forked from zk-coins/landing-page
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
700 lines (669 loc) · 40.4 KB
/
Copy pathindex.html
File metadata and controls
700 lines (669 loc) · 40.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
<title>zkCoins — Private Bitcoin via Shielded CSV</title>
<meta name="description" content="zkCoins brings true privacy to Bitcoin via Shielded CSV: amounts, sender, receiver and history stay off-chain, proven with zero-knowledge. Each transfer publishes only a ~64-byte nullifier to Bitcoin — about 16 vBytes on-chain. No soft fork, self-custodial. Built on the paper by Jonas Nick, Liam Eagen and Robin Linus (ePrint 2025/068)." />
<meta name="theme-color" content="#0a0a0a" />
<link rel="icon" href="/favicon.svg" type="image/svg+xml" />
<link rel="icon" href="/favicon.png" type="image/png" />
<meta property="og:title" content="zkCoins — Private Bitcoin via Shielded CSV" />
<meta property="og:description" content="True privacy for Bitcoin via Shielded CSV — coin data stays off-chain, with each transfer publishing only a ~64-byte nullifier to Bitcoin. No soft fork, self-custodial." />
<meta property="og:type" content="website" />
<meta property="og:url" content="https://zkcoins.com/" />
<meta property="og:image" content="https://zkcoins.com/favicon.png" />
<meta name="twitter:card" content="summary" />
<meta name="twitter:site" content="@zkcoinsbtc" />
<meta name="twitter:creator" content="@zkcoinsbtc" />
<link rel="canonical" href="https://zkcoins.com/" />
<meta name="robots" content="index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1" />
<meta name="author" content="zkCoins" />
<meta name="application-name" content="zkCoins" />
<meta property="og:site_name" content="zkCoins" />
<meta property="og:locale" content="en_US" />
<meta property="og:locale:alternate" content="de_DE" />
<meta property="og:locale:alternate" content="fr_FR" />
<meta property="og:locale:alternate" content="it_IT" />
<meta property="og:locale:alternate" content="es_ES" />
<link rel="alternate" hreflang="en" href="https://zkcoins.com/" />
<link rel="alternate" hreflang="de" href="https://zkcoins.com/de/" />
<link rel="alternate" hreflang="fr" href="https://zkcoins.com/fr/" />
<link rel="alternate" hreflang="it" href="https://zkcoins.com/it/" />
<link rel="alternate" hreflang="es" href="https://zkcoins.com/es/" />
<link rel="alternate" hreflang="x-default" href="https://zkcoins.com/" />
<link rel="sitemap" type="application/xml" href="/sitemap.xml" />
<link rel="stylesheet" href="/styles.css" />
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "Organization",
"@id": "https://zkcoins.com/#organization",
"name": "zkCoins",
"url": "https://zkcoins.com/",
"logo": "https://zkcoins.com/favicon.png",
"description": "zkCoins is a self-custodial wallet for Shielded CSV — private, client-side-validated Bitcoin transactions anchored on Bitcoin L1.",
"sameAs": [
"https://x.com/zkcoinsbtc",
"https://t.me/zkcoinsbtc",
"https://github.com/zk-coins",
"https://njump.me/npub126ap5uuyez2puq363jp8ntveyhy35p4xts2xgu8k70s727spzeash2e85m"
],
"contactPoint": [
{
"@type": "ContactPoint",
"contactType": "investor relations",
"email": "investors@zkcoins.com",
"url": "https://zkcoins.com/#investors",
"availableLanguage": [
"en",
"de",
"fr",
"it",
"es"
]
}
]
},
{
"@type": "WebSite",
"@id": "https://zkcoins.com/#website",
"url": "https://zkcoins.com/",
"name": "zkCoins",
"description": "Private Bitcoin transactions via Shielded CSV. Coin data stays off-chain — each transfer publishes only a ~64-byte nullifier to Bitcoin.",
"inLanguage": [
"en",
"de",
"fr",
"it",
"es"
],
"publisher": {
"@id": "https://zkcoins.com/#organization"
}
},
{
"@type": "SoftwareApplication",
"@id": "https://zkcoins.com/#wallet",
"name": "zkCoins Wallet",
"applicationCategory": "FinanceApplication",
"operatingSystem": "Web, iOS, Android (PWA)",
"url": "https://zkcoins.app",
"description": "Self-custodial wallet for sending and receiving private Bitcoin via the Shielded CSV protocol. Keys are generated and stored locally in the browser.",
"isAccessibleForFree": true,
"offers": {
"@type": "Offer",
"price": "0",
"priceCurrency": "USD"
},
"isBasedOn": {
"@id": "https://zkcoins.com/#paper"
},
"publisher": {
"@id": "https://zkcoins.com/#organization"
}
},
{
"@type": "ScholarlyArticle",
"@id": "https://zkcoins.com/#paper",
"name": "Shielded CSV: Private and Efficient Client-Side Validation",
"url": "https://eprint.iacr.org/2025/068",
"identifier": "IACR ePrint 2025/068",
"datePublished": "2025-01",
"author": [
{
"@type": "Person",
"name": "Jonas Nick"
},
{
"@type": "Person",
"name": "Liam Eagen"
},
{
"@type": "Person",
"name": "Robin Linus"
}
]
},
{
"@type": "FAQPage",
"@id": "https://zkcoins.com/#faq",
"inLanguage": "en",
"mainEntity": [
{
"@type": "Question",
"name": "What is zkCoins?",
"acceptedAnswer": {
"@type": "Answer",
"text": "zkCoins is a self-custodial wallet for Shielded CSV, a privacy protocol for Bitcoin. Amounts, sender, receiver and transaction history stay off-chain, proven with zero-knowledge and verified client-side. Each transfer publishes only a ~64-byte nullifier to Bitcoin."
