Taproot’s Second Act: How BitVM and Citrea Built Bitcoin Rollups

When Bitcoin activated Taproot in November 2021, the sales pitch was modest. Schnorr signatures would make multisignature spends look like ordinary single-key payments, complicated spending conditions would hide inside a Merkle tree until the moment they were used, and the average transaction would get a little cheaper. Almost five years later, the upgrade has taken a job that appeared in no brochure. Taproot is now the foundation under a small industry of Bitcoin rollups, trust-minimized bridges, and a research program called BitVM that claims Bitcoin can verify almost any computation without changing a single consensus rule.

The backdrop is loud. Bitcoin traded around $79,700 on 25 August 2026, up sharply on the month, according to CoinGecko, after Washington pushed forward on crypto market-structure legislation and the Treasury expanded its bond buybacks; Fortune tracked the coin punching past $75,000 on 21 August as those catalysts landed. The more interesting development, though, is not the price. It is that a startup named Citrea switched on the first production zero-knowledge rollup to settle directly on Bitcoin in January 2026, and that its bridge can keep user funds safe as long as just one participant out of many stays honest. Both facts trace back, in a straight line, to Taproot.

This is the story of Taproot’s second act: how a quiet 2021 soft fork became the load-bearing wall under Bitcoin’s 2026 experiment in programmability, why the whole design leans on one obscure rule change buried inside a BIP, and whether any of it survives a brutal year for Layer 2 tokens.

Bitcoin was built so it could not compute

Bitcoin’s scripting language is weak on purpose. It has no loops. It cannot multiply two numbers, because Satoshi disabled a batch of arithmetic and string opcodes in 2010 after a spate of bugs. It has no general memory and no notion of persistent state between transactions. Those were safety choices. A blockchain that every node on Earth must re-validate cannot allow transactions that quietly run heavy, open-ended programs, because every validator would have to run them too. The price of that safety is that Bitcoin, unlike Ethereum, ships no on-chain virtual machine and no built-in shortcut for checking a cryptographic proof.

That gap is exactly why Bitcoin missed the decade of decentralized finance that grew up on Ethereum and its rollups. If you want lending, trading, or a stablecoin engine, you need programmability, and the base layer refuses to give it to you. For years the only answers were federated sidechains and custodial wrapped-Bitcoin tokens, both of which ask users to trust an outside group with their coins. The engineering challenge of 2026 is to get real programmability with Bitcoin-grade trust assumptions instead, and that challenge runs through Taproot.

BitVM: verify the work, do not do the work

In October 2023 a developer named Robin Linus published a paper with the immodest title BitVM: Compute Anything on Bitcoin. The trick was to stop trying to run computations on Bitcoin and instead only to verify them, the same optimistic logic that powers Ethereum rollups. One party, the prover, claims that some function f applied to an input x yields an output y. If the claim is honest, nothing touches the chain at all. If the claim is a lie, any challenger can force an on-chain fraud proof that punishes the prover, using nothing but the opcodes Bitcoin already has. Academics later formalized the construction as quasi-Turing-complete computation on Bitcoin, and the key selling point never changed: no soft fork, no new opcode, no permission required.

The contrast with Ethereum is stark, and Citrea’s own founders draw it. Ethereum long ago added a precompile, a native shortcut, for checking the kind of succinct proof that rollups produce; smart accounts and delegated execution have since become routine there, as covered in our look at EIP-7702 and the smart-account switch. Bitcoin has nothing of the sort. BitVM is the workaround: rather than asking miners to check a proof, it lays the entire proof-checking program out on the chain in advance, split into pieces, and dares anyone watching to point to a single step that was done wrong. Get one step wrong and you lose your bond. That single-step spotlight is what makes an honest claim cheap and a dishonest one fatal.

The glue that holds it together is a commitment trick. Because Bitcoin Script has no shared memory, BitVM uses bit-value commitments, small hash puzzles that force the prover to reveal a consistent zero or one for every wire in the computation across many separate transactions. Reveal both the zero and the one for the same bit and you hand a challenger the secret that lets them take your money. That penalty is what stitches thousands of tiny, stateless Bitcoin scripts into something that behaves like one large, cheat-resistant program.

The one rule change that made BitVM possible

Here is the part almost no headline mentions. BitVM does not work on legacy Bitcoin Script, and it does not work on the SegWit scripts that came before Taproot. It works because Taproot quietly deleted two limits that would otherwise make the whole scheme impossible. The relevant rules live in BIP-342, the Tapscript half of the Taproot upgrade.

