What is BitVM?

BitVM is a framework, proposed by developer Robin Linus, for verifying complex computations on Bitcoin without changing Bitcoin's consensus rules. Rather than running a program on the blockchain, BitVM lets one party claim a result and lets others dispute it on-chain if the claim is wrong. Its main use so far is building bridges that move BTC to layer 2 networks and sidechains.

What does the BitVM whitepaper say?

The original whitepaper, dated December 12, 2023, describes a two-party setup with a prover and a verifier. Both lock deposits into a shared Taproot address. The program is broken into a huge circuit of simple logic gates, and each gate becomes a hidden script in the Taproot tree, so the address commits to the whole program while staying small on-chain.

If both sides agree, they settle off-chain with no trace of the computation. If the verifier thinks the prover lied, a series of pre-signed transactions forces a challenge-and-response game that narrows down the faulty step. A prover caught cheating loses its deposit. The paper was open about limits: only two parties, heavy off-chain work, and inefficient circuits. It called itself a sketch, with a real implementation as the next step.

What is BitVM2?

BitVM2 was announced in August 2024. Cointelegraph reported that it lets anyone dispute a false claim, not just a fixed set of parties, and that a challenge takes three transactions instead of up to 70 in the first design.

A peer-reviewed paper on BitVM2, presented at USENIX Security 2026, describes it as letting arbitrary programs be verified on Bitcoin while keeping Bitcoin's security. Its authors include Robin Linus along with academic researchers and engineers from the BOB project.

How does the BitVM bridge work?

The BitVM bridge draft paper explains the flow. A user deposits BTC into a locked output, and the other system mints wrapped BTC after confirming the deposit. To exit, the user burns the wrapped coins, an operator pays them BTC on Bitcoin from its own funds, and the operator later claims the locked deposit after a challenge period. If the operator's claim is false, any challenger can prove it on-chain and the operator's stake is slashed.

The headline benefit is the trust model. Most crypto bridges rely on a majority of signers being honest. BitVM2 lowers this to needing just one honest member of the setup committee, sometimes called 1-of-n honesty.

What are the limits of BitVM?

BitVM is not trustless in every sense. The bridge paper notes that operators must front their own BTC for withdrawals, only fixed deposit amounts are supported, the setup still depends on a signer committee, and some dispute transactions are too large for standard relay rules. As of November 2026, the project site also links to newer BitVM3 research, and the design is still evolving. Each project's exact design and risks are worth reading before use.