Deep Dive - tBTC

An analysis breaking down everything you need to know about the project bringing BTC to Ethereum

This Formal Verification crypto research is free for everyone. If you don’t want to miss out on the latest crypto research and content, then hit that subscribe button today.

Bringing BTC to Ethereum

As we revisit the idea of ‘hard money’ in the backdrop of global economic instability, unprecedented levels central bank debt issuance, and the bitcoin halvening, one recent area of intense focus in the crypto sphere has been enabling the representation of BTC on other blockchains, such as Ethereum. While this idea is not an entirely new one (see Binance’s BTCB, imBTC, WBTC), there has been growing energy from projects that look to improve on the current solutions and models out there, namely lowering the trust requirements. One of these projects that has just launched is tBTC.

But before we dive into tBTC, it helps to understand why there is a desire for Bitcoin synthetics on other blockchains at all.

Bitcoin’s UTXO

As most readers know, record-keeping in Bitcoin uses an UTXO model (as opposed to say Ethereum’s account-based model). When you transact on the Bitcoin network, you spend outputs from previous transactions and create new outputs that can be spent in future transactions - your balance is the sum of all unspent transactions. Critically, Bitcoin’s locking script will specify that the recipient can only spend the newly created UTXOs. The network keeps all of these unspent transactions fully-synchronised.

However, one of the limitations with this model in Bitcoin is that the parameters for the locking script have to be set in advanced. You cannot change or specify any further parameters at the time of execution. Consequently, Bitcoin’s locking script is not expressive enough to realise advanced contracts. This is where BTC bridge projects come in. If BTC can exist on more expressive smart contract platforms, such as Ethereum, users can take advantage of DeFi composability and put their BTC to work across a growing number of interconnected dApps. Within DeFi specifically, BTC being a deeply liquid collateral asset can increase the open credit market by at least an order of magnitude.

While still early days, there is evidence of growing popularity for BTC synthetics on Ethereum. On 12th May, a single user minted 1k of WBTC ($8.8m) which marked a 77% increase in total WBTC supply. However, users will be quick to point out that WBTC is centrally issued by the company BitGo and central “merchants” are responsible for pegging BTC in and out after they complete AML/KYC. This still leaves room for solutions that allow for the permissionless creation of BTC synthetics that are trustlessly backed.


Creating a peg model that allows users to permissionlessly mint Bitcoin synthetics without the reliance on centralised counter-parties needs to solve some key issues first: (1) Users have to ensure that the BTC they deposit into an address is not going to be stolen (2) ownership of BTC by proving information on another chain (3) the holder of the synthetic being able to redeem their synthetics for the locked BTC. tBTC attempts to solve this by building on the Shamir Secret Sharing model by incorporating threshold signatures. Let’s dive into how this works.

Threshold Signatures

As a reminder, a decentralised peg model needs to ensure that no party assisting with the creation of synthetics can take control of the deposited assets. What this means in practice is ensuring that no party has visibility and control of the deposit address private key. Threshold Signatures solve this by using multi-party computation (MPC). MCP essentially allows information which, when brought together, can sign off actions with a respective private key. One of the key features of MPC is that the underlying information is treated with homomorphic encryption ensuring parties never know the underlying values themselves or have visibility of the private key at any point.

For simplification, the process goes as follows: a scheme will determine how many shares (that correspond to a private/public key pair) and each participant in the scheme is given a 'share’. When data needs to be signed off, the required number of participants (e.g. 3/5) have to respond in order for the sign off to occur correctly. The beauty of such a model is that signers are allowed to enter and exit the scheme without a required change in the key pair (signers don’t have to stay signers forever). This characteristics critical for tBTC which we will discuss below.

Now let’s walkthrough how tBTC is minted when a user requests to place a BTC deposit.

