Proof Lab
StartEcosystem
Explore (579)Live Systems (52)Pricing
Log InGet API Key✓ Verify It Yourself
BITCOIN‑PRIVACY
Stage 05 · AnchoringSee how 32-byte anchors flow end-to-end →

The same 74 bytes, anchored on Bitcoin.

Solana-Privacy proved compliance to the regulator and privacy to the user on Solana devnet. Polygon-Privacy brings the same H33-74 attestation to EVM-native rails. Bitcoin-Privacy makes the proof permanent — one 32-byte commitment anchored via Taproot script-path (production) or OP_RETURN (alternative), on the deepest proof-of-work chain in existence.

Schedule Demo See Solana-Privacy (Live)
DEFINITION

Bitcoin privacy is the expression of the H33 Privacy Layer on Bitcoin. It protects the privacy of your evidence, identity, and chain interaction while anchoring a portable, independently verifiable attestation to Bitcoin. The privacy mechanism is a combination of zero-knowledge proof (ZK — STARK, no reveal), selective disclosure, and data minimization; the portable evidence itself is produced by H33-74 (the 74-byte post-quantum attestation), and the verdict is rendered by Verification. Bitcoin is the reference environment the evidence anchors to — one 32-byte commitment via Taproot script-path or OP_RETURN — never the producer of the proof.

Why this exists: Bitcoin is the deepest proof-of-work chain in existence, so a commitment anchored there is as permanent as evidence gets — but the chain itself exposes the entire UTXO set and has no privacy, no smart-contract verifier, and no post-quantum signatures. The Privacy Layer supplies privacy and portable post-quantum evidence, while Bitcoin supplies only permanence — a hash that outlives ECDSA.

BITCOIN RPC · LIVE
Bitcoin mainnet RPC connectivity is live on this page — current block (updates in real time via WebSocket, courtesy of mempool.space). Public Bitcoin anchor endpoint ships when infrastructure is provisioned. Solana-Privacy is live on devnet today.
DEPLOYMENT STATUS
Bitcoin Taproot / OP_RETURN — rollout status
BITCOIN RPC LIVE — public anchor endpoint pending
Updated
Bitcoin connectivityCONNECTING…
Latest block height
Latest block hash
Mempool fee (fast) sat/vB
WebSocket subscriptionconnecting…
Target chainBitcoin mainnet (+ signet / testnet for development)
First milestoneBackend code committed (bitcoin_anchor.rs, Phase 0 keystone 19161899f)
ETA public endpointPending infrastructure provisioning
Anchor primitiveTaproot script-path (P2TR) — production. OP_RETURN (max 80 bytes, we use 32) — supported alternative.
Receipt size74 bytes (unchanged)
On-chain footprint32 bytes (Taproot commitment or OP_RETURN payload)
Batched MerkleSubstrate Claims 124–125 amortize N anchors into one Taproot output (or OP_RETURN)
PQ signaturesML-DSA-65 + FALCON-512 + SLH-DSA-128f
EXPOSURE COMPARISON
What changes when H33 is in the path on Bitcoin

Native Bitcoin

  • × Visible UTXO set
  • × Visible wallet balances
  • × Visible treasury composition
  • × Visible custody structure
  • × Visible counterparty addresses
  • × Visible transaction history
  • × Visible reserve audits
  • × Visible institutional flows

H33 Protected

  • Encrypted reserve workflow
  • Attested execution proof
  • Hidden UTXO membership
  • Proof-only balance verification
  • 32-byte OP_RETURN commitment
  • Off-chain STARK verification
  • Post-quantum attestation
  • Permanent, replay-grade evidence
ATTESTATION RECEIPT
What a verified Bitcoin attestation looks like
Identical to Solana-Privacy and Polygon-Privacy receipt structure. Same 74-byte H33-74 bundle. The anchor target swaps to a Bitcoin OP_RETURN output — one 32-byte commitment, comfortably under the 80-byte OP_RETURN ceiling. Batched anchors use a Merkle root (Substrate Claims 124–125) so N receipts share one transaction.
h33-74 attestation receipt — bitcoin (preview)
H33-74 ATTESTATION RECEIPT Receipt ID: h74_attest_bitcoin_... DAG Root: 0x... (depth: 4, nodes: 12) Proof Hash: 0x... (STARK, 128-bit PQ security) Replay Ref: replay://h33.ai/r/... Chain Anchor: Bitcoin mainnet — block [pending] · OP_RETURN Anchor TX: [txid pending] (example only — not a real txid) Commitment: 0x... (32 bytes in OP_RETURN output) Merkle Root: 0x... (batched: 1 OP_RETURN → N receipts) Example UTXO: tb1q... (bech32 sample, not a real address) SIGNATURES: ML-DSA-65: VALID (3,309 bytes — MLWE lattice) FALCON-512: VALID (666 bytes — NTRU lattice) SLH-DSA-128f: VALID (17,088 bytes — hash-based) VERIFICATION: ALL CHECKS PASSED (20/20) HATS LEVEL: Level 1 Conformance CACHEE KEY: cachee://h33.ai/c/... Replay This Attestation → Verify Independently →
TRY IT
Try Bitcoin-Privacy
LIVE · BITCOIN RPC CONNECTIVITY

Live Bitcoin mainnet block stream — proof of Bitcoin connectivity from this page.