}
},
{
"@type": "Question",
"name": "Is zkCoins a new token or altcoin?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No — zkCoins is not a separate blockchain, altcoin, or native protocol token. It is a client-side-validation layer anchored to Bitcoin L1; value lives in client-side-validated coins. Moving on-chain BTC in and out uses a bridge, which is on the roadmap."
}
},
{
"@type": "Question",
"name": "Does zkCoins require a soft fork?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No. Shielded CSV works on Bitcoin as it exists today — no soft fork, no hard fork, no new opcodes. The chain is used only for ordering commitments and preventing double-spends."
}
},
{
"@type": "Question",
"name": "How does zkCoins keep transactions private?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Each spend is proven with a zero-knowledge proof and shared off-chain. Coin data — amounts, parties and history — never touches Bitcoin; only a ~64-byte nullifier per transfer is published to the chain."
}
},
{
"@type": "Question",
"name": "Is zkCoins self-custodial?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. Keys are generated and stored locally in your browser and never leave your device. zkCoins is peer-to-peer with no coordinator or custodian that can freeze funds or shut the network down."
}
},
{
"@type": "Question",
"name": "What is Shielded CSV?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Shielded CSV (Client-Side Validation) is a privacy-preserving Bitcoin protocol from the paper by Jonas Nick, Liam Eagen and Robin Linus (ePrint 2025/068). zkCoins v1 builds directly on it: each transfer publishes a ~64-byte nullifier to Bitcoin, everything else verified client-side."
}
},
{
"@type": "Question",
"name": "Is the publisher role actually decentralized?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Publishing is permissionless, and any wallet can self-publish its own transfers to Bitcoin at trivial cost — that caps what a dominant publisher can charge. Competitive economics do favor the fastest, best-capitalised operator, so some concentration is expected. It's a liveness risk only: a publisher never holds custody and can at most censor or delay a transfer, never steal or forge coins. Full breakdown on the docs' Risks page."
}
},
{
"@type": "Question",
"name": "Where do the nullifiers live?",
"acceptedAnswer": {
"@type": "Answer",
"text": "On Bitcoin. Each transfer publishes its ~64-byte nullifier directly to the chain as a half-aggregated signature, so Bitcoin itself guarantees the availability of every nullifier a verifier needs to check for double-spends — no off-chain batch data and no separate data-availability layer to trust. The coin data — amounts, parties and history — still stays off-chain, proven with zero-knowledge, and is never needed to reconstruct the public double-spend view."
