Researchers Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin at the New York cryptography lab [alloc] init have proposed a system called Shielded Bitcoin that would allow users to make private Bitcoin transfers without changing the network’s existing consensus rules. The proposal, published on September 24, describes a metaprotocol that uses encrypted notes and zero-knowledge proofs to conceal transaction amounts, counterparties and links between previously spent funds. Instead of requiring Bitcoin nodes to understand the new privacy system, the design places its additional verification logic in software operating alongside a Bitcoin node. The approach is still a research proposal rather than a deployed Bitcoin feature, and the researchers say parts of the system, including how BTC would enter and leave the shielded environment, require further work.
How Shielded Bitcoin Hides Amounts With Encrypted Notes
The Shielded Bitcoin paper describes a system that mirrors several concepts already used by Bitcoin. Instead of UTXOs being the primary representation of funds inside the private system, users would hold encrypted “notes.” A transfer would consume existing notes and create new ones, while a zero-knowledge proof would demonstrate that the transaction follows the protocol’s rules without publicly revealing the underlying amounts or which notes were spent. The researchers have covered the architecture in more detail in their plain-language Shielded Bitcoin explainer. Bitcoin would mainly provide a public record for publishing and ordering the encrypted data. Separate Shielded Bitcoin indexers would read that information, verify the cryptographic proofs and track which notes have already been spent. Bitcoin itself would not enforce the Shielded Bitcoin rules through consensus.
Why Shielded Bitcoin Needs No Bitcoin Consensus Change
The design uses nullifiers to prevent the same private note from being spent twice. A valid proof would show that the spender owns the relevant note and that the transaction’s inputs and outputs balance, while the nullifier allows the indexer to identify whether that note has already been consumed. This means the system can maintain a spent and unspent state without publicly identifying the specific note being spent.
Shielded Bitcoin: Private Transfers on Bitcoin L1 pic.twitter.com/X7nZRzDiJ7
— Alloc Init (@allocinitxyz) September 24, 2026
The proposal was also announced through an [alloc] init post, which describes Shielded Bitcoin as a private-transfer system operating on Bitcoin L1. The design requires no soft fork, no BitVM, no separate blockchain, no federation and no trusted operator, and unlike Zcash it runs no consensus of its own. That does not mean every part of a Bitcoin transaction would become invisible. According to the project’s explanation, observers could still see that shielded activity occurred, along with information such as transaction timing, fees, the Bitcoin transaction carrying the data and other public characteristics. The private portion would instead hide the transfer amount, shielded sender and recipient, and links to previously spent notes.
Researchers just released the first protocol for fully private bitcoin transfers on the base layer
by
u/docherino in
Bitcoin
A Reddit discussion described the proposal as using encrypted notes and zero-knowledge proofs while leaving Bitcoin itself unchanged. Other commenters raised questions about transaction size, fees and the practical tradeoffs involved in running such a system.
What Bitcoin PIPEs And Fees Mean For Shielded Bitcoin
One of the main limitations is that the current paper does not complete the mechanism for moving ordinary BTC into and out of the shielded system. The researchers say a separate paper will describe the proposed peg-in and peg-out process using Bitcoin PIPEs. Until that work is specified and implemented, Shielded Bitcoin primarily describes how private transfers would operate once value is inside the system. Bitcoin PIPEs is also an important part of the wider design. The approach uses witness encryption to make access to a Bitcoin signing key conditional on satisfying specified cryptographic conditions. Misha Komarov, one of the researchers behind the proposal, discussed the technology in a September 24 Unchained interview, where he described the underlying construction as still experimental.
There are also resource and fee considerations. Komarov said a shielded transaction would require about 700 virtual bytes, compared with roughly 100 to 200 vbytes for a typical Bitcoin transaction. He estimated that this could result in fees around four times higher than a conventional transaction, depending on network conditions. The underlying cryptographic work has had significant storage requirements as well. Reporting on the PIPEs research has cited an earlier figure of roughly 330 TB, with the researchers describing a possible path toward reducing that requirement to around 100 GB.
The lower figure remains a target rather than an achieved implementation in the cited research. Zavodil’s point about starting without an accumulated shielded set, the authors’ own acknowledgement that large deposits do not guarantee an anonymity set, and the quantum-resistance questions. Zcash co-founder Eli Ben-Sasson has backed the proposal.
