Shielded Bitcoin: what the privacy proposal means for your Bitcoin addresses

Bitcoin transfers are public. Anyone who knows an address can see the amount, the timestamp and every further payment attached to that address. On September 24, 2026, three researchers published a draft meant to change that without altering the Bitcoin protocol itself. It is called Shielded Bitcoin.

For you as a holder this is a paper, not a product. There is no software you could install. The occasion is still a good reason to settle a question many investors in Germany have never asked: how much does your own wallet give away today, what does your exchange collect anyway, and what would change if a scheme like this ever ran in production? This article places the proposal in context and then names the points you can check today regardless of it. The Bitcoin price plays no part here for once.

Shielded Bitcoin: what the paper of September 24, 2026 says

It was written by Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin of the cryptography research firm [[alloc] init]. The document runs to 56 pages and carries the title “Shielded Bitcoin: Private Transfers on the Bitcoin L1”. It describes a metaprotocol. A metaprotocol is a set of rules that sits on top of an existing blockchain and uses its data, without the blockchain knowing or enforcing those rules.

The stated goal: sender, recipient, transfer amount and the link to earlier payments are all meant to stay hidden. Bitcoin’s consensus rules remain untouched. No soft fork is required, meaning no coordinated rule change that a majority of node operators would have to agree to. That is precisely what separates the proposal from earlier attempts at more privacy on Bitcoin, which have repeatedly failed to win that agreement. The authors publish their work on the lab’s research page, which holds Shielded Bitcoin alongside the preparatory work on the underlying Bitcoin vaults.

One point matters for context: a paper is not a deployment. So far there is no implementation, no users and no pool holding any actual funds.

Encrypted notes, nullifiers and zero-knowledge proofs: the three building blocks

The draft borrows its parts from Zcash, an older cryptocurrency with encryption built in. Three terms carry the whole scheme.

A note is an encrypted record that holds an amount and the entitlement to it. In this system it replaces what would otherwise be an openly readable transaction output on Bitcoin. A nullifier is a public identifier that marks a note as spent without revealing which note it is. It prevents the same amount from being spent twice, which makes it the counterpart to the double-spend lock of the Bitcoin blockchain. A zero-knowledge proof, finally, is a mathematical demonstration that a statement holds true without disclosing the data it rests on.

Every transfer carries such a proof with it. The proof establishes two things: that the sender is entitled to the notes being used, and that the sum of the inputs matches the sum of the outputs. Neither the amount nor the origin can be read out of the proof itself. As its proof system the paper names Groth16, an established and very compact scheme that does, however, require a trusted setup ceremony. The technical debate returns to that point below.

Metaprotocol instead of soft fork: why Bitcoin nodes verify none of it

The core idea is awkwardly simple. Bitcoin is used purely as a publication and ordering layer. The chain stores encrypted data without ever interpreting what it contains. Verifying the proofs falls to separate software, an indexer, which each participant either runs themselves or trusts someone else to run.

The advantage is obvious: there is nobody to convince. Whoever wants to take part installs the software, and the remaining node operators notice none of it. The price is just as clear. The security of the scheme then no longer rests on the computing power of the miners but on the correctness and adoption of that additional software. Should it fail or never catch on, all that remains on the chain is a data stream nobody can interpret any more.

That is where the approach differs from older concepts such as Shielded CSV, which keep part of the data locally with the user. Here everything sits on Bitcoin, only encrypted.

OP_RETURN, 625 vBytes and Bitcoin Core v30: what Bitcoin privacy costs in fees

Data volume is the bottleneck. An ordinary Bitcoin payment takes up roughly 100 to 200 virtual bytes depending on its construction. A shielded transfer under this draft sits well above that. Decrypt puts the figure at 625 virtual bytes for a transfer with two inputs and two outputs, while BTC-Echo speaks of around 700 virtual bytes and, following from that, roughly four times the fees. The numbers differ because they describe different constellations; the order of magnitude is reliable, the exact figure is not.

That such a data volume fits on the chain at all is down to a change from autumn 2025. With Bitcoin Core version 30, the ceiling for the OP_RETURN data field was raised from 80 bytes to 100,000 bytes, and several such fields per transaction have been permitted since. OP_RETURN is an output type that explicitly carries no monetary value and only takes data. The change was and remains contested within the Bitcoin developer community; critics such as Luke Dashjr and Nick Szabo warned of bloated data sets and higher running costs for node operators.

For you this means two things. First, privacy under this model would not come as a by-product but as a service you pay noticeably more for on every transfer. Second, the proposal depends technically on that limit staying in place. Reversing the decision would pull the ground out from under it.

What Shielded Bitcoin does not hide: timing, fee and the number of inputs and outputs

The draft is remarkably candid on this point, and that belongs in any assessment. What stays hidden is the amount, the sender, the recipient and the connection to earlier notes. What stays publicly visible is the timing of a transfer, the fee paid for it and the number of inputs and outputs.

That sounds harmless and is not. Anyone analysing payment flows has worked with exactly this kind of metadata for years. A conspicuous combination of timing and fee can tie a transfer to an event even when the amount is encrypted. The fewer participants use the system, the more telling those remnants become.

The way in and back out is also unresolved. How Bitcoin enters the shielded area and leaves it again is not settled in the paper, which points instead to separate work on so-called Bitcoin PIPEs in its second version. What is missing is therefore the very place an observer would start with: the transition between the open chain and the encrypted pot.

Anonymity set and trusted setup: the objections from the cryptography debate

Reactions from the cryptography scene were mixed, and the objections are concrete enough to name their authors.

