Shielded Bitcoin payments at planetary scale By @Robin_Linus, @LiamEagen & @TheRealYingTong
Joined December 2021
- Tweets130
- Following1
- Followers5.5K
- Likes749
Aggregated lattice-based signatures offer another approach to making Shielded CSV quantum-resistant without compromising on throughput
xitter.cf/LayerZero_Core/status/…
New from LayerZero Research: Aerie.
A new system capable of aggregating 32,000 post-quantum Falcon signatures in just 0.65 seconds on a MacBook Pro.
ML-DSA, NIST’s standardized default, is already working inside Aerie at high performance.
layerzero.network/blog/intro…
Shielded CSV lets us do post-quantum Bitcoin transactions without sacrificing throughput—large proofs stay off-chain, the chain only stores a tiny nullifier.
Post-quantum transactions that require only 96 bytes on-chain:
@will_wjk (Imperial College) et al. published a very interesting variant of Shielded CSV, called Compact Shielded CSV.
I've always thought the CSV model is attractive in a PQ setting: the blockchain only stores the nullifier, so miners don't have to verify a signature before it gets into a block. Compact Shielded CSV goes a step further: the on-chain nullifier carries no signature at all, only what they call a "degriefer". Pre-quantum that's more than Shielded CSV's 64 bytes, but post-quantum it's much less.
Unlike Shielded CSV, which operates on top of Bitcoin, Compact is its own blockchain. That matters for the degriefer: a Compact miner who includes a nullifier with an invalid degriefer can't claim the block reward. Shielded CSV could adopt the degriefer, but on Bitcoin there is no such penalty. Anyone who sees your nullifier before it's confirmed can front-run it with bogus copies for ~100 bytes of fees each, and your spending proof then has to show for every one of them that it's invalid. This is something we deliberately avoided in the design of Shielded CSV. With PQ signatures as large as they are, it probably is a reasonable trade-off.
Compact also never discusses reorgs, which are a significant part of the Shielded CSV design. Integrating the degriefer into Shielded CSV would require combining it with the existing reorg handling.
arxiv.org/pdf/2609.32015
UX-first privacy ⛊
xitter.cf/cakewallet/status/2108…
Seth’s full interview with @isabelfoxenduke is officially live! 🎉
One of the big topics? Understanding that there’s a whole group of people who aren’t hardcore privacy nerds, but would love to use more privacy-focused products if they were just easier to use.
Watch the full conversation 👉 youtu.be/A7Di925wFEU
Shielded CSV ⛊ retweeted
📎 Shielded bitcoin protocols like @ShieldedCSV need to post a little data with each payment. Taproot already has a slot for that: the annex. Core just won’t relay it.
Opened a PR to make annexes standard. Policy only, consensus untouched.
Reviews welcome: github.com/bitcoin/bitcoin/p…
Shielded CSV ⛊ retweeted
The crux of shielded Bitcoin protocols like @ShieldedCSV isn’t the private transfer.
It’s the bridge. Shield in. Unshield out.
So what are the real options?
Shielded CSV ⛊ retweeted
Exciting work on post-quantum Shielded CSV from researchers at Imperial College London and Orbs!
I’d argue, Shielded CSV is the strongest candidate for scalable, quantum-safe payments on Bitcoin ⛊
arxiv.org/pdf/2609.32015
Shielded CSV ⛊ retweeted
Strong privacy demands strong security ⛊
@ShieldedCSV
Shielded CSV ⛊ retweeted
I filmed a whiteboard session...
GLASS COINS vs SHIELDED BITCOIN
∙ Key architecture and metaprotocol tradeoffs
∙ BitVM vs PIPEs (full comp of bridges)
∙ Cutting through delusion: the case for Bitcoin upgrades
Shielded CSV ⛊ retweeted
Privacy for Bitcoin.
Without compromising scale.
Going live to talk about Shielded CSV.
xitter.cf/i/broadcasts/1mGPaZeOZ…
Shielded CSV ⛊ retweeted
Privacy for Bitcoin.
Without compromising scale.
Going live to talk about Shielded CSV ⛊ xitter.cf/i/broadcasts/1mGPaZeOZ…
Shielded CSV ⛊ retweeted
There’s only one protocol for Bitcoin privacy that scales to 8 Billion people, and that’s @ShieldedCSV 🛡︎
Shielded CSV ⛊ retweeted
Bitcoin Wizards love Shielded CSV
Andrew Poelstra of @blksresearch breaks down Shielded CSV: a model in development by Blockstream Cryptography Lead @n1ckler where blockchain validation gets flipped.
Users verify coin history themselves. The chain becomes an ordering layer, not an execution engine.
Our BitVM2 implementation passed a comprehensive audit by @zellic_io! All findings addressed, system hardened.
SNARK verification on Bitcoin is ready for mainnet.
Huge thanks to all the BitVM Alliance companies:
Citrea, GOAT Network, BOB, Babylon, Bitlayer, Alpen, Fiamma.
Shielded CSV ⛊ retweeted
Excited to share our work on BitVM bridges: A novel trust-minimized protocol to bridge Bitcoins to second layers.
Huge thanks to @lukas_aumayr, @alexeiZamyatin, Andrea Pelosi, @zetavar1, and @matteo_maffei for their amazing contributions 🧡
bitvm.org/bitvm_bridge.pdf
Shielded CSV ⛊ retweeted
After months in the mempool, our Blake3 transaction has finally been mined, executing the most sophisticated Script in the chain to date. This marks a milestone in our mission of scaling Bitcoin through proof systems and BitVM.
Big thanks to @MarathonDH for covering the fees!
We just broadcasted the first mainnet transaction having a Blake3 hash lock implemented in Bitcoin Script.
One small opcode for BitVM, one giant script for Bitcoin.
blockstream.info/tx/d8a091a7…
Shielded CSV ⛊ retweeted
We may have discovered a way for BitVM to do permissionless verification, effectively overcoming its primary limitation!
Draft writeup: bitvm.org/bitvm2
Shielded CSV ⛊ retweeted
Last week, at the @SFBitcoinDevs meetup at Stanford, @danboneh introduced me to Winternitz signatures. These are more compact Lamport signatures and can cut the transaction fees for BitVM by more than 50%.
Check out the first implementation here:
github.com/BitVM/bitvm-js/bl…
