Bitcoin Rollup Comparison: Citrea, BOB, Starknet, and More

Bitcoin Rollup Landscape

Bitcoin rollups execute transactions off-chain and post proofs or data back to Bitcoin L1 for settlement. Unlike Ethereum, Bitcoin lacks native smart contract verification, so rollups must rely on creative workarounds: primarily BitVM fraud proofs that emulate computation verification within Bitcoin Script. This constraint shapes every Bitcoin rollup's design, bridge mechanism, and trust model.

The following table compares active Bitcoin rollup projects across their core technical dimensions. Note that TVL figures are approximate and shift rapidly in early-stage ecosystems.

Proof Systems and Verification

Bitcoin cannot natively verify zero-knowledge proofs or execute complex smart contracts. This is the fundamental constraint that separates Bitcoin rollups from Ethereum rollups, where a Solidity verifier contract can check proofs directly on-chain.

Citrea generates STARK proofs via RISC Zero's RISC-V based zkVM, then compresses them into Groth16 SNARKs for compact on-chain verification. The Clementine bridge uses BitVM2 to enforce verification: if a bridge operator submits a fraudulent state update, any single challenger can prove the fraud on Bitcoin and seize the operator's collateral. This 1-of-N honesty assumption means only one rational verifier is needed to keep the system honest.

Strata (Alpen Labs) takes a different approach with Glock, a cryptographic primitive that uses garbled circuits and DV-SNARKs to verify proofs on Bitcoin at up to 1000x lower cost than standard BitVM. Strata generates its ZK proofs via SP1 (Succinct's zkVM) and posts them to Bitcoin for settlement.

BitcoinOS developed BitSNARK, a minimal register-based VM specifically designed to verify zkSNARK proofs within Bitcoin Script. BOS achieved the first-ever ZK proof verification on Bitcoin mainchain, demonstrating that proof verification without opcode changes is possible. Rather than operating a single rollup, BOS provides infrastructure (MerkleMesh) for others to build rollups on top of.

BOB currently relies on Ethereum-side OP Stack fraud proofs for its settlement guarantees. It settles on Ethereum today, not on Bitcoin directly, though the team is actively contributing to BitVM3 research to add Bitcoin-native enforcement. BOB's BitVM3 implementation reduced worst-case on-chain dispute costs by 87% to approximately $10.91 per dispute.

For a deeper technical analysis of Citrea's architecture, see our Citrea ZK rollup research article.

BitVM: Enabling Trustless Verification

BitVM is the critical innovation that makes trust-minimized rollups on Bitcoin possible without protocol changes. It has evolved through three generations, each addressing the limitations of the last.

The original BitVM (2023) was a two-party model: one Prover and one Verifier. It required pre-generating billions of transactions for potential challenges, making it impractical for multi-user applications like bridges.

BitVM2 upgraded to permissionless N-party verification. Anyone can act as a challenger, and only one honest challenger is needed to catch fraud. This is the model Citrea's Clementine bridge uses in production. The tradeoff: expressing a SNARK verifier in Bitcoin Script is extremely complex, and worst-case disputes can require multi-megabyte on-chain transactions.

BitVM3 (published May 2026 by Robin Linus Woll et al.) uses garbled circuits to move computation off-chain while keeping fraud proofs on-chain. It reduces worst-case dispute transactions from megabytes to approximately 2.5 kvB (roughly $5 at current fee rates), a nearly 1000x improvement. BitVM3 is still in the research phase, though BOB has an early implementation.

Bridge Trust Assumptions

The bridge is the most security-critical component of any rollup. It determines how BTC moves between the base layer and the rollup, and what happens if something goes wrong. Current Bitcoin rollup bridges fall into three categories.

The distinction matters enormously. A 1-of-N BitVM bridge can fail only if every single challenger is offline or compromised simultaneously. A federated bridge fails when enough signers collude or are hacked. A centralized bridge has a single point of failure. For a broader view of bridge security models, see our layer 2 comparison tool.

