Researchers behind Alloc Init have published a paper introducing Shielded Bitcoin, a privacy-focused Bitcoin transfer scheme designed to conceal the addresses, amounts, and transaction links between sender and receiver—without requiring a soft fork or modifications to Bitcoin’s existing consensus rules.
Move privacy verification off-chain
This solution does not require Bitcoin nodes to understand privacy rules. By design, the Bitcoin chain is responsible only for publishing and ordering transaction data, while actual privacy verification is handled by off-chain programs.
Researchers refer to these programs as indexers. They read data in the order of Bitcoin transactions, verify zero-knowledge proofs, and check whether a spending output has already been used. If invalid data is detected, the Bitcoin chain may still include the transaction, but the indexer will not count it toward the state of Shielded Bitcoin.
Under this model, users hold cryptographic tokens. The sender consumes old tokens and generates new ones for the recipient. Zero-knowledge proofs are used to verify that the sender genuinely controls these assets, without creating new tokens out of thin air or disrupting the balance, while keeping the specific amounts and token details private.
Design concept similar to Zcash
Shielded Bitcoin adopts key practices from Zcash, including encrypted notes, nullifiers, and zero-knowledge proofs. Nullifiers are used to mark a note as spent without revealing which specific note it corresponds to, thereby preventing double-spending while concealing the transaction trail.
However, this does not mean all information disappears on-chain. External observers can still see when privacy transactions occur, the transaction fees, data size, and how many notes are consumed and generated in a transaction. If the wallet address publishing this data is itself identifiable, additional clues may be exposed.
Researchers also designed read-only viewing keys. Users can disclose partial income and expenditure information to parties such as accountants or counterparties without granting actual control over their assets.
The BTC deposit and withdrawal mechanism is still not complete.
This proposal is still in the research phase, and no mainnet launch date has been announced. More importantly, there is currently no complete implementation plan for how real BTC will enter and exit this privacy system.
Developer Vadim Zavodil questioned whether the newly created Bitcoin privacy pool would struggle to form a sufficiently large anonymity set during its early stages with few participants. The research team also acknowledged that the effectiveness of privacy largely depends on the number of users and their behavioral patterns; if deposit and withdrawal times, amounts, or wallet habits are too predictable, anonymity will significantly decrease.
Quantum resistance is another point of contention. Some researchers argue that this structure currently does not possess complete quantum resistance. Alloc Init, however, states that whether quantum protection can be achieved in the future will partly depend on the evolution of Bitcoin’s own signature system.
Alloc Init indicates that this paper currently describes only the privacy-preserving transfer process after assets enter the system; the deposit and withdrawal mechanisms for BTC will be detailed in a subsequent paper, related to their PIPEs research.
As previously disclosed by the team, PIPEs aim to simulate certain covenant and zero-knowledge verification capabilities without requiring a soft fork. However, the cryptographic structure currently still incurs high computational overhead. Researchers previously noted that the associated ciphertext size once reached approximately 330 TB, with theoretical potential to be compressed to around 100 GB—but this goal had not yet been achieved at the time.
In terms of transaction costs, Misha Komarov estimates that the initial fees for privacy transfers could be about four times those of a standard Bitcoin transaction. This means that even if the scheme eventually materializes, it will still face cost and usability pressures in the short term.