensus.
A dishonest indexer could provide stale information, omit transfers or delay wallet updates, the researchers said. Such an indexer would not gain control of a user’s spending key. Users could switch indexers or independently replay the shielded transaction history from Bitcoin.
How the Zcash-style design hides transaction links
Shielded Bitcoin closely follows the note model used by Zcash. Nullifiers identify when a note has been spent without publicly revealing which encrypted note produced the nullifier, allowing an indexer to reject double spending while keeping the transaction link hidden.
Komarov characterized the concept more simply in his September interview: “It’s basically Zcash.” He said users would place bitcoin into a private pool, receive encrypted notes and later spend, split or use those notes when withdrawing. Alloc Init intends to connect that system to Bitcoin through its PIPEs research.
Privacy would not make every part of the activity invisible. Public observers could still see when a Shielded Bitcoin transaction occurred, its timing, transaction fee, data size, number of notes consumed and created, and the Bitcoin transaction carrying the encrypted information. A recognizable Bitcoin wallet used to publish those transactions could reveal further information about the publisher.
The researchers provide separate read-only keys for viewing incoming or outgoing activity. Users could disclose selected transaction information to an accountant or counterparty without surrendering spending authority, though Alloc Init cautions that sharing a complete viewing key would reveal everything covered by that key.
In related coverage, crypto.news reported this week on expanding demand for privacy-focused crypto systems. The report cited ZecStats data showing 4.91 million ZEC in Zcash shielded pools, representing 29% of issued supply at the time.
Anonymity and quantum resistance remain contested
The proposal has drawn questions over how much privacy a new shielded pool could provide at launch. Developer Vadim Zavodil argued that Zcash already has years of shielded activity behind its anonymity set, while a new Bitcoin metaprotocol would begin with few participants.
“Privacy is a function of the crowd,” Zavodil wrote, arguing that an early Shielded Bitcoin user could have very few comparable transactions to blend into. His criticism focuses on practical anonymity from user behavior and pool size, not whether the cryptographic proof itself conceals its private inputs.
Alloc Init’s own explanation acknowledges the same general limitation. A large quantity of bitcoin entering a shielded system does not by itself create a strong anonymity set if only a few actors generate most notes or if individual wallets follow recognizable deposit, withdrawal or timing patterns.
Research on Zcash has documented similar behavioral problems. A peer-reviewed 2018 study found that transaction patterns could shrink the effective anonymity set even when the underlying shielded cryptography remained intact. The study examined an older Zcash implementation and predates several later upgrades.
Post-quantum researcher Pierre-Luc Dallaire-Demers raised a separate cryptographic concern. He described the construction as interesting but “not quantum resistant at all.” In a follow-up, he said he was examining what a fully post-quantum version could require if Bitcoin eventually adopts post-quantum signatures.
Komarov has given a more conditional account. His interview with Unchained said the shielded pool’s eventual route to quantum resistance would depend partly on Bitcoin’s own signature system. Alloc Init has not presented Shielded Bitcoin as a finished post-quantum implementation.
Zerocash co-author and StarkWare CEO Eli Ben-Sasson responded more favorably to the project’s direction, while noting that he had not yet reviewed the full paper. His support therefore represented an initial reaction, not a technical endorsement of the construction.
Shielded Bitcoin still needs its Bitcoin entry and exit system
A major unfinished component is the movement of actual BTC into and out of the shielded metaprotocol. Alloc Init’s September 24 explanation says the current paper specifies shielded transfers after value is inside the system, while a forthcoming paper will describe peg-ins and peg-outs using PIPEs.
PIPEs relies on witness encryption to make access to a Bitcoin signing key conditional on proof that specified rules were followed. Komarov explained to the Bitcoin Development Mailing List in February that PIPEs v2 could emulate certain covenant and zero-knowledge verification functions without requiring a Bitcoin soft fork.
The cryptographic machinery remains computationally heavy. Komarov’s February disclosure put a PIPEs v2 ciphertext at roughly 330 TB of storage, while stating that researchers knew a route that could eventually reduce the figure toward 100 GB. The smaller target had not been achieved in that publication.
Shielded transfers would consume more Bitcoin block space as well. Komarov told Unchained that an encrypted shielded payload would run around 700 virtual bytes, compared with roughly 100 to 200 virtual bytes for a typical Bitcoin transaction. He estimated the resulting miner fee could be approximately four times higher.
No launch date has been set. Komarov said the team is gathering technical feedback while continuing work on the experimental construction, including open attempts to find faults in the design and work with witness-encryption researcher Sanjam Garg.
The next publicly scheduled presentation is set for September 28, 2026. The Bitcoin Treasuries Conference agenda lists Alloc Init researcher Clara Shikhelman for a five-minute session titled “Shielded Bitcoin: Private Transfers on Bitcoin L1” in New York.
