Researchers Explore Zcash-Style Private Bitcoin Transfers Without Soft Fork

Alloc Init researchers have outlined a new approach they say could bring Zcash-style shielded transfers to Bitcoin without requiring a soft fork of the base protocol. The proposal, titled Shielded Bitcoin, aims to hide transaction amounts, senders, receivers, and linkages to previously spent funds by relying on encrypted “notes” and zero-knowledge proofs.

Published on Thursday by Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin, the design is intended to use Bitcoin as a kind of settlement and ordering layer—while separate software handles verification and state reconstruction for the privacy system. The result is a privacy overlay that, in theory, avoids asking miners or the wider network to enforce new rules.

Key takeaways

• Shielded Bitcoin proposes private transfers on top of Bitcoin without a soft fork by treating Bitcoin as an “ordering layer” rather than enforcing privacy rules at consensus.
• The system mirrors core Zcash components—encrypted notes, nullifiers to prevent double-spending, and zero-knowledge proofs for transaction validity.
• Privacy quality would depend on how quickly a meaningful anonymity set forms; critics argue early deposits may provide limited crowd-mixing.
• Commentators also raised open questions about cryptographic robustness and the practicality of the scheme.

How the proposal avoids a soft fork

In traditional privacy upgrades, hiding transaction details often requires changes that the network enforces. Shielded Bitcoin instead reframes the problem: rather than embedding privacy checks into Bitcoin’s mining and validation rules, the researchers propose using Bitcoin as “a neutral publication and ordering layer.”

Under this model, indexers—separate software components—would verify zero-knowledge proofs, confirm that the underlying funds have not been double-spent, and then reconstruct the evolving state of the shielded system. The encrypted notes and proofs would be published using Bitcoin transactions, but the privacy logic would be validated externally.

The paper’s key architectural point is that shielded validity does not have to be enforced by consensus for users to benefit from a private transfer—at least within the constraints of what other parties (wallets, relayers, and indexers) choose to accept and verify.

Why the Zcash-style design matters

The proposal explicitly draws from Zcash’s architecture. According to the paper, Shielded Bitcoin would use:

• Encrypted notes to conceal who owns funds and how much value is being moved.
• Public nullifiers that mark notes as spent, preventing double-spending without revealing note contents.
• Zero-knowledge proofs that demonstrate transaction validity while keeping sensitive details hidden.

However, Shielded Bitcoin differs from Zcash in one fundamental way: it is not presented as a separate shielded blockchain with its own consensus mechanism. Instead, it aims to plug a Zcash-like privacy system into Bitcoin’s existing infrastructure, using encrypted transaction artifacts and proof verification performed by external components.

For Bitcoin users and developers, the practical implication is clear: a privacy layer that can be deployed without consensus changes could lower the friction associated with privacy tooling. It also shifts the engineering burden toward wallets and verification infrastructure rather than requiring network-wide upgrades.

Early privacy may be weaker than Zcash’s anonymity set

Developer Vadim Zavodil was among the most pointed critics. Posting on X, Zavodil argued that a large share of the privacy “stack” already exists in Zcash and questioned how much privacy a newly launched shielded system could deliver immediately.

“Privacy is a function of the crowd. Zcash has a real shielded pool built over years of use. A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one.”

In response, the Shielded Bitcoin researchers acknowledged the same concern. In a companion explanation published alongside the proposal on Notion, they said that large deposits do not automatically translate into a large anonymity set. They also warned that observers might still be able to infer relationships between transfers if a small number of actors create most notes or if wallets produce distinctive behavior.

This tension highlights a common theme for privacy systems: cryptographic soundness does not automatically guarantee anonymity. Shielded designs often depend on how users actually use them—how many participants join, how uniformly transactions behave, and whether patterns can be linked over time.

Questions extend beyond privacy: post-quantum concerns and intent

Another line of critique came from Pierre-Luc Dallaire-Demers, founder of post-quantum cryptography firm Pauli Group. He said the construction was “not quantum resistant at all,” framing the proposal as interesting while still leaving cryptographic assumptions in question.

Dallaire-Demers later indicated he was exploring what a fully post-quantum version could look like, contingent on Bitcoin eventually adopting a post-quantum signature scheme.

Supporters, meanwhile, emphasized the broader goal of bringing privacy to Bitcoin. Eli Ben-Sasson, a Zerocash co-author and CEO of StarkWare, responded more positively to the announcement. Although he said he had not yet read the full paper, Ben-Sasson argued that the intent behind Zerocash—preceding Zcash—was to bring privacy to Bitcoin. He said he would like to see the vision of privacy and scalability through zero-knowledge proofs materialize on Bitcoin’s base layer.

Taken together, these reactions underscore that Shielded Bitcoin is not being debated only on whether it “works” on paper. It’s also being evaluated on longer-term assumptions—particularly around anonymity set formation and the resilience of the cryptography to future threats.

As the proposal circulates among developers, investors and builders will likely watch for two practical follow-ups: whether any wallet or indexer implementation demonstrates credible usability and whether the system’s privacy properties improve as more independent users participate and diversify their behavior.