Legacy Bitcoin scripts are capped at 10,000 bytes and at 201 non-push operations each. A program that checks a Groth16 zero-knowledge proof, the workhorse BitVM verifies, is vastly larger than that, running to hundreds of thousands of operations. Under the old rules it simply could not exist as a spendable script. According to BIP-342, Tapscript removes both ceilings: the maximum script size of 10,000 bytes no longer applies, bounded now only by the block weight limit, and the 201 non-push opcode limit no longer applies either. Tapscript swaps the blunt block-wide signature cap for a per-input budget and reserves a family of OP_SUCCESS opcodes for future upgrades. Layer that on top of Taproot’s core feature, the taptree that commits to a whole forest of alternative scripts while revealing only the one branch you actually spend, and you have the exact toolkit BitVM needs: enormous programs that stay hidden until the instant a dispute forces one leaf into the open.

Read that table twice. Taproot was marketed as a privacy and fee upgrade, and it delivered those, but the feature that turned out to matter most for 2026 was the boring removal of a size cap. Without it, there is no BitVM, no permissionless Bitcoin bridge, and no Citrea.

From a two-player game to a permissionless one

The first version of BitVM in 2023 had a serious catch: it was a duel. The fraud-proof game ran between exactly two pre-committed parties, a prover and a designated verifier, chosen in advance. That is fine for a payment channel but useless for a public bridge, where you want the whole world to be able to catch a cheat. The 2024 sequel, BitVM2, fixed that. It made the challenge permissionless: any user running a Bitcoin full node can step in and disprove a fraudulent claim, not just a chosen counterparty.

Mechanically, BitVM2 encodes the SNARK verifier into a taptree, chops the verification into sub-programs small enough to fit inside single Bitcoin transactions (each capped at a few megabytes), and arranges a set of disprove scripts so that any incorrect assertion can be punished by spending one of them. It shifts most of the heavy lifting onto whoever challenges, which keeps the honest path small and cheap. That design opened the floodgates. A cluster of startups now builds bridges and rollups on the same primitive, among them BOB, Babylon, Alpen, Bitlayer, Fiamma, and Citrea. What they share is not a token or a marketing story; it is a dependence on Taproot’s uncapped scripts.

Citrea turns the theory on

Citrea is the project that took BitVM out of the whiteboard stage. On 27 January 2026 it launched what The Block and crypto.news both described as the first production zero-knowledge rollup to settle directly on Bitcoin. Users transact on an Ethereum-compatible environment, so ordinary Solidity contracts run unchanged, while Citrea posts both its transaction data and its validity proofs down to the Bitcoin base layer. The rollup shipped with a dollar stablecoin called ctUSD and a bridged Bitcoin representation called cBTC, aimed at two core products: Bitcoin-backed lending and structured products. It opened with roughly 30 applications and, being early, a modest total value locked of about $1.7 million.

The company behind it, Chainway Labs, was founded in 2022, with Citrea spun out in 2023 by Orkun Mahir Kılıç, Murat Karademir, and Esad Yusuf Atik. It has raised around $17 million, headlined by a $14 million Series A led by Founders Fund, with Galaxy and Maven11 among the backers. Kılıç, the chief executive, is blunt about how much harder Bitcoin is to build on than Ethereum. In an interview with House of ZK he put it plainly: on Bitcoin, he said, the team has to build everything from scratch, sequencers, proof aggregation, light clients, and even contribute to BitVM development. He framed the payoff in the same breath: Ethereum has a precompile for verifying ZK proofs, while Bitcoin requires workarounds like BitVM to achieve the same thing, and rollups, unlike sidechains, are directly tied to Bitcoin’s security model.

The product vision is deliberately narrow. Citrea is not chasing gaming or social apps; the applications Kılıç highlights are the ones that need Bitcoin specifically: decentralized exchanges, Bitcoin-backed stablecoins, Bitcoin-backed loans, and prediction markets. To seed them, the team launched Citrea Origins, an incubation program for developers, and set up the Citrea Foundation to distribute grants and fund research. The wager is that a smaller catalog of genuinely Bitcoin-native products will outlast the general-purpose chains that spent 2026 fighting over the same thin liquidity.

