ABSTRACT
Bitcoin is the first widely adopted distributed e-cash system and  Zerocoin  is  a  recent  proposal  to  extend  Bitcoin  with
anonymous transactions.
The original Zerocoin protocol relies heavily on the Strong RSA assumption and double-discrete logarithm proofs, long-
standing  techniques  with  known  performance  restrictions. We show a variant of the Zerocoin protocol using instead el-
liptic curves and bilinear pairings.  The proof system makes use of modern techniques based on quadratic arithmetic pro-
grams  resulting  in  smaller  proofs  and  quicker  verification. We  remark  on  several  extensions  to  Zerocoin  that  are  en-
abled by the general-purpose nature of these techniques.