}
}
]
}
]
}
</script>
</head>
<body>
<!-- zkCoins mark — canonical 12×12 pixel monogram (Brand Guide v1.0) -->
<svg width="0" height="0" style="position:absolute" aria-hidden="true" focusable="false">
<symbol id="zk" viewBox="0 0 12 12">
<rect x="3" y="1" width="6" height="1"/>
<rect x="3" y="2" width="1" height="1"/><rect x="8" y="2" width="1" height="1"/>
<rect x="2" y="3" width="8" height="1"/>
<rect x="2" y="4" width="2" height="1"/><rect x="8" y="4" width="2" height="1"/>
<rect x="2" y="5" width="4" height="1"/><rect x="8" y="5" width="2" height="1"/>
<rect x="2" y="6" width="2" height="1"/><rect x="6" y="6" width="4" height="1"/>
<rect x="2" y="7" width="2" height="1"/><rect x="8" y="7" width="2" height="1"/>
<rect x="2" y="8" width="8" height="1"/>
<rect x="3" y="9" width="1" height="1"/><rect x="8" y="9" width="1" height="1"/>
<rect x="3" y="10" width="6" height="1"/>
</symbol>
</svg>
<a class="skip" href="#main">Skip to content</a>
<header class="nav">
<div class="nav-inner">
<a class="brand" href="/" aria-label="zkCoins home">
<svg class="mark" aria-hidden="true"><use href="#zk"/></svg>
<span class="word"><b>zk</b>Coins</span>
</a>
<nav class="nav-links" aria-label="Primary">
<a class="link" href="#paper">Whitepaper</a>
<a class="link" href="#how">How it works</a>
<a class="link" href="#roadmap">Roadmap</a>
<a class="link" href="https://docs.zkcoins.com">Docs</a>
<a class="app-btn" href="https://zkcoins.app">
Open Wallet
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg>
</a>
<details class="lang">
<summary aria-label="Language (EN)">EN</summary>
<div class="lang__menu">
<a href="/" lang="en" hreflang="en" aria-current="page">English <span>EN</span></a>
<a href="/de/" lang="de" hreflang="de">Deutsch <span>DE</span></a>
<a href="/fr/" lang="fr" hreflang="fr">Français <span>FR</span></a>
<a href="/it/" lang="it" hreflang="it">Italiano <span>IT</span></a>
<a href="/es/" lang="es" hreflang="es">Español <span>ES</span></a>
</div>
</details>
</nav>
</div>
</header>
<main id="main">
<!-- HERO -->
<section class="hero">
<span class="eyebrow">Private Bitcoin · Shielded CSV</span>
<h1>Private payments on Bitcoin<br><span class="accent">nothing legible on-chain</span></h1>
<p class="lede">zkCoins brings <b>true privacy</b> to Bitcoin. Amounts, sender, receiver and history stay off-chain — proven with zero-knowledge, while each transfer publishes only a <b>~64-byte nullifier</b> to Bitcoin.</p>
<div class="pillars">
<span class="pill">No soft fork</span>
<span class="pill">Self-custodial</span>
<span class="pill">Zero-knowledge</span>
<span class="pill">No coordinator</span>
</div>
<div class="hero-cta">
<a class="btn btn-primary" href="https://zkcoins.app">
Open the wallet
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg>
</a>
<a class="btn btn-ghost" href="#paper">Read the whitepaper</a>
</div>
</section>
<!-- STAT BAND -->
<section class="statband" aria-label="zkCoins at a glance">
<div class="stat"><span class="num">~16<span class="u">vB</span></span><span class="lab">on-chain per transfer</span></div>
<div class="stat"><span class="num">~100<span class="u">tx/s</span></span><span class="lab">throughput ceiling</span></div>
<div class="stat"><span class="num">0</span><span class="lab">soft forks</span></div>
<div class="stat"><span class="num">0</span><span class="lab">coordinators</span></div>
</section>
<!-- COMPRESSION DIAGRAM -->
<section class="compare band" aria-label="On-chain footprint comparison">
<div class="compare-grid">
<div class="txbox tx-public">
<div class="tx-title"><span class="tx-dot"></span>Regular Bitcoin transfer</div>
<div class="tx-row"><span class="lbl">from</span><span class="val">bc1q7f…3k9</span></div>
<div class="tx-row"><span class="lbl">to</span><span class="val">bc1p2m…q8x</span></div>
<div class="tx-row"><span class="lbl">amount</span><span class="val">0.4218 BTC</span></div>
<div class="tx-foot">~140 vBytes · fully public · one per payment</div>
</div>
<div class="compare-arrow">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 12h14M13 6l6 6-6 6"/></svg>
an order of magnitude smaller
</div>
<div class="txbox tx-private">
<div class="tx-title"><span class="tx-dot"></span>zkCoins transfer</div>
<div class="nullifier">one ~64-byte<br>nullifier</div>
<div class="tx-foot">~16 vBytes on-chain · coin data off-chain</div>
</div>
</div>
<p class="compare-cap">Coin data never touches the chain. <b>Each transfer publishes a ~64-byte nullifier to Bitcoin — about 16 vBytes, versus ~140 for a regular transfer — constant no matter how many coins it moves.</b></p>