Vadim Zavodil countered that privacy is a function of scale: Zcash has a shielded pool grown over years, whereas a new system starts from zero. The objection hits a sore spot, because encryption is of little use when only a handful of participants share the same pot. The technical term for that quantity is the anonymity set: the number of transactions a single transaction can be confused with.

Pierre-Luc Dallaire-Demers criticised the system as not quantum-resistant at all. That refers to the proof system in use, whose security rests on mathematical assumptions a sufficiently powerful quantum computer could break. On top of that comes the Groth16 setup ceremony already mentioned: whoever runs it briefly holds a secret that could later be used to produce false proofs. Such ceremonies are therefore conducted with many independent participants, but the residual risk cannot be removed entirely.

On the other side there is agreement with the direction of travel. Eli Ben-Sasson, one of the best-known names in the field of zero-knowledge schemes, voiced support while noting that he had not yet read the paper. That caveat belongs to the record: a well-disposed first reaction is not a technical review.

How public your Bitcoin addresses are today: address reuse and xpub

Here the subject turns practical, and here lies the part you can deal with today regardless of any research paper.

The biggest avoidable mistake is reusing a receiving address. Modern wallets generate a fresh address for every incoming payment automatically. Using one fixed address instead, in an email signature, on a website or in a donation appeal, links all incoming payments together and makes the entire balance at that address visible to anyone who knows it.

The second point is less well known and carries more weight. The extended public key, usually abbreviated to xpub or zpub, is a key from which all addresses of a wallet can be derived, past and future alike. It cannot move funds. Entering it into a portfolio tracker, a tax tool or a watch-only application, however, hands that provider a permanent and complete view of your holdings. So check which services you have ever given your xpub to, and whether you still use them.

Third, the selection of incoming payments, known as coin control. Good wallets let you label individual inputs and pick them deliberately. That keeps a payment from inadvertently merging funds from different sources and exposing connections that were not visible before. Which devices and programs offer the feature at all varies widely; our hardware wallet comparison lists the specifications of the common devices.

Transfer of Funds Regulation and the travel rule: what your exchange records on every withdrawal

This is where the effect of any on-chain encryption scheme ends, and explainers on the subject regularly overlook it.

The governing text is Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, known as the Transfer of Funds Regulation. It entered into force on June 29, 2023 and has applied since December 30, 2024. The obligation it sets out is colloquially called the travel rule: crypto-asset service providers must obtain information on the originator and the beneficiary of a transfer, retain it, pass it to the counterparty and make it available to the competent authorities on request.

For withdrawals to a self-custodied address, the European Banking Authority has published separate guidelines requiring providers to carry out a risk assessment of such transfers. In practice you encounter this as a question about who owns the destination address, sometimes combined with proof of control over it.

The consequence is sober: the route your bitcoin takes from a regulated exchange to your own wallet is documented, permanently, and independently of whatever happens on the blockchain afterwards. A scheme like Shielded Bitcoin could hide what you do with your holdings after the withdrawal. It cannot hide that you withdrew them.

The holding period under Section 23 EStG: why Bitcoin privacy does not replace your records

The German framework sets a second limit, and it works in the opposite direction. Under income tax law, gains from the sale of crypto-assets fall under the private disposal transactions of Section 23 of the German Income Tax Act. Hold for longer than a year and the gain is tax-free. Sell earlier and it is taxed at your personal rate, provided the exemption threshold is exceeded.

The burden of proof is what counts. The taxpayer has to document the acquisition date and the acquisition cost, not the tax office. Obscuring your payment flows towards third parties also obscures them towards yourself, unless you keep your own complete documentation. Privacy gained then turns into proof lost, and that costs real money.

In practice: keep your own record, independent of any exchange and any tool, with the date, the quantity, the euro value and the origin of every tranche. Tools take the arithmetic off your hands; the evidence remains your job. Which programs offer which import routes and report formats is set out in the comparison of crypto tax tools. A revision of the holding period is currently under political discussion; as long as nothing has appeared in the Federal Law Gazette, the wording of the provision continues to apply unchanged.

Checking Shielded Bitcoin: what to take away

The proposal is notable because it sidesteps the political hurdle that privacy extensions on Bitcoin have failed at so far. It is also research and not a tool: no software, no pool, no solved entry and exit, open questions on quantum security and on the setup ceremony. Reading an imminent change to your own position into it goes too far. Using the occasion to put your own starting position in order uses it correctly.

1. Go through your addresses and your xpub. Check whether you use a fixed receiving address anywhere, and list the services you have given your extended public key to. Delete the links you no longer use. If your wallet offers neither a fresh address per incoming payment nor a selection of inputs, a switch is worth considering; the common programs and their features are in the software wallet comparison.
2. Separate custody from the trading venue. Holdings you intend to keep for longer do not belong permanently on an exchange account. Which device suits the size of your holdings and your technical requirements is covered by the hardware wallet comparison; pay explicit attention to coin control support.
3. Secure your evidence independently. Record the date, quantity, euro value and origin of every tranche in a list of your own, one you will still have if a provider shuts its service down. Which tool imports your trading venues cleanly and produces a report the tax office can work with is shown by the comparison of tax and portfolio tools.

The next public date on the subject is announced for September 28, 2026, when Clara Shikhelman is due to present the draft at a Bitcoin conference in New York. Until then, Shielded Bitcoin remains exactly what it is: a carefully worked-out proposal whose practical viability nobody has tested yet.

(As of September 25, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)