Bitcoin Blockspace Constraints

Every rollup that posts data to Bitcoin competes for the same limited block space: 4 million weight units per block, or effectively up to 4 MB with SegWit witness data. Bitcoin blocks have been consistently full since early 2023, which means rollup data posting directly increases base layer fees.

A single rollup posting proof outputs and state differences typically consumes up to 400 KB per posting transaction (roughly 10% of a full block). At fee rates of 10 sat/vByte, this costs approximately $460,000 per month. At 50 sat/vByte during congestion, costs rise to approximately $2.3 million monthly. Multiple rollups competing for this space would drive fees even higher, creating a sustainability question that Galaxy Research has flagged as a structural concern.

This cost pressure means rollup users would need to pay approximately $0.05 to $0.23 per transaction just to cover data availability costs. Some projects are exploring alternative DA layers (Celestia, Near) to reduce costs, though this introduces additional trust assumptions beyond Bitcoin L1. Ethereum L2s faced a similar challenge before EIP-4844 (blobs) dramatically reduced their DA costs: Bitcoin has no equivalent upgrade on its roadmap.

How Rollups Differ from Lightning, Spark, and Liquid

Bitcoin rollups are not the only scaling approach. They sit alongside payment channels (Lightning), off-chain statechain protocols (Spark), and federated sidechains (Liquid) in the broader layer 2 landscape. The key differences are in trust model, programmability, and cost structure.

Lightning Network and Spark are optimized for payments. Lightning uses bidirectional payment channels with trustless on-chain enforcement: your BTC never leaves L1 until you close a channel. Spark extends this model with statechain-based transfers that support offline receiving and eliminate channel management, while maintaining a 1-of-N trust assumption where a single honest operator keeps the network safe. Neither Lightning nor Spark pays for Bitcoin DA, since all state is managed off-chain.

Liquid Network is a federated sidechain governed by a 11-of-15 functionary multisig (60+ federation members total). It provides confidential transactions and faster block times (1 minute), but users cannot unilaterally exit: withdrawing BTC requires federation cooperation.

Rollups offer something none of these provide: general-purpose smart contract execution (full EVM compatibility in most cases). This enables DeFi, tokenized assets, and complex programmable logic on a Bitcoin-anchored layer. The tradeoff is significant: rollups pay hundreds of thousands of dollars monthly in DA costs and rely on still-maturing BitVM technology for their trust-minimized bridges.

For a detailed side-by-side of all Bitcoin L2 approaches, see our Bitcoin L2 trust model comparison.

Current TVL and Adoption

BTCFi TVL has contracted approximately 74% from peak levels. Many users who arrived for farming incentives left when incentive programs ended. The broader challenge: deploying the same DeFi primitives already available on Ethereum and Solana gives users limited reason to bridge BTC onto less-tested chains.

Among rollups specifically, B² Network leads with approximately $477 million in bridged TVL, though only ~$40 million is actively deployed in DeFi protocols. BOB follows with ~$66 million bridged and ~$10 million in DeFi, while processing 80,000+ daily transactions. Merlin Chain peaked at over $1.7 billion in TVL with 150+ dApps but has since declined to approximately $15 million in active DeFi TVL. Citrea, having launched in January 2026 with 30+ dApps, sits at approximately $1.7 million as its ecosystem matures.

These figures contrast with established Bitcoin layers: the Lightning Network holds approximately 5,000 BTC in channel capacity and processes millions of daily transactions, while Rootstock (RSK) maintains roughly $98 million in TVL through its merge-mined sidechain. Stacks, which uses Proof of Transfer consensus rather than a rollup architecture, holds approximately $120 million in TVL with 300,000+ daily transactions.

How to Evaluate a Bitcoin Rollup

When assessing any Bitcoin rollup, these are the questions that matter most:

• Can you exit unilaterally? If the rollup operators disappear, can you recover your BTC on L1 without their cooperation? BitVM-based bridges (Citrea) allow this in theory; federated bridges do not.
• Where does the data live? Rollups posting data to Bitcoin L1 inherit its censorship resistance. Those using alternative DA layers introduce additional trust assumptions.
• Is the bridge code audited and open-source? Clementine (Citrea) is open-source. Many other bridge implementations are not fully auditable.
• What are the DA economics? A rollup that cannot sustain its data posting costs will either raise user fees, reduce posting frequency (weakening security guarantees), or migrate to cheaper DA layers.
• How mature is the fraud/validity proof system? BitVM2 is in production (Citrea). BitVM3 remains in research. Many rollups rely on multisigs rather than cryptographic enforcement.