This widget streams Bitcoin mainnet block heights, block hashes, and recommended mempool fees in real time via WebSocket — the same Bitcoin RPC path that will publish H33-74 attestations to Bitcoin OP_RETURN once the public anchor endpoint is provisioned. The Solana-Privacy demo at h33.ai/solana-privacy/#try-it generates the full STARK + PQ-signed proof flow today on Solana devnet.

BITCOIN MAINNET · connecting…
via mempool.space
Latest block height ———
Block hash
Fast fee (1–2 blocks)
Last update
Updates received 0

When the public Bitcoin anchor endpoint ships, the try-it surface will:

  • Generate an H33-74 attestation in the browser (same 74 bytes — unchanged across chains)
  • Embed the 32-byte commitment in an OP_RETURN output on Bitcoin mainnet (or signet, for testing)
  • Optionally batch N receipts into one OP_RETURN via Merkle root (Substrate Claims 124–125) to amortize Bitcoin TX cost
  • Return a mempool.space link plus the full off-chain proof bundle (STARK + ML-DSA + FALCON + SLH-DSA)
ATTESTATION PIPELINE
Five stages. 32 bytes on-chain. One OP_RETURN.
01
User Data
Encrypted inputs from custodian, treasury, or wallet
02
STARK Proof
Constraint satisfaction without reveal
03
PQ Signatures
ML-DSA + FALCON + SLH-DSA triple sign
04
Cachee Store
Full proof bundle persisted off-chain
05
OP_RETURN
32-byte commitment in a Bitcoin OP_RETURN output
32 bytes on-chain. Full proof off-chain. Three PQ families. Zero data revealed. 74 bytes total — same primitive that ships on Solana, Polygon zkEVM, and now Bitcoin.
TECHNICAL SPECS
Bitcoin target parameters
Chain (mainnet)
Bitcoin
the deepest proof-of-work chain in existence
Chain (test)
Signet · Testnet
development & integration before mainnet anchoring
Block time
~10 minutes
target inter-block interval, retargeted every 2,016 blocks
Finality
~6 confirmations
~60 minutes for practical settlement; permanence grows with depth
Anchor primitive
OP_RETURN
single output, max 80 bytes; we use 32 (room to spare)
Anchor cost
~$1–5 / anchor
typical mainnet fees; permanence priced in
Batched anchor cost
~$1–5 / N receipts
Substrate Claims 124–125: one OP_RETURN amortizes N attestations via Merkle root
Receipt
74 bytes
identical H33-74 bundle — unchanged across all chains
On-chain footprint
32 bytes
commitment payload in OP_RETURN (or Merkle root for batched)
PQ signature stack
3 families
ML-DSA-65 + FALCON-512 + SLH-DSA-SHA2-128f-simple
Proof system
ZK-STARK
Lookup STARK + AIR STARK; no trusted setup
On-chain verifier
None — by design
Bitcoin has no smart contracts. Verifier runs off-chain against the published commitment. The chain stores permanence, not logic.
DISCLOSURE BOUNDARY
What crosses the attestation boundary

NOT REVEALED

  • × UTXO set membership
  • × Wallet balance
  • × Treasury composition
  • × Custody structure
  • × Counterparty addresses
  • × Reserve audit detail
  • × Settlement timing
  • × Mining or ETF flows

ONLY REVEALED

  • Cryptographic validity
  • Compliance proof
  • Reserve sufficiency
  • 32-byte commitment
  • Verification status
  • Replay availability
  • PQ signature bundle
  • Permanent Bitcoin anchor
MULTI-CHAIN WITNESSING
Same H33-74 receipt, anchored across:
Bitcoin (RPC live)
|
Solana (devnet)
|
Ethereum
|
Polygon zkEVM
Same 74-byte primitive across every chain. Cross-chain continuity without rewriting the attestation format.
"Solana-Privacy proved compliance to the regulator and privacy to the user. Polygon-Privacy brought it to EVM rails. Bitcoin-Privacy makes it permanent — anchored to the deepest proof-of-work chain in existence."

Tornado Cash proved privacy without compliance becomes a regulatory dead end.

Polygon-Privacy proves privacy to the user while proving compliance to the regulator — post-quantum signed, replayable offline, and portable across Bitcoin, Solana, and Polygon zkEVM.

That’s the operational primitive institutional AI and RWA systems are missing.

Introducing H33-74. 74 bytes. Any computation. Post-quantum attested. Forever.
Anchored on Bitcoin, Solana, and Polygon zkEVM.