  1. A user requests to deposit their BTC in order to get the same value in tBTC on Ethereum mainnet

  2. Keep Network will use MPC to select 3 signers from the total available signers

  3. After being selected, signers have to put a deposit of 150% of the BTC value in ETH. A private key for a Bitcoin and Ethereum deposit address is created by the 3 signers

  4. Once the BTC is deposited into the Bitcoin address, a special tBTC deposit token (TDT) on Ethereum that represents a claim to a deposit’s underlying UTXO (facilitated by simple payment verification proof submitted to the Ethereum address). This TDT is an ERC-721 token.

  5. The TDT is then used to mint tBTC. Users can redeem their tBTC by sending back the TDT and receiving their funds back (note - users will have to pay fees to respective signers at point of redemption)

KEEP Token

We’ve touched on the requirement of ETH as a collateral asset for signers in order to align participant behaviour. However, this signer collateral alone doesn’t guarantee that you can become a worker on the KEEP Network. The Keep Network itself needs an incentive layer to drive efficiency and trust. This is where the KEEP token comes in.

The core use case of KEEP tokens is that it is used as a work token whereby owning KEEP gives you the opportunity to stake your ETH as a signer and make money from signer fees. In practice, the likelihood of being selected as a signer is a function of how many KEEP tokens you hold. For example, a user delegating 1,000 KEEP could expect over time to be selected for work 10x more often than someone who delegates 100 KEEP, earning fees in proportion to the work they successfully perform.

This is clearly capital inefficient - you might be wondering why the team has bothered with strapping on a work token at all considering signers have to put up collateral in the form of ETH. The team have stated that this (at least initial) collateral intense approach will add another layer of security to the network as the KEEP token allows malicious signers to be ‘kicked’ from the system. The logic goes that if a signer wanted to re-engage with the system, they would have to buy back new (and potentially illiquid) KEEP from the market disincentivising such malicious behaviour in the first place.

The team are hoping the KEEP security layer will lower the capital costs by signers as eliminating the KEEP component would likely justify a higher collateralisation ratio of ETH to gain effective network security (see here for more information regarding the KEEP token). Additionally, signers can also be rewarded KEEP without having to buy KEEP tokens on secondary markets through the ‘Play for Keeps’ which is covered below.

Where is tBTC at now?

tBTC was launched on mainnet on May 11th using MakerDAO’s ETHBTC price feed. At the start, the dApp will limit deposits sizes to small amounts but this will grow as the network is battle tested over time. The first signers on the tBTC network will be a permissioned set of signers of (~80-100).

The Keep Network will be running a long incentivised testnet called ‘Play for Keeps’. Play for Keeps is allowing community members to support the network off-chain (e.g. translations, video walkthroughs) so they can be rewarded in KEEP. These contributors can then stake their KEEP tokens on mainnet so they have a chance in being selected as a signer. Additionally, a stakedop will allow ETH holders to earn KEEP (and thus the right to work as a signer on the mainnet) by showing they are good stakers on the testnet for at least 4 weeks. Signers would typically have to bond both KEEP and ETH but the stakedrop allows users to become a signer with just ETH.

The stakedrop launched on the 8th June. Prospective signers will be judged by Zaki Manian, Spencer Noon, and Viktor Bunin for the months of May, June, and July respectively. The judges will award anywhere between 10 and 100k KEEP.

Recently, tBTC announced 40 industry partners (collectively representing three quarters of the total decentralised market) from wallet providers, exchangers, and custody providers that will collectively support the distribution, usage, and storage of tBTC around DeFi. For example, very recently, Loopring announced they will be adding tBTC support on ZK Rollups which will provide orders of magnitude greater throughput and cheaper settlement costs than existing layer 1 DEXs. The collective efforts of these partners overall will be absolutely paramount in driving the usage of tBTC across DeFi applications safely and effectively.


Now that we’ve had a run through of the key points of the system, let’s assess the degree of decentralisation and scalability of tBTC specifically with regards to custody, incentive design, and price feeds.


