Shielded transfers on Bitsaga Signet
The paper "Shielded Bitcoin" proposes private transfers on Bitcoin without changing its rules: coins move in sealed envelopes inside ordinary transactions, readable only with a key. We built the transfer layer and switched it on at block 151,455 of Bitsaga Signet, our test network.
Proof of concept on a test network: coins worth nothing, proofs forgeable, and the last section lists what is not real yet.
Two real transactions
Both come live from Bitsaga Signet, where every block carries a signature you can check with one file you can read. Left, an ordinary payment. Right, a shielded transfer.
Left: who paid whom, and how much. Right: only that 669 bytes of envelope went out, plus change. Without a key, that is all anyone sees.
The envelope is an OP_RETURN output, a size Bitcoin Core 30.0 relays by default.
Now hold a key
The 669 bytes are not hidden; your browser has them. They are encrypted, once to the receiver and once to the sender, the note model the paper credits to the Zcash protocol specification. Pick a key; shielded-verify.js, which decrypts, tries it in your browser.
Alice paid Bob. Bob's viewing key reads what he received. Alice's reads what she sent and her change. A stranger's opens nothing.
Pick a key.
About these keys. A viewing key only reads and these are test coins, so Alice's and Bob's are public. Spending keys are not.
What the network checked
Hidden is only useful if the network can still reject a forgery. A proof inside the envelope does that. Our indexer checked three things.
Alice spent notes she owns and created exactly the value she consumed. Checking took 2.5 milliseconds, proving 1.97 seconds.
Two blocks later the same bytes went on chain again, in 776ccb9b...03dee272. Bitcoin accepted them as data. The indexer refused: a spent note leaves a one-time tag, a nullifier, and both were already used.
Bob sent 400,000 shielded sat to the operator with a cash-out request, in 08d4707d...c3cc9a0f. The operator paid 399,632 sat, 400,000 minus the fee, in 85a6d93d...3679df25: the ordinary payment above.
The proof is checked in our indexer, not in your browser: it needs pairing arithmetic this page does not ship. Everything built and measured is in the long write-up.
Where this could go
Your wallet would look as it does now, balance and history, read by your viewing key on your phone. The chain would show a sealed envelope and a proof, not your address and amount. An accountant or tax office gets a viewing key, not your seed; the authors' companion post gives the wider picture.
What is not real yet
Public setup. The proof secret is a fixed public seed, so anyone can forge a proof here. Real use needs a ceremony that destroys it.
One-key peg. Coins enter by paying a vault and leave through an operator wallet we hold.
PIPEs on paper. The real bridge, PIPEs, exists only in the PIPEs v2 paper; nobody has built it.
Proof time. Two seconds on sixteen threads, nine on one. Not yet phone speed.