Silent payments and the privacy upgrades ahead

Wonder

1. How can a single public address receive unlimited payments without revealing that they belong to the same entity?
2. Why does adding one input from the receiver destroy the assumption of common ownership used by chain analysts?
3. What cryptographic trick allows two parties to derive a unique, unlinkable output key from a static pair of keys?

Explore

Part IPrivacy upgrades on the horizon

1. Bitcoin addresses are reusable, which creates on-chain links. If a merchant publishes one address for all customers, every payment to that address is visibly connected in the ledger. This linkability undermines privacy because it allows anyone to track the flow of funds across time. Silent Payments (BIP352) solves this by using Elliptic-Curve Diffie-Hellman. The recipient holds a static scan key and spend key pair. Each sender combines their input keys with the recipient’s scan key to derive a unique tweak, creating a one-time Taproot address that is indistinguishable from any other on-chain output.
2. Because the derived address changes for every transaction, no two payments to the same merchant appear connected in the blockchain data. The recipient scans the chain using their private keys to detect these unique outputs without needing prior interaction with the sender. This eliminates the need for a third-party server or real-time communication to generate new addresses. The process is computationally intensive for the scanner but provides strong unlinkability for both parties, ensuring that a merchant’s revenue stream cannot be easily aggregated by passive observers.
3. Payjoin (BIP78) attacks privacy from a different angle: transaction structure. Chain analysts rely on common-input-ownership heuristics to group inputs belonging to the same entity. In a standard transaction, all inputs are controlled by the sender. Payjoin allows the receiver to contribute an input to the transaction before it is signed. This mixes the receiver’s coins with the sender’s in a single transaction, breaking the assumption that all inputs belong to one party. The result looks like an ordinary payment, so an analyst who assumes all inputs belong to the sender draws the wrong conclusion.
4. Version 2 (BIP77) removes the need for the receiver to run a public server: the two sides exchange encrypted PSBTs asynchronously through a directory server, reached through Oblivious HTTP relays, so the directory cannot read the messages or tie them to IP addresses. While it does not hide the fact that a transaction is happening, it significantly complicates clustering of addresses because inputs from two different owners sit in one transaction that looks like it has one owner.
5. Network-level privacy requires hiding traffic patterns. Encrypted peer-to-peer transport (BIP324) became the default in Bitcoin Core version 27 in 2024. It hides the content of messages, which transactions and addresses a node relays, from passive observers; which IP addresses connect to which remains visible, and the encryption is unauthenticated, so it does not stop an active man-in-the-middle. BIP324 uses an elliptic-curve key exchange with keys encoded to look like random bytes, then ChaCha20-Poly1305 encryption, making it much harder to tie particular transactions to particular nodes by watching the wire.
6. Research continues on cross-input signature aggregation (CISA), which would let all the inputs of a transaction share one signature. Collaborative transactions such as coinjoins, which have many inputs, would become cheaper than spending the same coins separately, turning privacy into a fee saving. Unlike CoinJoin, which is covered in custody mechanisms, these upgrades focus on cryptographic structure and network transport rather than social coordination or server-mediated mixing.

Part IISilent payments

7. BIP-352, merged into the BIP repository in May 2024, introduces silent payments. A receiver publishes a single static code consisting of two public keys: a scan key and a spend key. Unlike standard addresses, this code remains constant for the lifetime of the wallet. The sender’s wallet uses its own private input keys to derive a fresh, unique Taproot address for each payment, ensuring no address reuse occurs across different senders or transactions.
8. The mechanism relies on Elliptic-Curve Diffie-Hellman (ECDH). When Alice sends to Bob’s silent code, her wallet combines her input private key with Bob’s scan public key. This generates a shared secret that acts as a tweak. Added to Bob’s spend public key, this tweak creates a destination output P. Because the derivation depends on her inputs’ keys and outpoints (an ‘input hash’) plus a counter for each output, every payment results in a distinct address indistinguishable from any other Taproot output.
9. The trade-off is computational asymmetry. While senders perform standard signing operations, receivers must actively scan the blockchain to detect incoming payments. Bob cannot simply check if a specific address has funds; for every transaction with eligible inputs, he combines his scan private key with the sum of its input public keys and checks whether any output matches. This scanning process is intensive and historically challenging for lightweight SPV clients.
10. The resulting transactions blend seamlessly with conventional Bitcoin transfers. There are no extra data fields, no increased transaction size, and no third-party servers required for coordination. An outside observer sees only standard Taproot inputs and outputs. The link between the sender’s input keys and the receiver’s static code is cryptographically hidden, so observers cannot tie the payment to the receiver’s published code.
11. Wallet adoption has progressed steadily since the specification’s release. Cake Wallet implemented support in 2024. Sparrow Wallet added sending capabilities in October 2025 and receiving capabilities in May 2026. Nunchuk added sending in 2026. Bitcoin Core merged the core BIP-352 logic (PR #35301) in 2026, while wallet sending and receiving were still under review and not yet in a release.
12. Silent payments solve the problem of address reuse without requiring sender-receiver interaction or coordination servers like those used in CoinJoin protocols. The receiver maintains one static identifier for all purposes—salaries, invoices, donations—while every incoming UTXO lands at a unique, unlinkable address. This enhances fungibility by preventing graph analysis from linking multiple payments to the same entity, provided the receiver’s scanning process is robust and secure.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• BIP 352: Silent Payments (Somsen, Baker et al., 2023)
• BIP 78: Payjoin v1 and BIP 77: Payjoin v2
• BIP 324: Encrypted Peer-to-Peer Transport
• Bitcoin Core 27.0 Release Notes (2024)
• Sparrow Wallet release notes (October 2025, May 2026)
• Cake Wallet documentation (2024)
• Bitcoin Core pull request #35301 (2026)