Search for "Bitcoin layer 2" or "BTCFi" and most of what comes back is promotional: stake it, wrap it, bridge it, lend it. What is harder to find is a plain account of what each design asks a holder to trust. For a chief financial officer, general counsel or allocator, the useful question is not whether a design works but who, exactly, can freeze, censor or lose the bitcoin, and under what conditions. This piece maps that question design by design, from each project's own documentation and from dated figures. Nothing in it is investment, legal or tax advice.
What the base layer will and will not do
Bitcoin's own rules are deliberately narrow. Capacity is fixed: BIP-141, the Segregated Witness specification, limits every block to a weight of 4,000,000 units, and the network retargets mining difficulty every 2,016 blocks against an ideal of 1,209,600 seconds, two weeks, which works out at roughly one block every ten minutes, as the Bitcoin developer guide sets out. Expressiveness is limited too. A Bitcoin script can require signatures, hashes and timelocks, but under today's consensus rules it cannot dictate where coins go once they are spent. That ability, called a covenant, is still "a category of proposed changes to Bitcoin's consensus rules" in Bitcoin Optech's description, and the best-known proposal, OP_CHECKTEMPLATEVERIFY, remains marked Draft in BIP-119.
The result is a ledger that needs no operator and no permission, but that cannot on its own run general-purpose applications or settle payments faster than its block schedule allows. Every design below works around that, and each does so by placing some party, a channel partner, a federation, a signer committee, a custodian or a lender, in a position Bitcoin's own rules do not require. The differences come down to who that party is and what it can do.
The Lightning Network: self-custody with liquidity limits
Lightning is not a separate blockchain but a network of two-party payment channels, specified in the BOLT documents. Two parties lock funds in an on-chain 2-of-2 multi-signature output, exchange signed balance updates off-chain, and return to the base layer to close the channel or to contest a dishonest close. Payments across several channels use hashed time-locked contracts, so a routed payment either completes along the whole route or fails.
Custody on Lightning is conditional. A user who holds their own keys, and who can respond on-chain if a counterparty broadcasts an outdated channel state, keeps funds under rules the base layer enforces; the residual risk is a channel partner cheating while that user, or a service watching on the user's behalf, is offline. The guarantee disappears when a wallet provider holds the keys. A Lightning balance in a custodial app is a claim on that provider like any other.
Liquidity is the practical constraint. A channel can carry only what has been committed to it, so receiving requires inbound capacity that someone else has funded, and under the routing specification each node also advertises htlc_maximum_msat, the most it will send through that channel in any one HTLC. A 2019 study of the network's topology classified it as small-world and scale-free and showed it susceptible to channel-exhaustion and node-isolation attacks, finding that an attacker able to remove nodes should target the most central ones (Rohrer, Malliaris and Tschorsch, IEEE Security and Privacy on the Blockchain, 2019). On 13 September 2026, 1ML showed 5,898 nodes, 19,906 channels and 2,667 BTC of total capacity.
Federations and signer sets: Liquid, Stacks and sBTC
Liquid: a named federation, with emergency keys
Liquid is a sidechain: bitcoin sent to the federation's multi-signature wallet on the main chain is represented as LBTC on a separate chain whose blocks are signed by known parties rather than mined. Its technical overview, retrieved 13 September 2026, says the network is operated by its members, with Blockstream as technical provider. Two groups matter. The more than 80 federation members can peg in and out but play no "direct role in securing the network". That role belongs to the functionaries, whose number the overview does not give, and who both sign blocks and act as "watchmen" securing the bitcoin.
The thresholds are specific. Blocks need signatures from at least two-thirds of block signers, and if a third or more of the functionaries stop operating, the chain is frozen until two-thirds are back. Spending the pegged bitcoin needs more than two-thirds of the watchmen. Peg-outs are paid only to addresses tied to a list of peg-out authorisation keys that takes three days to change, and the general public cannot peg out independently: it has to go through a functionary or a federation member. Finally, the wallet carries a timelock under which, if the network has been non-functional for an extended period, all funds become accessible to a set of three emergency keys. The questions for Liquid are therefore whether more than two-thirds of its functionaries could be compelled or compromised together, whether a third could be taken offline, and who holds those three keys, which the overview does not say.
