Researchers Propose Zcash-Style Private Bitcoin Transfers Without Soft Fork

Alloc Init Unveils Shielded Bitcoin: Privacy Metaprotocol Without Soft Fork

Cryptography research firm Alloc Init has published a proposal for Shielded Bitcoin, a metaprotocol designed to bring Zcash-style shielded transactions to the Bitcoin network without requiring a soft fork or consensus changes to the base protocol. The paper, released Thursday by researchers Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin, outlines a system that would conceal transaction amounts, senders, receivers, and links to previously spent funds using encrypted notes and zero-knowledge proofs.

Architecture: Bitcoin as Publication Layer, Indexers as Verifiers

Unlike Zcash, which operates its own blockchain and consensus mechanism, Shielded Bitcoin would not launch a separate chain. Instead, the design explicitly uses Bitcoin as “a neutral publication and ordering layer,” the researchers wrote. Transaction data—encrypted notes, public nullifiers marking notes as spent, and zero-knowledge proofs attesting to validity—would be posted to Bitcoin blocks. Separate software components called indexers would then verify the zero-knowledge proofs, check that funds have not been double-spent, and reconstruct the state of the shielded system off-chain.

This approach mirrors Zcash’s core cryptographic primitives—encrypted notes, nullifiers, and ZK-proofs—while offloading consensus and finality to Bitcoin’s existing proof-of-work chain. The researchers argue this offers a potential path to stronger privacy for Bitcoin users without the political and technical hurdles of a base-layer protocol upgrade.

Developer Reactions: Anonymity Set Concerns and Quantum Resistance

The proposal drew immediate and varied reactions from prominent cryptographers and developers. Vadim Zavodil, a developer, criticized the design on X, arguing that much of its privacy stack had already been implemented by Zcash and questioning the practical anonymity a newly launched system could provide.

“Privacy is a function of the crowd. Zcash has a real shielded pool built over years,”

“A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one.”

In a companion post, the Shielded Bitcoin researchers acknowledged a similar limitation, stating that large deposits do not automatically create a large anonymity set. They noted observers may still narrow down relationships between transfers if a small number of actors create most notes or if wallets exhibit distinctive behavior.

Pierre-Luc Dallaire-Demers, founder of post-quantum cryptography firm Pauli Group, raised a separate concern, describing the construction as interesting but “not quantum resistant at all.” Dallaire-Demers later indicated he was exploring what a fully post-quantum version could look like, assuming Bitcoin eventually adopts a post-quantum signature scheme.

Support from Zerocash Co-Author Eli Ben-Sasson

Not all feedback was critical. Eli Ben-Sasson, co-author of the original Zerocash paper and CEO of StarkWare, offered a supportive perspective. In response to Alloc Init’s announcement, Ben-Sasson said the original intent behind the Zerocash paper—which preceded Zcash—was to bring privacy to Bitcoin. He added that he had not yet read the Shielded Bitcoin paper but would like to see the vision of privacy and scalability through zero-knowledge proofs materialize on Bitcoin’s base layer.

Why This Matters

Shielded Bitcoin represents a novel attempt to solve Bitcoin’s long-standing privacy limitations without the contentious governance process of a soft fork. By treating Bitcoin as a data-availability and ordering layer—similar to how rollups use Ethereum—the proposal sidesteps the need for miner or node operator consensus on privacy rules. However, the design inherits the bootstrapping challenge common to all new shielded pools: without a large, diverse set of participants, the anonymity set remains small, potentially undermining the very privacy it promises. The quantum-resistance critique also underscores a growing focus in the cryptography community on post-quantum readiness, especially for systems intended to operate for decades. If Bitcoin eventually activates a post-quantum signature scheme, metaprotocols like Shielded Bitcoin would need to migrate their cryptographic primitives accordingly. For now, the proposal adds a concrete, research-grade option to the expanding landscape of Bitcoin privacy tools, joining efforts such as Silent Payments, PayJoins, and second-layer solutions like Lightning Network with Taproot Assets.

Frequently Asked Questions

Does Shielded Bitcoin require a Bitcoin soft fork?

No. The proposal explicitly avoids base-layer consensus changes. It uses Bitcoin only as a publication and ordering layer, with off-chain indexers handling verification of zero-knowledge proofs and double-spend prevention.

How does Shielded Bitcoin differ from Zcash?

While it adopts Zcash’s cryptographic architecture—encrypted notes, nullifiers, and ZK-proofs—Shielded Bitcoin does not operate its own blockchain or consensus mechanism. It relies entirely on Bitcoin for finality and data availability.

What are the main criticisms of the proposal?

Critics highlight two primary concerns: (1) a newly launched shielded pool starts with an anonymity set of near zero, limiting early privacy, and (2) the current construction is not quantum-resistant, posing long-term risk if large-scale quantum computers become viable.