BitVM Implementations Compared: Smart Contracts on Bitcoin

What Is BitVM?

BitVM is a framework for performing arbitrary computation on Bitcoin without requiring a soft fork or any consensus changes. Proposed by Robin Linus in October 2023, the core insight is that computation happens off-chain while Bitcoin serves as the dispute resolution layer. A prover commits to the result of a computation, and if the claim is false, any verifier can submit a compact fraud proof on-chain to penalize the prover and correct the record.

The original design decomposed computations into NAND logic gates that Bitcoin Script can verify individually. This proved that Bitcoin could enforce arbitrary programs in theory, but the practical costs were prohibitive: dispute resolution required up to 70 on-chain transactions over weeks or months. Since then, two major revisions (BitVM2 and BitVM3) have dramatically reduced those costs, and several Layer 2 projects have adopted BitVM as their bridge security model.

BitVM Version Comparison

Three generations of BitVM exist, each improving on the previous design's cost, round complexity, and trust assumptions. The following table summarizes the key technical differences.

BitVM2 is the current production standard. Its single-round challenge replaced the interactive bisection of BitVM1, and any party can act as a challenger rather than only pre-designated participants. BitVM3 is a research proposal that moves the verifier execution off-chain using garbled circuits, drastically reducing on-chain dispute costs, but it requires operators to store up to 5 TB of garbled circuit data and has not been deployed.

How BitVM2 Works

BitVM2 replaced the original NAND-gate bisection with a design that verifies a SNARK proof inside Bitcoin Script. The operator (prover) executes a computation off-chain, generates a SNARK proof of its correctness, and posts a commitment on Bitcoin. If the result is honest, nothing else happens on-chain. If the operator lies, any challenger can trigger a single-round dispute that splits the SNARK verifier across multiple Bitcoin transactions, each fitting within the 4 MB block weight limit.

The critical improvement is the trust model: BitVM2 requires only one honest party among all potential challengers. This is the same 1-of-N honesty assumption used by optimistic rollups on Ethereum. A Robin Linus et al. paper presented at USENIX Security 2026 confirmed that a full BitVM2 challenge has been executed on Bitcoin mainnet, demonstrating the protocol's viability in production.

Projects Building on BitVM

Several Bitcoin L2 projects have adopted BitVM (primarily BitVM2) as the foundation for their bridge security. The following table compares the major implementations.

Citrea is the most mature deployment. Citrea's Clementine bridge uses BitVM2 to enforce ZK-STARK proof validity on Bitcoin. The rollup executes transactions in a zkEVM powered by RISC Zero, posts state commitments to Bitcoin, and relies on the 1-of-N honesty assumption for settlement. If an operator submits an invalid proof, any challenger can trigger the BitVM2 dispute on Bitcoin mainnet.

Bitlayer launched as one of the first BitVM-based L2s but reportedly paused its bridge in mid-2026. BOB (Build on Bitcoin) raised $21 million and is preparing a mainnet BitVM2 bridge, while GOAT Network launched its BitVM2 testnet V3 in January 2026. For a broader comparison of Bitcoin L2 approaches, see our Bitcoin rollup comparison.

Why BitVM Matters for Bitcoin L2s

Before BitVM, Bitcoin L2s faced a fundamental trust problem: moving BTC from the base layer to an L2 required either a federated multisig (as in Liquid) or a centralized custodian. These bridges introduced counterparty risk that undermined Bitcoin's trustless properties.

BitVM changes this by enabling trust-minimized bridges. Under the 1-of-N model, a bridge remains secure as long as a single honest participant monitors and is willing to challenge fraud. This is a significant upgrade from federated models that typically require a majority of signers to be honest (e.g., 3-of-5 or 5-of-8 multisig setups). For rollups in particular, BitVM2 bridges provide a path to settlement on Bitcoin without requiring new opcodes like OP_CAT or OP_CTV.

For a deeper analysis of the original BitVM proposal and its design, see our research article on BitVM: trustless Bitcoin verification. To compare Bitcoin's virtual machine approaches more broadly, see the Bitcoin virtual machine comparison.

Limitations and Tradeoffs

BitVM is not a universal solution. Several constraints shape what it can and cannot do in practice.

Challenge period and capital lockup:

• BitVM2 bridges enforce a challenge period of approximately two weeks before withdrawals finalize on Bitcoin
• During this window, BTC is locked and cannot be used, creating capital inefficiency for bridge operators
• GOAT Network claims to have reduced this to one day on their testnet, but this has not been independently verified on mainnet

Dispute economics:

• A worst-case BitVM2 dispute costs approximately $16,000 in on-chain fees, which means challengers need significant capital to enforce honesty
• BitVM3 aims to reduce this to roughly $5, but the protocol requires operators to store approximately 5 TB of garbled circuit data
• The economic incentive to challenge depends on the value at stake exceeding the dispute cost

Script and transaction constraints:

• Bitcoin's 4 MB block weight limit means the SNARK verifier must be chunked across multiple transactions, each under 400 KB of script
• Compiling a Groth16 verifier to Bitcoin Script produces a large program (estimates range from 20 MB to over 1 GB depending on optimization level)
• These chunked transactions must all confirm within the challenge window, adding coordination complexity

No covenant support yet:

• BitVM2 bridges currently use N-of-N pre-signing committees to establish the peg-in conditions
• Covenant opcodes like OP_CTV or OP_CAT would remove this setup requirement, but no covenant proposal has been activated on Bitcoin mainnet
• Until covenants arrive, BitVM bridges require a pre-signing ceremony among operators before they can accept deposits

BitVM vs Other Bitcoin Scaling Approaches

BitVM-based rollups are one of several competing approaches to Bitcoin scaling. Each makes different tradeoffs between trust, speed, and complexity.