Clementine: a bridge that needs one honest party

Every Bitcoin Layer 2 lives or dies on its bridge, because that is where the real coins sit. The historical record is grim: most of crypto’s largest thefts have been bridge hacks, usually because a small federation held the keys. Citrea’s answer is Clementine, a bridge built on BitVM2 and described in an academic whitepaper as collateral-efficient, trust-minimized, and scalable. Its headline property is a one-of-N honesty assumption. As long as a single honest Signer and a single honest Watchtower remain in the set, an incorrect peg-out cannot succeed, and funds can only follow spending paths that were pre-approved at setup.

In practice a deposit is the easy direction: a user locks Bitcoin into the bridge and receives cBTC on the rollup to spend in applications. The hard direction is the exit, and that is where BitVM earns its keep. When a user withdraws, an operator fronts them the Bitcoin right away and later reclaims it from the locked pool, but only by publishing a proof that the rollup really owed that payout. If the operator lies, the fraud-proof game lets any watcher disprove the claim on Bitcoin and seize the operator’s bond, which is why a single honest participant is enough to keep the whole system sound.

The mechanism leans on a purpose-built Bitcoin light client that stays secure against any adversary controlling less than half of Bitcoin’s hash rate, provided at least one Watchtower in the permissioned set publishes the finalized, canonical header chain. Compare that to a five-of-nine multisig federation, where compromising five key holders drains everything, and the improvement is real: a thief must corrupt every single participant, not a majority. It is not magic. Clementine still asks operators to lock up capital and to run infrastructure, and the security rests on that light-client and majority-hash-rate assumption rather than on Bitcoin consensus alone. But it is a categorically better trust story than the wrapped-Bitcoin tokens it competes with.

The block space debate comes back

Nothing on Bitcoin is free of politics, least of all anything that consumes block space. Citrea posts its checkpoints to Bitcoin as compact OP_RETURN commitments, one transaction attesting to thousands of rollup operations rather than thousands of individual writes. Even so, at one point during its testnet the rollup’s data-availability footprint alone accounted for close to 10 percent of Bitcoin’s monthly data bandwidth, according to Cointelegraph. That reopened the same fight that has simmered since the Ordinals boom and the OP_RETURN wars over how much data the base chain should carry.

Jameson Lopp, chief security officer at Casa and a long-time Taproot commentator, welcomed the experiment, calling Citrea’s rollout the next grand experiment in generating sustainable demand for block space. Skeptics were less charmed. One widely shared critique noted that Citrea users are not actually lending or trading on Bitcoin at all; they do that on Citrea’s own EVM, with Bitcoin merely storing the proofs, which reduces the base chain to a filing cabinet for rollup receipts. It is the same argument that has followed Bitcoin’s data-heavy uses all year, from the inscription mania documented in our piece on Ordinals and the flight to Bitcoin’s blue chips to the token protocols we compared in Runes versus Taproot Assets. The through-line is that Taproot keeps enabling uses that some Bitcoiners never wanted, and the network has no way to say no.

Citrea is not alone

The BitVM idea spread fast, and by 2026 several teams were racing to turn it into product. Bitlayer shipped a BitVM Bridge to mainnet in July 2025, per CoinDesk, pairing a one-to-one wrapped token called YBTC with a front-and-reclaim model in which brokers hand users their Bitcoin within about an hour while they wait out a seven-day security window. BOB took a hybrid path and now reports tens of millions of dollars bridged and steady daily transaction counts. Others, including Alpen and Fiamma, are building on the same BitVM2 primitive, while Stacks and Botanix reach programmability by different routes that do not use BitVM at all.

Figures in the table move constantly and should be read as a snapshot, not a scoreboard. The important pattern is architectural: the BitVM cohort (Citrea, Bitlayer, BOB, Alpen, Fiamma) all inherit the Taproot dependency, while the older designs (Stacks, Botanix) reach programmability through sidechain-style trust that predates it.

The reality check: a 74 percent haircut

All of this is happening in the worst possible market for it. Bitcoin Layer 2 total value locked shrank by more than 74 percent over the year, and even the broader Bitcoin DeFi category slipped, falling from roughly 101,700 BTC to about 91,300 BTC, which is under half a percent of all the Bitcoin in existence. CoinDesk called it a bear-market reality check, and in August the same outlet described a broader, dot-com-style shakeout with more than 100 projects folding in 2026. Most Layer 2 launches became ghost towns the moment their airdrop farming ended.

