Alloc Init's 56-page private Bitcoin spec leaves deposits and withdrawals for a second paper

The paper is precise about how little it hides. "Like Zcash and Monero, Shielded Bitcoin preserves the privacy of who paid whom and how much, not that a shielded transfer happened," it states ^[4]. Timing, fees and the number of inputs and outputs stay public ^[5]. At the boundary the promise is smaller again. According to Bankless, the authors explicitly do not claim that entering or leaving the system will be private or free from transaction linkage ^[3]. A coin's path has a public first step, a private middle and a public last step, and the 56 pages cover the middle ^[9].

The bitcoin itself sits outside the published half. Deposit 1 BTC and it leaves your spendable balance while a note worth 1 BTC appears inside the system, in Bankless's description ^[18]. That note is a claim on coins held under a peg that has not been specified. The peg paper will build on PIPEs v2, earlier Alloc Init research in which a valid proof recovers an encrypted Bitcoin signing key, according to the firm's website ^[2]. If that key controls the deposited coins, the pool is only as sound as the proof system behind it ^[13]. Pierre-Luc Dallaire-Demers, founder of Pauli Group, called the construction interesting but "not quantum resistant at all" ^[16].

The compliance appendix already puts the regulatory check at the deposit, the point where a public coin becomes a note ^[14]. Zcash, whose design this one borrows, now sits inside regulated wrappers: Grayscale's Zcash ETF began trading on NYSE Arca on August 25, and 21Shares listed Europe's first Zcash product on Euronext Paris and Amsterdam on September 22 ^[15]. None of the three reports includes a response from a regulator or an exchange to Shielded Bitcoin.

The peg paper can go a few ways. It could claim entry and exit that cannot be linked, and the boundary would then stop being a checkpoint. It could deliver withdrawals that work but leave deposits traceable, with certified deposits as the lane regulated venues use. Or the design could work while the pool stays thin. "A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one," developer Vadim Zavodil wrote ^[6]. The authors concede that large deposits do not automatically create a large anonymity set, and that observers may narrow links between transfers if a few actors create most notes ^[7].

I think the second outcome is the likeliest, because the authors wrote the compliance lane before the exit. An unlinkable exit in the next paper would prove that wrong. Building a metaprotocol spares Alloc Init a soft-fork campaign, and chief operating officer Scott Odell described the aim as making Bitcoin "private, without changing Bitcoin" ^[19]. The counter-case is that the transfer layer is what the Zerocash authors wanted on Bitcoin from the start. StarkWare chief executive Eli Ben-Sasson, a Zerocash co-author, said that paper's original intent was to bring privacy to Bitcoin, though he said he had not yet read this one ^[17]. Zavodil's other complaint, that Zcash had already implemented much of the privacy stack, points to the peg as the new work ^[8].