Researchers Pitch Zcash-Style Privacy Cloak for Bitcoin, No Soft Fork Required 🕶️

Researchers at cryptography firm [[alloc] init] have published a 56-page design for "Zcash-style" private transfers on Bitcoin that would conceal the sender, recipient and amount of a payment while running on the existing $BTC network. The paper, dated September 24, 2026, is authored by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin, and would not require a soft fork.

Value in the system, called Shielded Bitcoin, is held as encrypted "notes," and each transfer carries a zero-knowledge proof that the sender controls the notes being spent and that inputs and outputs balance. A public marker called a nullifier lets software reject double spends without revealing which note was used, while separate software called indexers verifies the proofs and rebuilds the shielded state. "ZCash-style privacy on the Bitcoin L1 via PIPEs v2," Komarov wrote on X. Shikhelman said the team had "put a lot of work into thinking carefully about the security of Shielded Bitcoin and about what information the protocol reveals." Chief operating officer Scott Odell said the firm had been "cooking on this for quite a while" and described the work as making Bitcoin "private, without changing Bitcoin."

Unlike Zcash, which enforces the rules through its own blockchain, Shielded Bitcoin publishes transfers as data on Bitcoin, which records them without checking them. The paper contrasts this approach with Shielded CSV, a 2025 Bitcoin proposal in which coin owners must keep their own transaction data, which generally cannot be recovered from the chain. Timing, fees and the number of inputs and outputs remain public. "Like Zcash and Monero, Shielded Bitcoin preserves the privacy of who paid whom and how much, not that a shielded transfer happened," the paper states.

The current design uses the Groth16 proof system, whose security depends on an honestly run trusted setup ceremony. It publishes each transfer in an OP_RETURN output, which the paper measures at 625 vbytes for a transfer with two inputs and two outputs, relying on the larger OP_RETURN default in Bitcoin Core v30, a contested update that node operators can reverse. The paper covers only transfers inside the system; how $BTC enters and leaves is left to a separate paper built on Bitcoin PIPEs v2, earlier [[alloc] init] research that encrypts a Bitcoin signing key so it can be recovered only with a valid proof.

Developer Vadim Zavodil criticized the proposal on X, arguing that a new shielded pool starts without the anonymity set Zcash has accumulated. "Privacy is a function of the crowd. Zcash has a real shielded pool built over years," he wrote. "A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one." The researchers acknowledged the limitation, noting that large deposits do not automatically create a large anonymity set and that observers may be able to narrow down relationships if a small number of actors create most notes. Pierre-Luc Dallaire-Demers, founder of post-quantum cryptography firm Pauli Group, described the construction as interesting but "not quantum resistant at all," and said he was exploring what a fully post-quantum version could look like. Zerocash co-author and StarkWare CEO Eli Ben-Sasson said the original intent behind the Zerocash paper, which preceded Zcash, was to bring privacy to Bitcoin, adding that he had not yet read the Shielded Bitcoin paper but would like to see the vision realized.