--- title: "Private payments on Bitcoin, tried on our test network · Bitsaga Insights" description: "A paper puts bitcoin payments in a sealed envelope without changing Bitcoin's rules. We built the transfer part, ran it on our test network, and list what is missing." url: "https://bitsaga.be/insights/shielded-bitcoin-on-signet" language: "en" --- > A paper puts bitcoin payments in a sealed envelope without changing Bitcoin's rules. We built the transfer part, ran it on our test network, and list what is missing. [Insights](https://bitsaga.be/insights) · Technical # Private payments on Bitcoin, tried on our test network September 25, 2026 ![The same Bitsaga Signet transaction shown twice: on the left what the chain shows, a sealed envelope, 0 sat and 669 bytes of hex; on the right what Bob's viewing key shows, an opened envelope reading 120,000 sat received](https://bitsaga.be/images/insights/shielded-bitcoin-on-signet.svg) Every bitcoin payment is a postcard. The amount and the addresses on both ends are written on the outside, and anyone who picks it up can read them. That is how the chain works, and it is why chain analysis firms exist. On 24 September 2026 three researchers published a paper called [Shielded Bitcoin](https://www.allocinit.xyz/uploads/shielded-bitcoin.pdf). It describes a way to put that postcard in a sealed envelope. The envelope still travels over Bitcoin, inside a normal transaction, and Bitcoin's rules do not change at all. Only the person it is addressed to can open it. ## What the paper says The idea is borrowed from Zcash, a separate coin built for private payments. Zcash needed its own blockchain to do it. This design does not. It writes the sealed envelopes into ordinary Bitcoin transactions and lets anyone who reads the chain rebuild the same books. Bitcoin only keeps the envelopes in order. It never opens them and never checks them. The paper covers the transfers only: how an envelope is made, sent and spent. How coins get into the envelopes and back out again is left for later. ## What we did We wanted to know whether this works outside a PDF. So we built the transfer part and ran it on the [Bitsaga Signet](https://bitsaga.be/signet), our own test network where the coins are worth nothing. Alice got 500,000 test sats, Bob got 300,000. Alice paid Bob 120,000 in a sealed envelope. Then we tried to cheat. We published the same envelope a second time and it was refused. We sent a broken envelope with the right label on it, refused too. Bob cashed 400,000 back out to a normal address. After that we went through the paper line by line, fixed what we had got wrong, threw the whole state away and ran it all again from a fresh start. Same result. You can open one of those envelopes yourself. [The demo page](https://bitsaga.be/shielded) fetches the real transaction from our test network and unlocks it in your browser with Bob's viewing key. On the chain it is 669 bytes that mean nothing. With the key it reads 120,000 sat, received. Nothing leaves your browser. ## How it works, in three pictures **A note is a sealed envelope.** Inside it says: this many sats belong to this person. Only the person it is addressed to can open it. Every envelope ever made is filed in one shared cabinet, in the order it arrived. **A nullifier is a used stamp.** When you spend an envelope you do not point at it in the cabinet. You show a stamp that only the owner of that envelope can make, and the stamp goes on a public list. Show the same stamp twice and the second spend is refused. Nobody can tell from the stamp which envelope it came from. **The proof is one small slip of paper.** It says: the envelopes I am spending are in the cabinet, they are mine, and what goes in equals what comes out. Anyone can check the slip without opening anything. All three go into one Bitcoin transaction. Because everyone reads the same chain in the same order and applies the same rules, everyone ends up with the same cabinet and the same list of used stamps. Nobody has to be trusted for that part. ## What we measured On the server that runs this site, for a transfer with two envelopes in and two out. | What | Measured | |---|---| | Making a proof | about 2 seconds on the server, 9 seconds on one core | | Checking a proof | 2.5 milliseconds | | The proof | 192 bytes | | The whole envelope | 669 bytes | Proving is the slow part, and it is seconds. Checking is what everyone else has to do, for every envelope, and it is milliseconds. ## What is missing Three things, and they are the whole difference between a test and a product. The way coins get in and out is not in the paper. It points to [another paper](https://www.allocinit.xyz/uploads/pipesv2.pdf), which is also research, and calls the door itself future work. In our test the door is one key, and we hold it. Coins go into a vault we control, and when Bob wants out, our software pays him. That is a custodian, not a bridge. The proof system needs a one-time setup, done by people who then destroy a secret. On our network that secret is public. Anyone could forge a proof and empty the vault. That is what let us run it without a ceremony, and it is why this deployment can never hold real coins. Test coins only. The paper also leaves choices open on purpose: which hash, which cipher, how to pad a transfer that has only one envelope going in, what to do with an oddly shaped transaction that carries the right label. We had to pick, and every pick is written down. A real deployment would have to pin all of them down in one shared profile, or two wallets could read the same chain and disagree. ## What it means for you If this ever runs for real, your wallet would hold your balance and your history, and the chain would show a blob of bytes with no amount and no recipient. When you paid, and roughly how big the transaction was, would still be public. It is an envelope, not invisibility. Disclosure changes shape. Today, showing an accountant your income means handing over addresses and hoping they stop reading. Here you would hand over a viewing key. It opens your envelopes and cannot spend a single sat. Your seed stays with you. Nothing in Bitcoin's rules changes. No soft fork, no vote, no new coin. Bitcoin carries the envelopes and does not care what is in them. The transfers work. We ran them, and you can open one yourself. The door in and out of the envelopes is the part nobody has built yet, and until it exists this is a good paper, not a way to pay.