Replay any attestation. Verify independently.

Every H33-74 receipt is reconstructible from its commitment. Inspect lineage. Inspect proof. Inspect DAG. Verify signatures. On Bitcoin, the commitment lives forever in the deepest PoW chain.

Built For
Institutions building permanence on Bitcoin.
ETF Custodians
Corporate Treasuries
Mining Operations
Regulated Exchanges
Sovereign Reserves
Compliance Teams
EXPLORE
50 Live Systems 44 ZK Use Cases Solana-Privacy (Live) Polygon-Privacy

Same 74 bytes. Permanent on Bitcoin.

Compliance to the regulator. Privacy to the user. Post-quantum attestation that outlives ECDSA — anchored to the deepest proof-of-work chain in existence.

Schedule Demo

H33.ai, Inc. · Patents Pending · HATS Standard · Privacy Layer · H33-74 · Solana-Privacy · Polygon-Privacy

DECISION GUIDANCE
When to use Bitcoin privacy — and when not to

When to use this

  • Use this when settlement permanence is your first requirement — ETF custody, sovereign reserves, corporate treasuries, long-horizon evidence.
  • Use this when you want a commitment anchored to the deepest proof-of-work chain, with off-chain post-quantum proof.
  • Use this when you must prove reserve sufficiency or compliance while revealing nothing about UTXOs, balances, or custody structure.

When NOT to use this

  • × Do not use this when you need an on-chain smart-contract verifier or fast finality — Bitcoin has neither; use Ethereum privacy, Arbitrum privacy, or Base privacy instead.
  • × Do not use this when your evidence naturally settles on an EVM chain or subnet — use Avalanche privacy or one of the EVM chains above.
  • × Do not use this when the need is encrypted computation over data that never decrypts — that is a different mechanism (FHE); use FHE instead. Anchoring the result back to Bitcoin still routes through this page.
BOUNDARY QUESTIONS
Exactly what Bitcoin privacy is — and is not
  1. 1. What privacy property is provided?
    Confidentiality of your evidence, identity, and on-chain interaction: UTXO membership, wallet balance, treasury composition, and custody structure stay hidden while a proof of validity and reserve sufficiency is published.
  2. 2. What is specific to Bitcoin?
    The reference environment: a Taproot script-path or OP_RETURN commitment (32 bytes, under the 80-byte ceiling), ~10-minute blocks, and the deepest proof-of-work permanence in existence. The chain is where the evidence anchors — it is not the producer of the evidence.
  3. 3. What remains supplied by H33-74?
    The portable evidence itself. H33-74 produces the 74-byte post-quantum attestation that travels across every chain unchanged; Bitcoin only stores its commitment.
  4. 4. Is the mechanism ZK, FHE, minimization, selective disclosure, or a combination?
    A combination: zero-knowledge STARK proof, selective disclosure, and data minimization. FHE (encrypted computation) is a distinct mechanism and is used only if encrypted compute is genuinely in the workflow — see FHE.
  5. 5. What does the chain itself NOT provide?
    Bitcoin provides no privacy, no smart contracts, no on-chain verifier, and no post-quantum signatures. It stores permanence, not logic — a 32-byte commitment and nothing more.
  6. 6. How is the evidence independently verified?
    Verification renders the verdict: because Bitcoin has no on-chain verifier by design, the verifier runs off-chain against the published commitment — re-derive it from the bundle and check the three post-quantum signature families with the open-source verifier, trusting neither H33 nor Bitcoin.
  7. 7. When should another chain or mechanism be preferred?
    Prefer Ethereum, Arbitrum, Base, or Avalanche when you need fast finality, low fees, or an on-chain verifier; and FHE when the need is computing on data that never decrypts.
FAQ
Bitcoin privacy — questions
Is Bitcoin privacy the same as encrypted computation (FHE)?

No. Bitcoin privacy is an expression of the Privacy Layer — it protects evidence, identity, and chain interaction using ZK, selective disclosure, and minimization. Encrypted computation over data that never decrypts is a separate mechanism (FHE), covered at /fhe/. The two share the word “privacy” but not the mechanism.

Does Bitcoin produce or verify the proof?

No. Bitcoin has no smart contracts and no on-chain verifier. The proof is produced by H33-74 and its verdict is rendered off-chain by Verification. Bitcoin is the reference environment the 32-byte commitment anchors to — it stores permanence, not logic.

When should I choose a different chain?

Choose Ethereum, Arbitrum, Base, or Avalanche privacy when you need fast finality, low fees, or an on-chain verifier. Bitcoin is best when permanence outweighs everything else. The same H33-74 attestation is portable across all of them.

Same Primitive · Other Chains
The same 32-byte H33-74 attestation runs across every chain H33 ships on. One primitive, four products, no per-chain verification model.
Ethereum-Privacy Bitcoin-Privacy · YOU ARE HERE Solana-Privacy Polygon-Privacy