Stacks and sBTC: a threshold of named signers
Stacks is a separate chain with its own consensus, and sBTC is the bridge that brings bitcoin onto it. Stacks' documentation distinguishes two sets of signers: Stacks signers validate Stacks blocks, while sBTC signers secure the peg. The bitcoin backing all sBTC sits in a single output at a multi-signature Taproot address controlled by the sBTC signers, and any spend needs a threshold of them to approve. Stacks also says its chain state forks with Bitcoin, a property it calls Bitcoin finality; that describes how Stacks history follows Bitcoin's, and does not change who controls the bitcoin in the peg wallet.
According to the sBTC security model, retrieved 13 September 2026, deposits and withdrawals need 70% signer consensus, and an initial set of 15 institutional signers was chosen for the first phase under criteria the Stacks community approved in SIP-028, with a later, undated move to a fully decentralised set. Stacks' sBTC page dates mainnet deposits to 17 December 2024, and the documentation describes withdrawals as a working operation: a user burns sBTC on Stacks and, after six Bitcoin block confirmations, the signers create the Bitcoin transaction that pays out. CoinGecko showed about 2,467 sBTC in circulation on 13 September 2026. The trust question is whether enough of those signers to reach 70% could be compelled, compromised or coordinated to move or withhold the bitcoin.
BitVM bridges and rollups: fewer trusted parties, newer code
BitVM, whose inventor bitvm.org names as Robin Linus, is a way to verify a computation on Bitcoin rather than execute it there, and it "requires no changes to the network's consensus rules". A prover makes a claim; if the claim is false, anyone can submit a fraud proof and punish the prover. The BitVM2 write-up sets out the trust model: a one-time setup that needs only one of its participants to be honest, and, for a bridge, at least one honest operator as well. If every operator is dishonest, they cannot steal deposits, only burn them, but the write-up warns that such liveness failures can in practice be turned into a ransom demand. The reference implementation on GitHub still carried the warning "DO NOT USE IN PRODUCTION!" on 13 September 2026.
Citrea, a zero-knowledge rollup, runs a bridge of this kind on mainnet: its site read "Mainnet is Live" on 13 September 2026. Its canonical bridge, Clementine, is based on BitVM2. Citrea's Clementine documentation describes a committee of signers that pre-signs the only paths deposited bitcoin may take, emulating the covenants Bitcoin itself lacks, and operators who front withdrawals and then reclaim them from the vault, each posting a bond of about 2 BTC that is slashed if a challenge proves a claim fraudulent. On Citrea's account, the bridge is safe as long as each key role has one honest participant and an attacker does not control more than 45% of Bitcoin's hash rate for two weeks. The same page notes that the deployed version omits the whitepaper's reimbursement of challengers, so the honest challenger the model depends on must be able to pay for a challenge up front. Deposits through Clementine are made in units of 10 BTC; smaller amounts are pointed to third-party routes, Symbiosis, which the documentation describes as a cross-chain swap priced against a liquidity pool, and Atomiq.
For any rollup described as secured by Bitcoin, the practical questions are which bridge holds the coins, who sits in its signer and operator sets, and whether that code is live or still marked not for production.
Wrapped bitcoin: the trust sits with custodians
Wrapped BTC (WBTC) and Coinbase Wrapped BTC (cbBTC) make bitcoin usable on smart-contract chains that Bitcoin cannot reach. Both work the same way in outline, a custodian holds bitcoin and a token is minted elsewhere, and differ in who the custodian is. According to WBTC's FAQ, WBTC is minted when bitcoin is deposited through an authorised merchant and released by an authorised custodian, and its site says only identity-verified institutions approved through DAO governance can mint and burn; the merchants listed include Galaxy, Amber, BitGo Prime, Wintermute, Cobo, CoinList and FalconX. In 2024, per WBTC's own timeline, BitGo and BiT Global announced a joint venture for "multi-jurisdictional, multi-institutional, and multi-layer custody" of WBTC. On 13 September 2026, WBTC's transparency page listed custodian addresses holding about 116,512 BTC.