There is clearly no reliance on central issuance here but rather trusting correct smart contract execution for deposits and withdrawals. This marks a more decentralised approach to solutions like WBTC and imBTC. The key concern here is existence of an admin key which give the team certain abilities: (1) start a one-time emergency 10-day pause (2) time-delayed fee rate setting (although tight range defined) (3) lot size setting (4) collateral ratio setting (strictly defined between 100%-300%).

While this design choice ultimately strives to secure the network, some readers may be unaware that these functions will not be governed by the wider community for the foreseeable future, such as on-chain token voting. This, of course, runs very much counter to the DAO/governance narrative that is currently prevalent in the space.

Incentive Alignment

tBTC’s incentive design is constructed to deter any collusion or malicious behaviour. By having a 150% collateral level, acting dishonestly is not in any signer’s best interest. This perhaps necessary component is also one of tBTC’s weakest. Firstly, signers have to ensure that their collateral ratio is kept at 150% and it is not known what happens if this ratio falls to ‘black swan’ levels. We know that ‘pre-liquidation’ occurs when the ratio hits 125%, signers should close the deposit or face liquidation. If it is not closed within 6 hours or the ratio falls below 110%, liquidation will follow. However, signers are incentivised to close the positions down before this to avoid losing their collateral from full liquidations.

Secondly, having this requirement means the creation of tBTC is directly constrained by the willingness of signers to bond ETH. During the early periods of the network, staking providers and Keep Network will likely drive bootstrap initial ETH amounts. As time goes on, further bond value from public signers will likely be because the fee revenue for signers is higher than the cost of capital. However, the prospect of earning meaningful returns as a signer is somewhat muted:

Signers earn a revenue of 1.875%. After bonding 150% in value for deposits, this makes out to a 1.25% yield which is lower than the borrow rates for ETH on credit markets (As of 13th May, Compound is currently offering Eth borrow rates of 2% with Nuo offering as much as 4.3%). Therefore, signers may not be economically incentivised to contribute resources to the network to secure tBTC. Note, staking yields for ETH 2.0 might make this even more problematic.

Price Feeds

tBTC is using price feeds operated by MakerDAO for the first version of the system. For context, MakerDAO price feeds are a collection of voted-in parties selected by MKR holders. This is somewhat a decentralised approach but such an approach might be short-lived as a new price feed mechanism for tBTC v2 will be introduced (details being unknown at this point).

Open questions

  • Will signers settle for <2% yield? Will signers ultimately take the form of institutions?

  • Will forcing malicious signers to buy KEEP from the market again an effective deterrent? What will KEEP’s liquidity look like?

  • How will tBTC cope with ETH flash crash (i.e. ETH drops more than 33% in less than 6 hours) or if BTC rips higher on the ETHBTC pair?

  • How will tBTC transition from ETH 1 to 2.0? Will there effectively be two operating systems?

  • What other collateral types might be added in v2? How are these selected and risk assessed?

  • How will tBTC fare against other peg solutions such as Ren or cross-chain liquidity pools like ThorChain that don’t require peg tokens at all?


tBTC represents the bleeding edge of permissionless non-custodial peg models that seek to lower overall trust requirements. To date, tBTC has had strong support from industry leading partners that will no doubt fortify tBTC’s role in the wider DeFi ecosystem.

While the tBTC mainnet has only just launched with the public signers only coming online from next month, there are still some critical open questions namely the economic incentives for signers as well as the impact of a black swan events on the system. It is important to emphasise that tBTC is extremely experimental and is subject to change in the future. When the network matures and the tBTC peg model has been battle tested, future versions of tBTC may one day be controlled by its own community - only until the network is governed by the network participants themselves can the KEEP Network fully achieve its decentralised ambitions.

Evolution takes time, and patience.


tBTC Whitepaper
tBTC Technical Overview
Threshold Signatures
Setting up a Keep Network node

Formal Verification research is not investment advice and is strictly for informational purposes only. Conduct your own research.