Kılıç, whose own project has to survive that winnowing, does not pretend otherwise. The market and the technology are both maturing, he told CoinDesk, investment is a lot slower and more cautious now, and only projects with sound business models and a clear problem statement will survive. He has also warned Bitcoin Layer 2s to stop pitching themselves as general-purpose chains: trying to do the same things as Solana on day one, he argued, makes no sense, and the survivors will be the ones building products uniquely enabled by Bitcoin’s security and settlement. In a year that punished hype, that is either discipline or a survival strategy, and probably both.

What BitVM still cannot do cheaply

It is worth being honest about the limits, because the marketing rarely is. BitVM is trust-minimized, not trustless. As developers have repeatedly pointed out, there is no way on-chain to prove that an honest watcher actually exists in the set; you assume one does. Decrypt captured the mood of working engineers in a headline that asked whether BitVM is the holy grail of Bitcoin and answered, from the developers it interviewed, that it is complicated. Beyond that honesty caveat, the operational costs stack up:

• Heavy setup: a pre-signing ceremony has to fix every allowed spending path before a single coin moves.
• Expensive disputes: when a fraud proof actually fires, the disprove transactions are large and consume real block space.
• Locked collateral: operators must post bonds and front liquidity to users, tying up capital.
• Bear-market fragility: that capital cost is brutal in a year when most Layer 2 tokens are down and yields have thinned.

Robin Linus himself has been careful about scope. Rather than pitching BitVM as a general world computer, he has framed its realistic near-term use as a trust-minimized bridge, the narrow job of moving Bitcoin to and from a second layer with as few trusted parties as possible. That is a big deal on its own, since bridges are where the money and the hacks both concentrate, but it is a long way from the maximalist promise of computing anything on Bitcoin. The gap between the paper title and the shipping product is the gap this next chapter is trying to close.

BitVM3 and the garbled-circuit leap

The cost problem is the one everyone is now attacking, and the leading answer arrived in May 2026 as BitVM3, a paper from Robin Linus Woll and collaborators. It replaces BitVM2’s dispute machinery with a design based on garbled circuits, a decades-old cryptographic technique borrowed from secure multiparty computation, and it claims to cut worst-case on-chain dispute costs by close to a thousandfold while adding a formal security framework and explicit support for Bitcoin rollups. Blockworks reported the promise with the appropriate caveat that it is not production-ready yet.

Citrea is already chasing the same idea in its bridge. Its research on Clementine v2 uses garbled circuits and a scheme it calls TOOP to try to eliminate the collateral and liquidity requirements that make the current bridge capital-hungry. If those approaches ship, the economics of a Bitcoin bridge could change from something only well-funded operators can run to something far cheaper and more competitive. That, more than any token price, is the metric to watch: the day a trust-minimized Bitcoin bridge costs an operator little more than an ordinary hot wallet is the day this architecture stops being a science project.

Where the SEC actually has a say

For a United States reader, the regulatory question sorts cleanly into two boxes. Taproot itself, BitVM, and the activation of any future soft fork sit outside the Securities and Exchange Commission’s remit entirely; the agency neither approves nor blocks a change to Bitcoin’s consensus rules, any more than it votes on a software release. The bite is downstream. A rollup token, a governance token, or a yield-bearing bridge product can absolutely draw securities scrutiny, and a custodian offering exposure to any of these has to answer for how it holds and prices them.

The politics happen to be tilting friendly at the moment, which is part of why Bitcoin rallied into the high $70,000s in August. Momentum on federal market-structure legislation, alongside a proposed offering framework and Treasury bond buybacks, drove the move, and readers tracking those deadlines can follow them in our crypto regulatory countdown. A clearer rulebook would matter more for Bitcoin DeFi than for almost any other corner of crypto, because the whole pitch of a trust-minimized rollup is that institutions can use Bitcoin without handing custody to an intermediary. Rules that recognize self-custodial and trust-minimized designs, rather than lumping them in with centralized wrapped tokens, would decide how much of that promise is usable in practice.