cbBTC has no DAO. CoinMarketCap's description says cbBTC is backed by bitcoin held by Coinbase, that cold-wallet key material is stored at facilities in the United States and Europe, that decrypting a key requires the cryptographic consensus of multiple human operators, and that holders redeem by depositing cbBTC into a Coinbase account. CoinMarketCap put circulating supply at about 96,000 cbBTC on 13 September 2026.
Either way, the holder's claim runs against a custodian and the arrangements around it, not against Bitcoin's consensus, which raises the segregation and bankruptcy-remoteness questions covered in our guide to what institutional custody actually means. A published list of reserve addresses shows coins sitting at those addresses at a moment, not that they were unencumbered, the limit examined in what proof of reserves proves. And each further bridge a wrapped token crosses adds another verification and custody system, which our threat model for institutional DeFi treats as a separate risk to underwrite.
Bitcoin-backed lending: who can move the collateral
Borrowing dollars against bitcoin without selling it asks the custody question again, and two lenders give opposite answers. Unchained's commercial loans page, retrieved 13 September 2026, describes collaborative custody: the borrowing company, Unchained and Fortis Bank each hold a key to a multi-signature vault, and the collateral "cannot be moved or rehypothecated by Unchained, Fortis Bank, or your company acting alone". The borrower can verify the collateral on-chain with its own key. The page's pricing example, dated 10 November 2025, assumes collateral worth twice the loan principal.
Ledn takes the custodial route. Its site, retrieved 13 September 2026, says collateral is held with a qualified independent custodian in segregated on-chain addresses and may be re-posted by Ledn to an institutional funding partner such as a bank or credit fund; it also says collateral is never lent out to earn interest. Loans start at 50% loan-to-value, with a margin call at 70% and liquidation at 80%. Ledn publishes a monthly Open Book Report, independently reported by The Network Firm, with the latest attestation dated 1 September 2026. A Ledn borrower relies on Ledn, its funding partners and its custodian; an Unchained borrower's collateral cannot be moved by any one key holder acting alone.
Reading the map
One question sorts every design here: which parties, and how many, would have to fail or collude before bitcoin moves, or stops moving, without its owner's consent.
- Base layer: no party beyond whoever holds the keys.
- Lightning: in self-custody, a channel partner, and only if the user, or a service watching for the user, fails to respond in time; in a custodial app, the provider.
- Liquid: more than two-thirds of its functionaries to move the pegged bitcoin, a third of them to freeze the chain, and after a prolonged outage, whoever holds the three emergency keys.
- sBTC: enough of its signers to reach the 70% approval threshold, or enough to stop it being reached.
- Clementine: on Citrea's own account, every participant in one of its key roles acting dishonestly, or an attacker holding more than 45% of Bitcoin's hash rate for two weeks.
- WBTC and cbBTC: the custodians, and for WBTC the merchant and DAO arrangements around them.
- Bitcoin-backed loans: the lender, its partners and custodian, or, in collaborative custody, more than one named key holder acting together.
None of these is wrong for every use. Each is a specific trade that can be checked against the project's own documentation before an institution relies on it.
On the Paris 2026 programme
Among the sessions at Proof of Talk's Paris 2026 edition, at the Louvre Palace, were two on Bitcoin. On Day 1, 2 June 2026, the Taostats Stage carried the panel "Rebuilding Bitcoin’s Financial Stack: From Payment Rails to Programmable Value", 11:35–12:10, with Rena Shah, Ben Milne and Chad Master, moderated by Pete Rizzo. On Day 2, 3 June, the Hecto Main Stage carried the fireside "Decentralising Intelligence: The Unification of AI and Bitcoin", 10:05–10:35, in which Jacob Steeves was in conversation with the moderator, Mark Jeffrey. This piece attributes no view to any participant in either session; both are archived on the agenda.