A new research paper proposes Shielded Bitcoin, a protocol for private bitcoin payments built directly on Bitcoin L1 using Zcash-style cryptography, with no soft fork, no new blockchain and no trusted operator. The catch: the mechanism for moving real BTC in and out of the system does not exist yet.
The paper was published Thursday by researchers Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin of New York cryptography lab [alloc] init. It arrives during the strongest privacy trade in crypto history, with Zcash up roughly 2,500 percent over the past year and topping $1,600 this week before pulling back.
How the design works
Shielded Bitcoin borrows the encrypted-note architecture from Zcash. Value inside the protocol lives in encrypted records called notes, each holding an amount and receiving information. Notes never appear on Bitcoin in readable form.
To pay someone, a sender publishes a transfer envelope to Bitcoin carrying recipient ciphertexts, public spend markers called nullifiers, and a zero-knowledge proof. The proof establishes that the sender owns the notes being spent, that no value was created out of nothing, and that the notes exist in the shared state, all without revealing amounts, sender or recipient. Once a nullifier is published it cannot be reused, which prevents double spending.
Bitcoin itself only stores and orders these bytes. It does not understand them and does not enforce the protocol rules. Separate software called indexers scans the chain, verifies proofs and reconstructs the shared state by replaying accepted envelopes in block order. Anyone can run the same replay independently, so no single indexer decides what counts as valid. Invalid data can still land onchain, and indexers simply ignore it.
The design keeps all state on Bitcoin rather than relying on users to hold private proof data, which means a wallet can recover its funds from its seed alone. Viewing keys let users disclose transactions to an auditor without handing over spending power. A Bitcoin node and an indexer are the only requirements to use the system, with no service provider or coordinator involved.
What stays visible
Privacy is not absolute. Transfer timing, the number of notes involved, fee payments and the carrying transaction all remain public. A wallet that repeatedly pays transaction fees from a recognizable address could still leak clues, and a small user base makes the crowd easier to analyze.
Block space is another cost. A shielded payload runs about 700 vbytes, roughly four times a typical Bitcoin payment, according to co-author Mikhail Komarov, who called the added cost not catastrophic. The design also leans on Bitcoin Core v30 looser OP_RETURN relay policy, the same change many Bitcoin users fought against last year.
The researchers ask whether bitcoin can move privately using the network exactly as it exists today. Their answer is a metaprotocol whose rules are interpreted by independent software rather than Bitcoin consensus.
The unfinished door
The 56-page specification covers transfers only after value is already inside the system. Getting bitcoin in and back out is reserved for a companion paper built on the lab PIPEs v2 research, a witness encryption scheme that would lock a Bitcoin signing key until someone produces a proof of a valid exit transaction.
The claim that users never lose custody covers transfers inside the system and explicitly excludes deposits and withdrawals. Witness encryption remains young technology. Komarov said ciphertext sizes have fallen from roughly 300 terabytes to about 8 terabytes in a year, which is real progress but still far from practical deployment. His words: it is still pretty experimental.
Critics have been quick to point at the gaps. Developer Ruben Somsen cited the trusted setup, the absence of fee anonymization and the missing peg, writing that without an in-protocol way to move actual BTC in and out, users are holding synthetics. The reference design also requires a one-time cryptographic setup whose security depends on at least one participant acting honestly, a known weakness of the Groth16 proof system the paper uses.
Entry and exit points carry their own privacy risk. Amounts and timing visible during a deposit or withdrawal could let observers link outside-Bitcoin activity with shielded transfers, a problem the authors acknowledge and defer to the companion paper.
Zcash context and the privacy trade
The paper lands in the middle of a market repricing of privacy assets. Zcash now ranks ninth among cryptocurrencies by market cap at roughly $26 billion. Grayscale Zcash ETF began trading August 25 and has drawn more than $250 million in net inflows. Paradigm co-founder Matt Huang disclosed a ZEC position on September 16, calling Zcash a private complement to Bitcoin.
The day before the Shielded Bitcoin paper appeared, Citrea, a Bitcoin layer-2 backed by Galaxy Ventures, acquired private Bitcoin wallet Crest with the stated goal of bringing Zcash-style privacy to Bitcoin. Cypherpunk, a public company that holds and mines Zcash, welcomed the research but argued it is not yet competition for the Zcash chain, citing the unfinished bridge, the trusted setup and Zcash nearly ten years in production with a shielded pool worth more than $7 billion.
There is no launch date. The lab has run public break-it challenges since May, and Shikhelman presented the research at BitDevs NYC on September 24 as part of a feedback round ahead of the companion paper. Until the entry and exit mechanism works, Shielded Bitcoin stays research rather than a usable privacy system.
The demand side, though, looks more durable than in past cycles. Whether privacy ends up on Bitcoin itself through metaprotocols like this one, or on dedicated chains like Zcash, is now an open engineering and market question rather than a settled one.