Privacy, But Make It Bitcoin: Researchers Drop a 56-Page Zcash Glow-Up 📜

Researchers at [[alloc] init] have published a 56-page design for "Zcash-style" private transfers that would hide the sender, recipient and amount of a payment while running on the existing Bitcoin network. The paper, dated September 24, 2026, is written by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin, and outlines a system called Shielded Bitcoin. Shikhelman said on X that the team "put a lot of work into thinking carefully about the security of Shielded Bitcoin and about what information the protocol reveals," while Komarov described it as "Zcash-style privacy on the Bitcoin L1 via PIPEs v2." [[alloc] init] chief operating officer Scott Odell wrote that the firm had been "cooking on this for quite a while," and framed the work as a contribution to making Bitcoin "private, without changing Bitcoin."

Value in Shielded Bitcoin is held as encrypted "notes," and each transfer carries a zero-knowledge proof that the sender controls the notes being spent and that inputs and outputs balance. A public marker called a nullifier lets software reject double spends without revealing which note was used. Zcash enforces those rules through its own blockchain; Shielded Bitcoin instead publishes transfers as data on $BTC, which records them without checking them, while separate software called indexers verifies the proofs and rebuilds the shielded state. The paper contrasts this with Shielded CSV, a 2025 Bitcoin proposal in which coin owners must keep their own transaction data, which generally cannot be recovered from the chain.

Timing, fees and the number of inputs and outputs remain public, the authors write. "Like Zcash and Monero, Shielded Bitcoin preserves the privacy of who paid whom and how much, not that a shielded transfer happened," the paper states. The paper covers only transfers inside the system; how $BTC enters and leaves is left to a separate paper built on Bitcoin PIPEs v2, earlier [[alloc] init] research that encrypts a Bitcoin signing key so it can be recovered only with a valid proof, according to the firm's website.

The current version uses the Groth16 proof system, whose security depends on an honestly run trusted setup ceremony. Each transfer is published in an OP_RETURN output, which comes to 625 vbytes for a transfer with two inputs and two outputs, according to the paper. That relies on the larger OP_RETURN default in Bitcoin Core v30, a contested change that node operators can reverse, so relay depends on enough nodes and miners keeping it, the paper notes. Bitcoin is heading into a pivotal month as its Core v30 update prepares to roll out in October, an event that has reopened a long-running dispute over how the network should operate and respond to new pressures.