Alloc Init, a cryptography research shop that styles the name as [[alloc] init] on its website, published a paper Thursday that tries to put Zcash-style private transfers onto Bitcoin itself. Recipients, amounts, and the path between old coins and new ones would sit in encrypted notes rather than in the usual public UTXO graph. A key part of the pitch for Shielded Bitcoin is that none of this requires a consensus-level change to the Bitcoin network, which requires buy-in from an extremely diverse userbase and can be a daunting task for anyone trying to add something new to the crypto network.
The design has been compared to Zcash by the researchers behind the paper themselves and other observers. Alloc Init COO Scott Odell said Shielded Bitcoin “is not a mixer” and is more similar to Zcash than the Ethereum-based Tornado Cash.
Thanks for covering our proposal, @gregory_nico! Just want to clarify that Shielded Bitcoin is not a mixer and different in architecture than Tornado Cash. It’s architecture is closer to Zcash, but built for non-custodial use on Bitcoin’s base layer. It is designed to not have…
— Scott Odell (@nevernotrunout) September 25, 2026
Clara Shikhelman, the team’s head of protocol research and a former Chaincode Labs researcher, summarized some of the key features of the proposal as “No soft forks, no bridges, no operators, just Bitcoin.”
The paper specifies how notes would move once bitcoin is already inside a shielded pool. Of course, getting value in and out still depends on vaults on Bitcoin’s base layer, and those vaults are supposed to be enforced with a witness-encryption construction the authors have not finished. This issue of bridging bitcoin to separate systems has plagued Bitcoin developers for more than a decade, at least since the publication of the original sidechains paper in 2014.
More Than a Decade in the Making
Johns Hopkins researchers originally proposed Zerocoin in 2013 as a cryptographic extension of Bitcoin, then tightened the idea into Zerocash in 2014. However, Bitcoin never absorbed the privacy and anonymity enhancements of either paper.
Zcash (ZEC) launched as its own chain in 2016 and spent most of a decade as a market afterthought. But CoinGecko now has ZEC around $1,540, up more than 2,700% over the past year, after a July 2024 low near $16 and an October 2016 high around $3,200.
The Zcash pump has been criticized by many bitcoin proponents as more of a short-term trade around the idea of privacy rather than something people are actually using for its intended purpose. Boosters talk about Zcash as “private bitcoin,” or, as Tyler Winklevoss wrote, “encrypted bitcoin,” while The 7th Property author Eric Yakes and others point out the need for decentralization and immutability at the base layer of a crypto network as a necessary first step before privacy can be added on top.
TL;DR — Shielded Bitcoin not as scalable as @Glass_Coins fka ShieldedCSV, but arguably more user friendly.
Both still need a bridge. Best option is Garbled Circuits fka BitVM3.
If @allocinitxyz cracks Witness Encryption you could build a better bridge (still unsolved). https://t.co/WnF2e3FnzP
— David Seroy 🏔️ (@david_seroy) September 24, 2026
For now, the asset people still reach for when they want a private payment is often Monero (XMR). A February TRM Labs report found that 48% of darknet markets launched in 2025 accepted only Monero, and that ransomware crews still name XMR as a preferred payment even when the bills that actually get paid are usually in bitcoin. Earlier this week, the group claiming the Revolut customer-data leak, iamnotavillain, asked for about 6,000 XMR, roughly $3 million, rather than bitcoin or ZEC.
Complex Crypto Can Cause Problems
Bitcoin’s refusal of Zerocoin and Zerocash was not simply cultural stubbornness or a rejection of financial privacy. The cryptography was young, the proofs were heavy, and the constructions initially required a trusted setup. A fully shielded pool also makes it much harder to audit the money supply the way anyone can add up transparent UTXOs on Bitcoin. That last point is a key part of the hesitation with any Zcash-style design, including this one.
In June, a soundness bug in Zcash’s Orchard pool that could have allowed extra ZEC to appear with no public trace was discovered and then quickly patched via a hard fork. The Zcash Foundation said there was “no evidence of unauthorized value creation.” However, because the pool is private, outsiders cannot really check the veracity of that statement.
On top of that, earlier this month a consensus bug in Blockstream’s Liquid sidechain, which has its own way of masking transaction details, let an attacker mint unbacked L-BTC and cash out about 4,000 real bitcoin, then worth about $320 million. During the attack, vulnerable software treated fake coins as valid, and the 11-of-15 federation wallet on Bitcoin’s base chain paid out the withdrawal.
If Shielded Bitcoin ever goes live, those two failures map onto different parts of the tech stack that could cause issues: inflation you may never see and the reliability of the connecting bridge. Shielded Bitcoin involves a trusted setup for its soundness properties, meaning at least one of those involved in the initial ceremony must be honest. Otherwise, someone involved in that ceremony could create fake bitcoin within the Shielded Bitcoin layer.
Just days ago, Zano, a smaller privacy-by-default chain, said a bug in its new Gateway Addresses feature hit asset issuance, including its fUSD stablecoin. Reporting since then says Zano is preparing to roll back about 24 hours of history.
Different Paths Toward Bitcoin Privacy
Shielded Bitcoin is not the only attempt to hide payments without asking the base chain to understand the math. Glass Coins, also previously known as Shielded CSV, keeps most of the proof work off-chain and posts a small nullifier. David Seroy of Alpen Labs said both designs still need reliable onramps and offramps, and that the witness encryption Shielded Bitcoin wants for those vaults is still unsolved.
Shielded CSV co-author and BitVM inventor Robin Linus wrote that he respects the research toward covenants without a soft fork but added that the underlying cryptography “is still highly experimental, and its security assumptions are far from established.” Years of scrutiny would be needed before it belongs in a Bitcoin application, “and realistically, that confidence may never materialize.”
TL;DR — Shielded Bitcoin not as scalable as @Glass_Coins fka ShieldedCSV, but arguably more user friendly.
Both still need a bridge. Best option is Garbled Circuits fka BitVM3.
If @allocinitxyz cracks Witness Encryption you could build a better bridge (still unsolved). https://t.co/WnF2e3FnzP
— David Seroy 🏔️ (@david_seroy) September 24, 2026
Alloc Init founder Mikhail Komarov did not dispute the experimental label. Witness encryption, he wrote, is “quite novel indeed (it’s been around for about 6 years).” An updated paper is due later this year.
While the Shielded Bitcoin paper was circulating, Ethereum-compatible Bitcoin layer-two network Citrea bought Crest, a wallet project from its own ecosystem, and put it at the center of its pitch to crypto users. Crest is now the planned mobile front end for Citrea, with auto-shielding, private bitcoin transfers, and onboarding from both Bitcoin’s base layer and Ethereum.
Those projects sit next to tools that already move activity off Bitcoin’s base layer. The Lightning Network takes payments into payment channels, so the public chain only sees the open and the close. Chaumian ecash mints in the Cashu style, including the “unruggable” mint designs still being sketched, and federated setups such as Fedimint, go further by issuing private bearer tokens against bitcoin held by a mint or a small federation.
It should be remembered that Samourai Wallet co-founders Keonne Rodriguez and William Lonergan Hill received five-year and four-year sentences last year after convictions tied to privacy features in a non-custodial bitcoin wallet. Tornado Cash developer Roman Storm was also convicted last year on an unlicensed-money-transmitter count. He has not been sentenced, and the government still wants a retrial on the counts the jury could not decide.
Plenty of developers still want better privacy for bitcoin users. However, the legality around that work is still unclear, and the Senate’s recent failure to push the CLARITY Act forward means developers will have to wait longer for stronger legal protections.
Read the full article here
