SILENT PAYMENTS FOR SHARED WALLETS — BIP-352 SAYS NOT WITHOUT A SECURITY PROOF — A NEW PROPOSAL’S PROOF IS STILL UNDER REVIEW

Silent payments let you publish one reusable address and still get a fresh, unlinkable output on chain for every payment. The spec, BIP-352, carries a caveat for wallets with more than one signer. On FROST and MuSig inputs it says: "While we do not recommend it due to lack of a security proof (except if all participants are trusted or are the same entity)". So a shared wallet, the kind people set up so no single key can move the coins, is told to trust its own co-signers before it pays a silent address.

On Oct 15, 2026, a Delving Bitcoin post by the user olkurbatov proposed a way around that. Each signer computes its own share of the secret the payment needs, and the wallet combines the shares with the same weights it already uses for its key. A protocol the post calls AggDLEQ makes each signer prove its share is honest, then folds those proofs into one standard BIP-374 proof. The post says PSBT "doesn't need any additional fields" because the extra messages stay inside the wallet.

Now the checkable part versus the trusted part. The post claims the receiver "can detect the payment regardless of what the coordinator does". The proofs behind that are not public. The author writes that the paper "is under internal review" and says the hardness of the key assumption "is open". The post links no implementation of its own. Until the paper is out and other people try to break it, this is a claim, not a result.

It is still the right problem. Privacy that only works with one key pushes people back to one key. If this holds up, shared custody and private receiving stop being a trade. At the time of this writing, bitcoin was $82,320.