The security bill: 51 percent assumptions and a quantum clock

Every trust-minimized bridge ultimately rents Bitcoin’s own security, and that rent has terms. Clementine’s light client is safe only against an adversary holding less than half the network’s hash rate, which is the same 51 percent assumption that underpins Bitcoin itself. That assumption has grown sturdier as hashing power has climbed toward record highs, a trend we traced in our report on Bitcoin’s hashrate growth toward two zettahashes; a cheaper, weaker network would make every BitVM bridge more fragile at once. Security here is not a fixed property of the code. It is a live, market-priced quantity that rises and falls with mining economics.

There is a longer-dated cloud too. BitVM and Clementine lean heavily on Taproot outputs, and a Taproot output publishes its full public key on-chain from the moment it is created, which is exactly the exposure that a future cryptographically relevant quantum computer would target. Google researchers narrowed their estimate of the resources such an attack would require earlier in 2026, and Bitcoin developers responded with a set of post-quantum migration proposals. None of that is an emergency for a bridge going live today, but any protocol that parks large sums in Taproot outputs for years is quietly betting that Bitcoin migrates to quantum-resistant signatures before the threat arrives. It is a bet the whole ecosystem is making together, BitVM builders included.

Taproot’s second act, and what comes next

Step back and the shape of the story is almost ironic. Taproot was pitched to the Bitcoin community as a conservative, privacy-preserving efficiency upgrade, the kind of change that would barely be noticed. The feature that ended up mattering most was not Schnorr signatures or the elegance of the taptree; it was the unglamorous decision to stop capping how big a script can be. That one line in BIP-342 is what let Robin Linus imagine BitVM, what let BitVM2 make fraud proofs permissionless, and what let Citrea put a working zero-knowledge rollup and a one-of-N bridge on top of Bitcoin without asking the network to change again.

Whether this becomes Bitcoin’s DeFi era or a well-engineered footnote depends on numbers that are moving the wrong way right now: total value locked is down hard, most Layer 2 tokens have cratered, and the cheapest version of the technology, garbled circuits and BitVM3, is still in the lab. But the direction is unmistakable. Five years after a quiet soft fork, Bitcoin can host a rollup that settles to its own chain and a bridge that only needs one honest guardian, and it can do so on rails that were already there in 2021. Taproot’s first act was privacy. Its second act, it turns out, is programmability, and that act is only getting started.

Frequently Asked Questions

What does Taproot have to do with Bitcoin rollups?

Taproot’s Tapscript rules, defined in BIP-342, removed the old 10,000-byte script size limit and the 201-opcode limit, and Taproot’s taptree lets a transaction commit to a huge set of scripts while revealing only the branch it spends. Those changes are what let BitVM encode a full zero-knowledge proof verifier on Bitcoin, which is the basis for rollups like Citrea. Without Taproot, the scripts BitVM needs would be too large to exist.

What is BitVM in simple terms?

BitVM, proposed by Robin Linus in 2023, is a way to verify off-chain computations on Bitcoin without changing its consensus rules. Instead of running a program on-chain, a prover claims a result, and if the claim is false any challenger can trigger an on-chain fraud proof that seizes the prover’s bond. BitVM2 made that challenge permissionless, so any full-node user can catch a cheat, which is what makes trust-minimized bridges possible.

Is Citrea really the first ZK-rollup on Bitcoin?

Citrea launched its mainnet on 27 January 2026 and was described by The Block and crypto.news as the first production zero-knowledge rollup to settle directly on Bitcoin, posting both data and validity proofs to the base chain and pairing them with a BitVM2 bridge called Clementine. Other Bitcoin Layer 2s exist, including Bitlayer, BOB, Stacks, and Botanix, but they use different designs, and not all of them are ZK-rollups.

How safe is a BitVM bridge like Clementine?

Clementine uses a one-of-N honesty model: as long as a single Signer and a single Watchtower stay honest, an incorrect withdrawal cannot succeed, so a thief would have to corrupt every participant rather than a majority. That is much stronger than a typical multisig federation, but it is trust-minimized, not fully trustless. Its safety also depends on a light client that assumes no attacker controls more than half of Bitcoin’s hash rate.

Does the SEC regulate Taproot or BitVM?

No. The SEC does not approve or block changes to Bitcoin’s protocol, including Taproot or any BitVM-based design; consensus rules sit outside its jurisdiction. Where the agency can act is downstream, over tokens, yield products, or custodial services built on top of these systems. For US users, the practical regulatory questions are about products and custody, not about the underlying cryptography.

By Marcus Okafor, senior markets writer at HOGE Wire, covering Bitcoin infrastructure and Layer 2 protocols.