Zcash-style privacy on Bitcoin, without a soft fork

A paper on the IACR ePrint archive introduces Shielded Bitcoin, a protocol for private transfers directly on Bitcoin's base layer that needs no change to Bitcoin's consensus rules. Its design borrows from Zcash and earlier shielded-note systems: value is held as encrypted notes, spending a note is marked by a public nullifier, and zero-knowledge proofs establish that each transfer is valid.

The difference from Zcash is that there is no separate chain. All protocol data is published on Bitcoin itself, transfer validity is enforced through a mechanism the authors call PIPEs v2, and the shielded state is reconstructed by replaying accepted transfers in Bitcoin order. That state, comprising the note tree, the nullifier set and a block-level history of roots, lives entirely off-chain, and the paper's claim is that any two correct implementations replaying the same Bitcoin history arrive at the same state without coordinating.

What a transfer hides is the usual shielded set: its amount, sender, receiver and place in the transfer graph. What stays public is that every encrypted state transition is valid. At the level of transfers the design is non-custodial: spending authority remains with keys held in users' wallets, and neither indexers nor the replay layer can spend user notes.

The paper is explicit about its scope. It defines the transfer model, note structure, nullifier rules, transaction binding, replay semantics and publication assumptions, but peg-in and peg-out, the steps by which bitcoin enters and leaves the shielded system, belong to the broader system and are outside this paper. That is where much of the practical trust question for any such design will sit.