For payment use cases where full EVM programmability is not required, Lightning and Spark provide faster, cheaper, and more battle-tested alternatives. Rollups make the most sense for applications that specifically require smart contract execution on a Bitcoin-anchored layer: DeFi protocols, tokenized assets, and programmable settlement logic.

Frequently Asked Questions

What is a Bitcoin rollup?

A Bitcoin rollup executes transactions off-chain, then posts compressed transaction data or validity proofs back to the Bitcoin base layer for settlement. This provides higher throughput and lower per-transaction costs while inheriting some degree of Bitcoin's security guarantees. The key challenge is that Bitcoin cannot natively verify rollup proofs, so projects use BitVM or similar constructions to emulate verification within Bitcoin Script.

Which Bitcoin rollup is the most trustless?

Citrea currently offers the strongest trust minimization among production Bitcoin rollups. Its Clementine bridge is the first production deployment of a BitVM2-based two-way peg, operating under a 1-of-N honesty assumption: only one rational challenger needs to be online to catch fraud. By contrast, most other Bitcoin L2s rely on federated multisig bridges that require a majority of signers to act honestly.

How do Bitcoin rollups compare to Ethereum rollups?

Ethereum rollups benefit from native smart contract verification: a Solidity verifier contract can check validity proofs directly on L1. Bitcoin lacks this capability, so rollups must use BitVM to emulate verification in Bitcoin Script, adding complexity and cost. Ethereum rollups also benefit from EIP-4844 blob space for cheap data availability, while Bitcoin rollups compete for general-purpose block space at significantly higher cost.

What is BitVM and why does it matter for Bitcoin rollups?

BitVM is a construction that enables arbitrary computation verification on Bitcoin without protocol changes. It works by encoding computation into Bitcoin Script commitments, then using a challenge-response protocol where anyone can prove an invalid claim. BitVM2 (used by Citrea) enables permissionless N-party verification. BitVM3 (published May 2026) reduces dispute costs by approximately 1000x. BitVM is essential because it is the only known mechanism for trust-minimized rollup bridges on Bitcoin without a soft fork.

Can Bitcoin support multiple rollups simultaneously?

In theory, yes. In practice, Bitcoin's 4 MB block size creates a hard ceiling on how much rollup data can be posted per block. A single rollup data posting can consume up to 10% of a block. If many rollups compete for this space, fees rise for all Bitcoin users. Galaxy Research has warned that most Bitcoin L2 rollups may not be economically sustainable long-term without alternative data availability solutions or a Bitcoin-native equivalent to Ethereum's EIP-4844.

Are Bitcoin rollups safe to use today?

Bitcoin rollups are in their earliest production phase. Citrea launched its mainnet in January 2026 with approximately $1.7 million in TVL, and its BitVM2-based bridge is the first of its kind. BOB has been operational longer but currently settles on Ethereum rather than Bitcoin directly. The technology is advancing rapidly, but users should treat these systems as early-stage: bridge code is new, TVL is small relative to established protocols, and the economic sustainability of Bitcoin DA costs remains an open question.

How do Bitcoin rollups affect Bitcoin transaction fees?

Rollup data postings compete for the same block space as regular Bitcoin transactions. Each posting consumes up to 400 KB. When block space demand is high, rollup postings contribute to fee pressure for all users. This is similar to how Ordinals inscriptions drove fee spikes in 2023. Proposed BIP-110 would restrict arbitrary data in transactions, though miner signaling for this soft fork is currently under 1%.

This tool is for informational purposes only and does not constitute financial advice. TVL figures, project statuses, and technical details are approximate and based on publicly available information as of mid-2026. The Bitcoin rollup ecosystem is evolving rapidly. Always verify current data directly with project documentation before making decisions.