</section>
<!-- PAPER (dominant) -->
<section id="paper" style="padding-bottom: 8px;">
<blockquote class="quote quote-lead">
<span lang="en">"Use the chain for what the chain is good for — an immutable ordering of commitments to prevent double-spending."</span>
<cite>— Robin Linus, co-author of Shielded CSV</cite>
</blockquote>
<article class="paper" aria-labelledby="paper-title">
<div class="eyebrow">Whitepaper · ePrint 2025/068</div>
<h2 id="paper-title">Shielded CSV: Private and Efficient Client-Side Validation</h2>
<div class="subtitle">A privacy-preserving variant of Client-Side Validation, settled directly on Bitcoin.</div>
<dl class="meta">
<dt>Authors</dt>
<dd>Jonas Nick (Blockstream) · Liam Eagen (Alpen Labs) · Robin Linus (ZeroSync)</dd>
<dt>Published</dt>
<dd>January 2025 (ePrint) · September 2024 (whitepaper)</dd>
<dt>Reference</dt>
<dd><a href="https://eprint.iacr.org/2025/068">eprint.iacr.org/2025/068</a></dd>
<dt>Predecessor</dt>
<dd>zkCoins (Robin Linus, 2023) · builds on the <a href="https://github.com/ZeroSync/ZKCoins">ZeroSync prototype</a></dd>
</dl>
<p class="abstract">
Client-Side Validation decouples transaction validation from Bitcoin consensus by moving it to the recipient. Shielded CSV improves on prior CSV designs by hiding the transaction history entirely: each transfer leaks only a 64-byte nullifier to the chain, with the rest verified client-side via succinct zero-knowledge proofs. The protocol is compatible with Bitcoin as-is — no soft fork, no hard fork — and targets roughly an order of magnitude more transactions per second than the base layer alone.
</p>
<p class="paper-note"><b>zkCoins v1 builds directly on the paper's on-chain model:</b> each transfer publishes its ~64-byte nullifier directly to Bitcoin as a half-aggregated signature, so the chain itself guarantees every nullifier a verifier needs for its double-spend checks — no off-chain batch data, no data-availability assumption. About 16 vBytes on-chain per transfer, on the order of ~100 transactions per second.</p>
<div class="actions">
<a class="btn btn-primary" href="https://eprint.iacr.org/2025/068.pdf">
Read the paper
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg>
</a>
<a class="btn btn-ghost" href="https://eprint.iacr.org/2025/068">Abstract on ePrint</a>
</div>
</article>
</section>
<!-- WHAT CHANGES -->
<section class="band">
<div class="band-head">
<span class="eyebrow">What Shielded CSV changes</span>
<h2>Private transfers, a tiny nullifier on Bitcoin</h2>
<p>Coin data stays off-chain. Each transfer publishes only a ~64-byte nullifier to Bitcoin, proven with zero-knowledge — so privacy and a small on-chain footprint win at once.</p>
</div>
<div class="concepts">
<div class="concept">
<div class="k">On-chain footprint</div>
<div class="h">A nullifier per transfer</div>
<p class="v">Coin data never touches the chain. Each transfer publishes a <b>~64-byte nullifier</b> to Bitcoin — nothing legible about amounts or parties.</p>
</div>
<div class="concept">
<div class="k">Transaction graph</div>
<div class="h">Nothing linkable</div>
<p class="v">Unlike RGB or Taproot Assets, history stays hidden under a zero-knowledge proof. Recipients verify validity <b>without ever seeing the lineage</b>.</p>
</div>
<div class="concept">
<div class="k">Compatibility</div>
<div class="h">Bitcoin, unchanged</div>
<p class="v">No soft fork, no hard fork. CSV protocols use the chain <b>only for ordering and double-spend prevention</b>.</p>
</div>
<div class="concept">
<div class="k">Cost</div>
<div class="h">A fraction of a Bitcoin transfer</div>
<p class="v">Each transfer costs about <b>16 vBytes on-chain</b> — a fraction of a ~140-vByte Bitcoin transfer, roughly an order of magnitude smaller — constant no matter how many coins it moves.</p>
</div>
</div>
</section>
<hr class="hr" />
<!-- HOW IT WORKS -->
<section id="how" class="band">
<div class="band-head">
<span class="eyebrow">How it works</span>
<h2>The chain orders, the recipient validates</h2>
<p>Traditional blockchains ask every node to validate every transaction. Shielded CSV inverts that — validation moves to the recipient, and Bitcoin does only what it is uniquely good at.</p>
</div>
<ol class="steps">
<li class="step"><span class="n">1</span><div class="body"><p class="t">Sender proves</p><p class="d">The sender creates a transfer and generates a succinct validity proof of the coin's entire history — a constant size, no matter how old the coin is.</p></div></li>
