--- title: "A payment happened here. Can you see it? ยท Shielded transfers on Bitsaga Signet" description: "A shielded Bitcoin transfer on the Bitsaga Signet: two real transactions side by side, one ordinary and one sealed. Hold a viewing key in your browser and read the sealed one. Proof of concept on a test network, nothing here is worth anything." url: "https://bitsaga.be/shielded" language: "en" --- > A shielded Bitcoin transfer on the Bitsaga Signet: two real transactions side by side, one ordinary and one sealed. Hold a viewing key in your browser and read the sealed one. Proof of concept on a test network, nothing here is worth anything. Shielded transfers on Bitsaga Signet # A payment happened here. Can you see it? [The paper](https://www.allocinit.xyz/uploads/shielded-bitcoin.pdf) "Shielded Bitcoin" proposes private transfers on Bitcoin without changing its rules: coins move in sealed envelopes inside ordinary transactions, readable only with a key. We built the transfer layer and switched it on at block 151,455 of [Bitsaga Signet](https://bitsaga.be/signet), our test network. Proof of concept on a test network: coins worth nothing, proofs forgeable, and the last section lists what is not real yet. Checking the network Block ... Last block ... Shielded since block 151,455 Two real transactions ## One you can read. One you cannot. Both come live from Bitsaga Signet, where every block carries a signature you can check with [one file you can read](https://bitsaga.be/signet-verify.js). Left, an ordinary payment. Right, a shielded transfer. ### An ordinary payment Transaction [85a6d93d...3679df25](https://signet.bitsaga.be/api/tx-proof?txid=85a6d93d6f4d07fabfa901936a5fb58711e013e07067d6ad23aea1eb3679df25) Fetching from the network. #### Inputs #### Outputs ### A shielded transfer Transaction [1ffa8dd5...5f0a4c73](https://signet.bitsaga.be/api/tx-proof?txid=1ffa8dd59d1ccdaf43ca15e6f8bf04e151e1e77c30e9be0efc654f355f0a4c73) Fetching from the network. #### Inputs #### Outputs Left: who paid whom, and how much. Right: only that 669 bytes of envelope went out, plus change. Without a key, that is all anyone sees. The envelope is an OP_RETURN output, a size [Bitcoin Core 30.0](https://bitcoincore.org/en/releases/30.0/) relays by default. Now hold a key ## The envelope opens for exactly two people. The 669 bytes are not hidden; your browser has them. They are encrypted, once to the receiver and once to the sender, the note model the paper credits to the [Zcash protocol specification](https://zips.z.cash/protocol/protocol.pdf). Pick a key; [shielded-verify.js](https://bitsaga.be/shielded-verify.js), which decrypts, tries it in your browser. Alice paid Bob. Bob's viewing key reads what he received. Alice's reads what she sent and her change. A stranger's opens nothing. ### Try to read the envelope Read it as Bob Read it as Alice Read it as a stranger Pick a key. Try this key **About these keys.** A viewing key only reads and these are test coins, so Alice's and Bob's are public. Spending keys are not. What the network checked ## Hidden is not the same as unchecked. Hidden is only useful if the network can still reject a forgery. A proof inside the envelope does that. Our indexer checked three things. โœ“ **A 192-byte proof said the transfer was honest, without saying what it was.** Alice spent notes she owns and created exactly the value she consumed. Checking took 2.5 milliseconds, proving 1.97 seconds. โœ• **The same envelope, published again, was rejected.** Two blocks later the same bytes went on chain again, in [776ccb9b...03dee272](https://signet.bitsaga.be/api/tx-proof?txid=776ccb9b4bce353a60d70feda6ece200aa8e54f95baaf8b54fe9cb5603dee272). Bitcoin accepted them as data. The indexer refused: a spent note leaves a one-time tag, a nullifier, and both were already used. โœ“ **Bob cashed out to a normal address.** Bob sent 400,000 shielded sat to the operator with a cash-out request, in [08d4707d...c3cc9a0f](https://signet.bitsaga.be/api/tx-proof?txid=08d4707d2db63f410a17b03dbb00538e8ca7581728771a20c14f0897c3cc9a0f). The operator paid 399,632 sat, 400,000 minus the fee, in [85a6d93d...3679df25](https://signet.bitsaga.be/api/tx-proof?txid=85a6d93d6f4d07fabfa901936a5fb58711e013e07067d6ad23aea1eb3679df25): the ordinary payment above. **The proof is checked in our indexer, not in your browser:** it needs pairing arithmetic this page does not ship. Everything built and measured is in the [long write-up](https://bitsaga.be/insights/shielded-bitcoin-on-signet). Where this could go ## What it would feel like for you. Your wallet would look as it does now, balance and history, read by your viewing key on your phone. The chain would show a sealed envelope and a proof, not your address and amount. An accountant or tax office gets a viewing key, not your seed; the authors' [companion post](https://allocinit.notion.site/Shielded-Bitcoin-Private-Transfers-on-Bitcoin-L1-3e436974087f80f586acf2462bc547a5) gives the wider picture. What is not real yet ## Read this before you get excited. **Public setup.** The proof secret is a fixed public seed, so anyone can forge a proof here. Real use needs a ceremony that destroys it. **One-key peg.** Coins enter by paying a vault and leave through an operator wallet we hold. **PIPEs on paper.** The real bridge, PIPEs, exists only in the [PIPEs v2 paper](https://www.allocinit.xyz/uploads/pipesv2.pdf); nobody has built it. **Proof time.** Two seconds on sixteen threads, nine on one. Not yet phone speed.