Federated sidechains like Liquid use a fixed set of functionaries to manage the bridge. This is simpler to operate but requires trust in the federation. BitVM bridges reduce trust to 1-of-N but add complexity and capital lockup.

Statechains, as used by Spark, take a fundamentally different approach: they transfer UTXO ownership off-chain without wrapping BTC into a separate token. This avoids the bridge problem entirely for payments and simple transfers, though it does not provide the general-purpose smart contract execution that BitVM-based rollups offer. For use cases like stablecoin transfers and Bitcoin payments, Spark's statechain model offers instant settlement without challenge periods.

Lightning channels provide instant payment finality but are limited to payment routing rather than general computation. For a comprehensive view, see our Bitcoin second-layer scaling landscape research article.

The Road Ahead: BitVM3 and Covenants

BitVM3, published as a preprint in 2026, proposes replacing on-chain SNARK verification with garbled circuits. The challenger evaluates a garbled verifier locally and only posts a small fraud witness (roughly 93 virtual bytes) if the operator cheated. This reduces worst-case dispute costs from thousands of dollars to approximately $5, making challenges economically viable even for small bridge amounts.

The tradeoff is off-chain storage: each operator must maintain approximately 5 TB of garbled circuit data. BOB's co-founder has noted that while the bridge design between BitVM2 and BitVM3 remains largely the same (the main change is the verifier), garbled circuits require substantial additional research before production deployment.

Covenant opcodes represent another potential improvement. If Bitcoin activates proposals like OP_CAT or OP_CTV, BitVM bridges could eliminate the N-of-N pre-signing ceremony entirely, reducing setup complexity and making bridges more permissionless. However, covenant activation remains politically contentious in the Bitcoin community, and no activation timeline exists. Read more about the covenant landscape in our covenant activation research.

Frequently Asked Questions

What is BitVM and how does it work?

BitVM is a framework that enables arbitrary computation on Bitcoin without consensus changes. Computation runs off-chain, and Bitcoin serves as the dispute resolution layer. A prover commits to a result on-chain, and if the claim is false, any verifier can submit a fraud proof using Bitcoin Script to penalize the prover. The key innovation is that Bitcoin only processes disputes, not the computation itself, keeping the base layer lightweight while enabling complex logic.

What is the difference between BitVM1 and BitVM2?

BitVM1 (2023) used an interactive bisection protocol requiring up to 70 on-chain transactions between a fixed prover and verifier. BitVM2 (2024) replaced this with a single-round SNARK verification that any party can challenge, reducing the trust model from 1-of-2 to 1-of-N honest parties. BitVM2 also shortened the challenge period from potentially months to approximately two weeks and reduced the on-chain footprint from over 1 GB to roughly 4.8 MB per dispute.

Does BitVM require a Bitcoin soft fork?

No. BitVM works entirely within Bitcoin's existing Script capabilities, particularly leveraging Taproot and Tapscript for compact script commitments. No new opcodes are required for the core protocol. However, covenant opcodes like OP_CAT or OP_CTV would improve BitVM bridges by removing the need for N-of-N pre-signing ceremonies during setup.

Which Bitcoin L2s use BitVM?

As of October 2026, Citrea is the most prominent BitVM2-based L2 with a live mainnet and the Clementine bridge. BOB, GOAT Network, Alpen Labs, and Fiamma are also building on BitVM2. Bitlayer launched with BitVM but reportedly paused its bridge in mid-2026. Most of these projects use BitVM2 specifically for their trust-minimized bridge from Bitcoin to the L2 execution environment.

How does BitVM compare to Ethereum rollups?

BitVM-based bridges share the 1-of-N honesty assumption with Ethereum's optimistic rollups. The key difference is that Ethereum has native smart contract support for verifying fraud proofs, while Bitcoin requires the computation to be encoded in Script and split across multiple transactions. This makes BitVM disputes more expensive (approximately $16,000 worst case for BitVM2 vs. a few hundred dollars on Ethereum) and the challenge period comparable at roughly two weeks.

What is BitVM3?

BitVM3 is a 2026 research proposal by Robin Linus Woll that replaces on-chain SNARK verification with garbled circuits. The challenger evaluates the circuit off-chain and only posts a small fraud witness (approximately 93 vB) if fraud is detected. This reduces worst-case dispute costs to around $5 but requires operators to store roughly 5 TB of garbled circuit data. BitVM3 has not been deployed to production.

Can BitVM enable trustless Bitcoin bridges?

BitVM bridges are trust-minimized rather than fully trustless. They require at least one honest challenger to monitor the bridge and dispute fraud. This is a 1-of-N honesty assumption, which is stronger than federated multisig bridges (which need a majority of signers) but weaker than a fully trustless system where the protocol enforces correctness automatically. The economic viability of challenging also depends on dispute costs being lower than the value at risk.

This tool is for informational purposes only and does not constitute financial advice. Data is approximate and based on publicly available information as of October 2026. BitVM implementations are rapidly evolving: project statuses, cost estimates, and technical specifications may change. Always verify current data from official project documentation before making decisions.