<li class="step"><span class="n">2</span><div class="body"><p class="t">Proof goes to the receiver</p><p class="d">The proof travels <b>directly to the receiver, off-chain</b>. Only sender and receiver ever see the amounts, parties and history — no amounts or parties are written to the chain.</p></div></li>
<li class="step"><span class="n">3</span><div class="body"><p class="t">The nullifier is published to Bitcoin</p><p class="d">The transfer's <b>~64-byte nullifier</b> is published to Bitcoin as a half-aggregated signature. Publishing is permissionless — any wallet can self-publish — and the chain itself holds every nullifier a verifier needs.</p></div></li>
<li class="step"><span class="n">4</span><div class="body"><p class="t">Receiver verifies client-side</p><p class="d">The receiver re-verifies the coin's full zero-knowledge proof locally — a single constant-time check, no matter how long the coin's history — and accepts it without trusting any third party.</p></div></li>
<li class="step"><span class="n">5</span><div class="body"><p class="t">Bitcoin prevents double-spends</p><p class="d">Bitcoin records each nullifier in canonical order, and the first on-chain occurrence of a coin's state key selects its one valid transition. The chain's one job: guarantee each coin is spent <b>exactly once</b> — with no off-chain data required.</p></div></li>
</ol>
</section>
<hr class="hr" />
<!-- PERFORMANCE -->
<section class="band">
<div class="band-head">
<span class="eyebrow">By the numbers</span>
<h2>Bitcoin, next to Shielded CSV</h2>
</div>
<div class="perf-wrap">
<table class="perf">
<thead>
<tr><th>Metric</th><th>Bitcoin (regular)</th><th class="zk">zkCoins v1</th></tr>
</thead>
<tbody>
<tr><td class="metric">On-chain data</td><td class="btc" data-label="Bitcoin (regular)">full transaction (~140 vBytes)</td><td class="zk" data-label="zkCoins v1"><b>~64-byte nullifier per transfer</b></td></tr>
<tr><td class="metric">Per-transfer cost</td><td class="btc" data-label="Bitcoin (regular)">~140 vBytes</td><td class="zk" data-label="zkCoins v1"><b>~16 vBytes per transfer</b></td></tr>
<tr><td class="metric">Privacy</td><td class="btc" data-label="Bitcoin (regular)">None — fully public</td><td class="zk" data-label="zkCoins v1"><b>Full — nothing legible on-chain</b></td></tr>
<tr><td class="metric">Verification</td><td class="btc" data-label="Bitcoin (regular)">Full script per tx</td><td class="zk" data-label="zkCoins v1">1× transfer proof</td></tr>
<tr><td class="metric">Proof size</td><td class="btc" data-label="Bitcoin (regular)">N/A</td><td class="zk" data-label="zkCoins v1">Constant, independent of history</td></tr>
</tbody>
</table>
</div>
</section>
<hr class="hr" />
<!-- WHAT IT IS NOT -->
<section class="band">
<div class="band-head">
<span class="eyebrow">Boundaries</span>
<h2>What Shielded CSV is not</h2>
<p>Privacy here is structural, not a bolt-on. It is worth being precise about what this protocol deliberately is not.</p>
</div>
<div class="nots">
<div class="not"><span class="x"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>Not a sidechain</span><p>It uses <b>Bitcoin L1 directly</b> — no separate consensus, no bridge to a foreign chain.</p></div>
<div class="not"><span class="x"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>Not a rollup</span><p><b>No sequencer, no data-availability layer — the nullifiers live on Bitcoin itself.</b> Validity proofs move peer-to-peer between sender and receiver; each transfer's ~64-byte nullifier anchors to Bitcoin L1.</p></div>
<div class="not"><span class="x"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>Not a mixer</span><p>Privacy is <b>structural, not obfuscation</b> — a global anonymity set of every coin, not a small per-round pool.</p></div>
<div class="not"><span class="x"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>Not a token</span><p><b>No native protocol token to bootstrap.</b> Value lives in client-side-validated coins.</p></div>
<div class="not"><span class="x"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" aria-hidden="true"><path d="M18 6 6 18M6 6l12 12"/></svg>Not a soft fork</span><p>It works on <b>Bitcoin as it exists today</b> — no consensus change, no new opcodes.</p></div>
</div>
</section>
<hr class="hr" />
<!-- ROADMAP -->
<section id="roadmap" class="roadmap band" aria-labelledby="roadmap-title">
<div class="roadmap-head">
<div class="band-head" style="margin:0;">
<span class="eyebrow">Roadmap</span>
<h2 id="roadmap-title" style="margin-bottom:0;">The path to mainnet</h2>
</div>
<div class="legend" aria-hidden="true">
<span class="is-active"><i class="dot-active"></i>Active</span>
