On September 24, a cryptography research institution [[alloc] init] released the paper “Shielded Bitcoin: Private Transfers on the Bitcoin L1”.
The authors are Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin.
Shielded Bitcoin: Private Transfers on the Bitcoin L1
In this sentence, “possible” matters more than “real.” The paper describes a set of meta-protocols, not a feature that is already live, and it has no mainnet roadmap. You don’t need to change even a single line of Bitcoin’s consensus. The tradeoff is this: Bitcoin nodes neither understand nor execute these privacy rules.
What you see on-chain is an encrypted envelope. Inside the envelope are three things: an encrypted note to the recipient, a public nullifier corresponding to each note being spent, and a zero-knowledge proof. The note contains the amount and the spending details; outsiders can’t read the plaintext. The nullifier prevents the same note from being spent twice. The proof shows that the spent notes exist, that the amounts are conserved, and that the payer is authorized to spend—without revealing the sender, the recipient, or the amount on-chain.
Bitcoin does only two jobs: collect these bytes and order them by block. Shared privacy state is not part of the consensus. Indexers replay all valid envelopes over Bitcoin’s history to reconstruct the note tree and the set of nullifiers. The paper specifies that the indexer is outside the consensus boundary. If a wallet neither replays it itself nor verifies the results returned by the indexer, then it is effectively trusting that indexer locally. A dishonest indexer can hide things or delay them, but it can’t change the canonical state that a wallet reconstructs by replaying and comparing against its own Bitcoin data.
The keys to money are in the users’ hands. Only the spending key can authorize expenditures. The viewing key for recipients is read-only: sharing it lets you see incoming funds, but it doesn’t let anyone spend them. The design is non-custodial: no operator, no federation, no separate chain to keep the funds for users.
The authors are Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin.
Shielded Bitcoin: Private Transfers on the Bitcoin L1
In this sentence, “possible” matters more than “real.” The paper describes a set of meta-protocols, not a feature that is already live, and it has no mainnet roadmap. You don’t need to change even a single line of Bitcoin’s consensus. The tradeoff is this: Bitcoin nodes neither understand nor execute these privacy rules.
What you see on-chain is an encrypted envelope. Inside the envelope are three things: an encrypted note to the recipient, a public nullifier corresponding to each note being spent, and a zero-knowledge proof. The note contains the amount and the spending details; outsiders can’t read the plaintext. The nullifier prevents the same note from being spent twice. The proof shows that the spent notes exist, that the amounts are conserved, and that the payer is authorized to spend—without revealing the sender, the recipient, or the amount on-chain.
Bitcoin does only two jobs: collect these bytes and order them by block. Shared privacy state is not part of the consensus. Indexers replay all valid envelopes over Bitcoin’s history to reconstruct the note tree and the set of nullifiers. The paper specifies that the indexer is outside the consensus boundary. If a wallet neither replays it itself nor verifies the results returned by the indexer, then it is effectively trusting that indexer locally. A dishonest indexer can hide things or delay them, but it can’t change the canonical state that a wallet reconstructs by replaying and comparing against its own Bitcoin data.
The keys to money are in the users’ hands. Only the spending key can authorize expenditures. The viewing key for recipients is read-only: sharing it lets you see incoming funds, but it doesn’t let anyone spend them. The design is non-custodial: no operator, no federation, no separate chain to keep the funds for users.
