Every bitcoin payment is a postcard. The amount and both addresses are written on the outside, and anyone who picks it up can read them. That is why chain analysis firms exist.
On 24 September 2026 three researchers published a paper called Shielded Bitcoin. It puts the postcard in a sealed envelope. The envelope travels inside a normal Bitcoin transaction, Bitcoin's rules do not change, and only the person it is addressed to can open it. We built the transfer part and ran it on mainnet with test amounts. This page carries the bytes, and a way to open them.
Two real mainnet transactions
Both cards are drawn from the raw transaction bytes; the links go to the same bytes on mempool.space.
Coins going in
Transaction 3529901c...24e8d49e. See it on mempool.space
Reading the bytes.
Inputs
Outputs
A shielded transfer
Transaction 5c3a5857...4bdec3751. See it on mempool.space
Reading the bytes.
Inputs
Outputs
Left: who paid the vault, and how much. Right: 669 bytes went out, plus change. Without a key, that is all anyone sees.
Open it yourself
The 669 bytes are not hidden, they are encrypted, once to the receiver and once to the sender. Bob's viewing key reads what he received, Alice's reads what she sent and her change, and any other key opens nothing, with no error and no partial result.
Pick a key.
About these keys. Viewing keys only read and these are test amounts, so Alice's and Bob's are public. Spending keys are not. Decryption runs in your browser with shielded-verify.js, and nothing leaves it.
What the network checked
Bitcoin checked only the signature on the input that paid the fee. Our indexer, reading the chain with the paper's rules, checked the rest.
- A 192-byte proof inside the envelope says Alice spent notes she owns and created exactly the value she consumed, without saying which notes or what value. Checking it takes 2.5 milliseconds.
- Bob redeemed 12,000 sat to a normal address in 515a51d7, a 699-byte envelope.
- The operator paid 11,448 sat to
bc1qdl42e27rn7qp3rttyy8cfq604e5a4v4jjnzrwtin 2e21f3f9.
The proof is checked in the indexer, not in your browser: it needs pairing arithmetic this page does not ship. Before mainnet the whole sequence ran on our signet, including a double spend the indexer refused; the log is in RUNS.md.
Did any sats move?
Yes, the way they move on Lightning. The sats sit locked on chain, in the vault, and ownership moves without a coin changing hands. Alice's 15,000 and Bob's 10,000 went into the vault in public. Then 5,000 of them became Bob's, inside an envelope, with no output on the chain saying so. When Bob wanted his sats back on the ledger, the vault paid him 11,448: his own 10,000 plus the 5,000 from Alice, minus fees. Nothing on chain ties that payout to Alice's deposit.
The difference from Lightning is the way out. A Lightning channel can be closed by either side with a script; here the vault holder pays you out, and the paper's trustless version of that is still on paper. The other honest limit is the crowd: with two depositors the link is obvious. Privacy is the size of the pool, and ours was two people.
What it cost
| Step | Fee | Envelope | Where |
|---|---|---|---|
| Mint 15,000 sat to Alice | 702 sat | 81 bytes | 3529901c, block 968,530 |
| Alice pays Bob 5,000 sat, shielded | 2,382 sat, 793 vB | 669 bytes | 5c3a5857, block 968,533 |
| Bob redeems 12,000 sat | 2,676 sat, 892 vB | 699 bytes | 515a51d7, block 968,537 |
| The operator pays out 11,448 sat | 552 sat | none | 2e21f3f9 |
The envelope is the cost. A plain payment is about 140 vB; this one was 793 vB, most of it the OP_RETURN, a size Bitcoin Core 30.0 relays by default. Making the proof took 1.89 seconds on the server that runs this site.
What is missing
Public setup. The proof system needs a one-time setup that ends with a secret being destroyed. Here that secret is public, so anyone could forge a proof and empty the vault.
One-key peg. Coins enter by paying a vault we control, bc1qmha0yw969cy0kaqpcyr7eht8s9ryh9rgt5edrq, and leave through an operator wallet we hold. That is a custodian, not a bridge.
The bridge is paper only. The paper covers transfers; getting coins in and out points to PIPEs v2, also research. Nobody has built it.
Proof time. Two seconds per proof on a sixteen-thread server, nine on one thread. Not phone speed.
So, plainly: proof of concept, insecure by design, not usable today. The code, the profile and every transaction id are at github.com/bitsagarob/shielded-btc-probe, so anyone can replay the chain and check our books.
What it would mean
If this ran for real, your wallet would hold your balance and history, and the chain would show a blob of bytes with no amount and no recipient. When you paid, and roughly how big the transaction was, stays public. It is an envelope, not invisibility.
Disclosure changes shape. Showing an accountant your income would mean handing over a viewing key, not your addresses. It opens your envelopes and cannot spend a single sat.
Nothing in Bitcoin's rules changes. No soft fork, no vote, no new coin. The transfer works on mainnet today; the bridge in and out is the open question.