<span><i class="dot-next"></i>Next</span>
<span><i class="dot-planned"></i>Planned</span>
<span><i class="dot-horizon"></i>Horizon</span>
</div>
</div>
<ol class="timeline">
<li class="phase active">
<div class="phase-head">
<span class="phase-num">Phase 01</span>
<h3 class="phase-title">Foundation</h3>
<span class="phase-when">Q2 2026</span>
<span class="phase-status">Active</span>
</div>
<p class="phase-lede">The proving stack and the wallet–server boundary. Everything downstream depends on this.</p>
<div class="phase-card">
<ul>
<li><span class="what">Zero-knowledge circuit migration.</span><span class="why">Move the state-transition circuit onto a recursion-native proving system with a SNARK-friendly hash.</span></li>
<li><span class="what">Server-side proving on commodity hardware.</span><span class="why">Single-host Apple Silicon target — no GPU farms, no cloud proving service. The wallet holds only the private key.</span></li>
<li><span class="what">Wallet boundary via BIP-340 Schnorr.</span><span class="why">The wallet signs a SHA-256 digest of the server-computed state. No in-browser zero-knowledge.</span></li>
<li><span class="what">End-to-end roundtrip on signet.</span><span class="why">Create account, mint, send, receive — the full user loop runs on a public Bitcoin testnet.</span></li>
</ul>
</div>
</li>
<li class="phase next">
<div class="phase-head">
<span class="phase-num">Phase 02</span>
<h3 class="phase-title">Pre-mainnet hardening</h3>
<span class="phase-when">Q3 2026</span>
<span class="phase-status">Next</span>
</div>
<p class="phase-lede">Close the protocol gaps between "works on signet" and "safe with real Bitcoin".</p>
<div class="phase-card">
<ul>
<li><span class="what">Hiding recipient commitments.</span><span class="why">Eliminate the residual link between sender, recipient and coin identifier.</span></li>
<li><span class="what">Deterministic nullifier accumulation.</span><span class="why">Rebuilt purely from Bitcoin; final at 6 confirmations, the Bitcoin-standard depth.</span></li>
<li><span class="what">Per-coin freshness proofs.</span><span class="why">Recipients verify a coin's age locally without trusting any third party.</span></li>
<li><span class="what">Paper-derived security test suite.</span><span class="why">The full set of formal properties from the Shielded CSV paper, encoded as failing-witness tests.</span></li>
</ul>
</div>
</li>
<li class="phase planned">
<div class="phase-head">
<span class="phase-num">Phase 03</span>
<h3 class="phase-title">Trustless BTC bridge</h3>
<span class="phase-when">Q4 2026</span>
<span class="phase-status">Planned</span>
</div>
<p class="phase-lede">Mint and burn against native BTC without trusting the issuer. The biggest user-facing trust gap closes here.</p>
<div class="phase-card">
<ul>
<li><span class="what">BitVM2 / Clementine-style bridge.</span><span class="why">1-of-N honesty trust model. The same construction running on Citrea mainnet.</span></li>
<li><span class="what">Recursive Bitcoin light client.</span><span class="why">A succinct proof that a deposit landed at depth ≥ 6 in the canonical chain.</span></li>
<li><span class="what">Recursion → Groth16 wrapping.</span><span class="why">Bridge our recursion-friendly proofs into a verifier that Bitcoin script can check.</span></li>
<li><span class="what">Federation scaling: N=3 → N=100.</span><span class="why">Start with a single-operator federation; grow to one hundred independent members, where one honest key deletion is enough.</span></li>
<li><span class="what">Signet integration run.</span><span class="why">Full peg-in / peg-out roundtrip including a deliberately malicious operator scenario.</span></li>
</ul>
</div>
</li>
<li class="phase planned">
<div class="phase-head">
<span class="phase-num">Phase 04</span>
<h3 class="phase-title">Lightning atomic swap</h3>
<span class="phase-when">Q1 2027</span>
<span class="phase-status">Planned</span>
</div>
<p class="phase-lede">Move value between Lightning and zkCoins atomically — no provider trust, no custodial bridge.</p>
<div class="phase-card">
<ul>
<li><span class="what">HTLC on the nullifier funding transaction.</span><span class="why">Atomicity lives on Bitcoin layer 1, not on the private coin layer. Standard primitives, no soft fork.</span></li>
<li><span class="what">Symmetric LN ↔ zkCoins flows.</span><span class="why">Buy with Lightning sats and sell back to Lightning sats, both directions trustless.</span></li>
<li><span class="what">Provider-fronted liquidity.</span><span class="why">Anyone can run a swap provider; the protocol enforces honesty, not the operator.</span></li>
<li><span class="what">Privacy-preserving swap pattern.</span><span class="why">A swap provider learns the LN side, never the zkCoins-internal graph.</span></li>
</ul>
</div>
</li>
<li class="phase horizon">
<div class="phase-head">
<span class="phase-num">Phase 05</span>
<h3 class="phase-title">Long-term positioning</h3>
<span class="phase-when">2027 +</span>
<span class="phase-status">Horizon</span>
</div>
<p class="phase-lede">Replace the bridge technologies of today with the bridge technologies of tomorrow — without changing the protocol.</p>
<div class="phase-card">
<ul>
<li><span class="what">Next-generation proving system.</span><span class="why">Port to a smaller field with a faster hash once the upstream stack stabilises. Algorithmic structure stays.</span></li>
<li><span class="what">Bridge construction upgrade.</span><span class="why">Drop-in successors to BitVM2 (Glock, Mosaic) cut on-chain dispute cost by two orders of magnitude. Circuit contract unchanged.</span></li>
<li><span class="what">Federation diversity.</span><span class="why">Recruit independent organisations as federation members until one-honest-deletion is a meaningful assumption.</span></li>
<li><span class="what">Bridge-verifier trusted setup.</span><span class="why">A 30–60 contributor ceremony replaces the single-contributor Groth16 parameter set used to test the bridge verifier — zkCoins' own proofs are transparent (FRI) and need no setup.</span></li>
</ul>
</div>
</li>
</ol>
<p class="roadmap-note"><strong>Note.</strong> Dates indicate target windows for the engineering work, not a guaranteed mainnet date. zkCoins runs in a public test environment until pre-mainnet hardening completes; no real Bitcoin is at risk before then.</p>
</section>
<hr class="hr" />
<!-- FAMILY -->
<section class="band">
<div class="band-head">
<span class="eyebrow">Ecosystem</span>
<h2>The zkCoins family</h2>
</div>
<div class="grid">
<a class="card" href="https://zkcoins.app">
<div class="label">Wallet <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg></div>
<div class="name">zkCoins Wallet</div>
<div class="domain">zkcoins.app</div>
</a>
<a class="card" href="https://docs.zkcoins.com">
<div class="label">Documentation <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg></div>
<div class="name">zkCoins Docs</div>
<div class="domain">docs.zkcoins.com</div>
</a>
<a class="card" href="https://github.com/zk-coins">
<div class="label">Source <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg></div>
<div class="name">GitHub</div>
<div class="domain">github.com/zk-coins</div>
</a>
</div>
</section>
<!-- INVESTORS -->
<section id="investors" class="band" aria-labelledby="investors-title">
<div class="investor">
<div class="band-head">
<span class="eyebrow">Investors</span>
<h2 id="investors-title">Direct channel for funds and angels</h2>
<p>zkCoins brings Shielded CSV to a self-custodial wallet — private Bitcoin on L1, no soft fork. We keep an open line for venture funds, family offices and strategic angels evaluating the project.</p>
</div>
<div class="investor-body">
<p>The protocol is built on published research (<b>ePrint 2025/068</b>), the stack is open source, and the roadmap is public. We are not actively raising — but we are open to conversations ahead of mainnet.</p>
<a class="investor-mail" href="mailto:investors@zkcoins.com">
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="2" y="4" width="20" height="16" rx="2"/><path d="m2 7 10 7 10-7"/></svg>
investors@zkcoins.com
</a>
<div class="investor-links" role="group" aria-label="Due diligence links">
<a href="https://github.com/zk-coins">GitHub</a>
<a href="#paper">Whitepaper</a>
<a href="#roadmap">Roadmap</a>
<a href="https://docs.zkcoins.com">Documentation</a>
</div>
</div>
</div>
</section>
<!-- FAQ -->
<section class="band" id="faq">
<div class="band-head">
<span class="eyebrow">FAQ</span>
<h2>Questions, answered</h2>
</div>
<div class="faq">
<details>
<summary>What is zkCoins?</summary>
<p>zkCoins is a self-custodial wallet for Shielded CSV, a privacy protocol for Bitcoin. Amounts, sender, receiver and transaction history stay off-chain, proven with zero-knowledge and verified client-side. Each transfer publishes only a ~64-byte nullifier to Bitcoin.</p>
</details>
<details>
<summary>Is zkCoins a new token or altcoin?</summary>
<p>No — zkCoins is not a separate blockchain, altcoin, or native protocol token. It is a client-side-validation layer anchored to Bitcoin L1; value lives in client-side-validated coins. Moving on-chain BTC in and out uses a bridge, which is on the roadmap.</p>
</details>
<details>
<summary>Does zkCoins require a soft fork?</summary>
<p>No. Shielded CSV works on Bitcoin as it exists today — no soft fork, no hard fork, no new opcodes. The chain is used only for ordering commitments and preventing double-spends.</p>
</details>
<details>
<summary>How does zkCoins keep transactions private?</summary>
<p>Each spend is proven with a zero-knowledge proof and shared off-chain. Coin data — amounts, parties and history — never touches Bitcoin; only a ~64-byte nullifier per transfer is published to the chain.</p>
</details>
<details>
<summary>Is zkCoins self-custodial?</summary>
<p>Yes. Keys are generated and stored locally in your browser and never leave your device. zkCoins is peer-to-peer with no coordinator or custodian that can freeze funds or shut the network down.</p>
</details>
<details>
<summary>What is Shielded CSV?</summary>
<p>Shielded CSV (Client-Side Validation) is a privacy-preserving Bitcoin protocol from the paper by Jonas Nick, Liam Eagen and Robin Linus (ePrint 2025/068). zkCoins v1 builds directly on it: each transfer publishes a ~64-byte nullifier to Bitcoin, everything else verified client-side.</p>
</details>
<details>
<summary>Is the publisher role actually decentralized?</summary>
<p>Publishing is permissionless, and any wallet can self-publish its own transfers to Bitcoin at trivial cost — that caps what a dominant publisher can charge. Competitive economics do favor the fastest, best-capitalised operator, so some concentration is expected. It's a liveness risk only: a publisher never holds custody and can at most censor or delay a transfer, never steal or forge coins. Full breakdown on the docs' <a href="https://docs.zkcoins.com/risks">Risks page</a>.</p>
</details>
<details>
<summary>Where do the nullifiers live?</summary>
<p>On Bitcoin. Each transfer publishes its ~64-byte nullifier directly to the chain as a half-aggregated signature, so Bitcoin itself guarantees the availability of every nullifier a verifier needs to check for double-spends — no off-chain batch data and no separate data-availability layer to trust. The coin data — amounts, parties and history — still stays off-chain, proven with zero-knowledge, and is never needed to reconstruct the public double-spend view.</p>
</details>
</div>
</section>
<!-- CTA -->
<section class="band" style="padding-top:8px;">
<div class="cta">
<h2>Try private Bitcoin today</h2>
<p>The zkCoins wallet runs in your browser. Keys are generated and stored locally — they never leave your device. Currently on a public test network; no real Bitcoin is at risk.</p>
<div class="actions">
<a class="btn btn-primary" href="https://zkcoins.app">
Open the wallet
<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7 17 17 7M8 7h9v9"/></svg>
</a>
<a class="btn btn-ghost" href="https://docs.zkcoins.com">Read the docs</a>
</div>
</div>
</section>
</main>
<footer class="footer">
<div class="footer-inner">
<div class="footer-brand">
<a class="brand" href="/" aria-label="zkCoins home">
<svg class="mark" aria-hidden="true"><use href="#zk"/></svg>
<span class="word"><b>zk</b>Coins</span>
</a>
<span class="tag">Private Bitcoin transactions via Shielded CSV. Settled on Bitcoin, verified client-side.</span>
</div>
<div class="footer-cols">
<div class="footer-col">
<h3>Protocol</h3>
<a href="#paper">Whitepaper</a>
<a href="#how">How it works</a>
<a href="#roadmap">Roadmap</a>
<a href="https://eprint.iacr.org/2025/068">ePrint 2025/068</a>
</div>
<div class="footer-col">
<h3>Build</h3>
<a href="https://zkcoins.app">Wallet</a>
<a href="https://docs.zkcoins.com">Documentation</a>
<a href="https://github.com/zk-coins">GitHub</a>
<a href="https://github.com/zk-coins/landing-page/tree/HEAD/brand">Brand kit</a>
</div>
<div class="footer-col">
<h3>Community</h3>
<a href="https://x.com/zkcoinsbtc">X / Twitter</a>
<a href="https://t.me/zkcoinsbtc">Telegram</a>
<a href="https://njump.me/npub126ap5uuyez2puq363jp8ntveyhy35p4xts2xgu8k70s727spzeash2e85m" title="zkcoins@zkcoins.com — NIP-05 verified">Nostr</a>
</div>
<div class="footer-col">
<h3>Investors</h3>
<a href="#investors">Investor relations</a>
<a href="mailto:investors@zkcoins.com">investors@zkcoins.com</a>
<a href="https://github.com/zk-coins">Source code</a>
</div>
</div>
</div>
<div class="footer-legal">
<span>© 2026 zkCoins · MIT-licensed</span>
<span>Not investment advice · Testnet software</span>
</div>
</footer>
</body>
</html>