Discreet Log Contracts: Taproot’s Non-Custodial Bitcoin Finance

The year 2026 gave Bitcoin plenty of noise: a soft fork that failed to activate (BIP-110), a running argument about how much data belongs in an OP_RETURN output, and a quantum-computing scare that sent developers scrambling for post-quantum plans. Underneath all of it, one Taproot capability that almost nobody argues about started doing real financial work. It is called the discreet log contract, or DLC, and it is the closest thing Bitcoin has to a native engine for derivatives, lending, and betting. It exists because of the same Schnorr signatures that Taproot shipped in November 2021.

The timing is not a coincidence. Prediction markets are the runaway crypto story of the year: combined trading on Kalshi and Polymarket blew past 50 billion dollars during the 2026 World Cup, a record, and the two platforms are now fighting in United States federal court over whether their sports contracts are regulated swaps or plain gambling. Those venues are custodial, centralized, and mostly not on Bitcoin. DLCs are the mirror image: peer-to-peer, non-custodial, private, and settled on Bitcoin’s base layer. With Bitcoin trading around 77,000 dollars, the most convincing DLC use in 2026 is not betting at all. It is a wave of non-custodial lending built so that the collapses of 2022 never repeat. This is the story of how Taproot quietly handed Bitcoin a contract layer.

What a Discreet Log Contract Actually Is

Strip away the cryptography and a DLC is simple. Two parties (sometimes more) lock funds into a shared Bitcoin output. Later, an independent oracle publishes a signed statement about some fact in the world: a closing price, a match result, an election outcome. That signature behaves like a key, and it unlocks exactly one pre-agreed way of splitting the money. Neither party can move the funds alone, neither can force the wrong outcome, and the settlement transaction that eventually lands on-chain looks like an ordinary spend.

The idea came from Thaddeus “Tadge” Dryja, a co-author of the Lightning white paper, who presented it at Scaling Bitcoin in Stanford in 2017 while working at the MIT Digital Currency Initiative. He called them invisible smart contracts, and the word invisible is the whole point. The contract’s logic never touches the blockchain. Compare that to an Ethereum smart contract, where the code is deployed on-chain for everyone, and every bot, to read and interact with. A DLC pushes all of that logic into signatures that the two parties exchange privately. Bitcoin only ever sees a funding transaction and, at the end, a settlement.

The Schnorr Connection: Why DLCs Needed Taproot

The whole scheme rests on one property of Schnorr signatures, the signature type that Bitcoin adopted in BIP-340 when Taproot activated on 14 November 2021: linearity. A Schnorr signature is, at heart, a sum. That math means you can hand someone an almost-complete signature that is missing exactly one secret number, and it becomes valid only when that number is revealed. Cryptographers call that object an adaptor signature: an incomplete Schnorr signature that completes the instant a specific value appears.

Adaptor signatures are what make DLCs both practical and private. Work by researchers including Lloyd Fournier turned the concept into what the community calls scriptless scripts: enforcing a contract with clever signatures rather than with special Bitcoin script that would sit visibly on-chain. Taproot’s second gift is the funding output itself. A DLC locks money into a 2-of-2 that both parties jointly control. Before Taproot, that looked like a multisig, a visible fingerprint on the chain. With Taproot’s key-path spend and MuSig2 key aggregation, the two keys combine into one, and the funding output becomes indistinguishable from any ordinary single-signature payment to a bc1p address. If you want a primer on those addresses and why they matter, our practical guide to bc1p covers the ground.

DLCs predate Taproot; earlier versions from roughly 2019 to 2021 used adaptor signatures built on Bitcoin’s older ECDSA scheme. They worked, but they were larger and less private. Schnorr made them small, cheap, and effectively invisible. The table below maps the primitives to what each one gives a DLC.

Oracles That Never Know They Were Used

An oracle in a DLC works in two phases. Before the event, it makes an announcement: it publishes a public key, a one-time nonce point, and a description of the event and its possible outcomes. After the event, it makes an attestation: it publishes a single Schnorr signature over the outcome that actually happened, using the nonce it committed to in advance. The two parties built their contract around that announcement, so the attestation is the missing secret that completes exactly one payout.

The elegant part is what the oracle does not do. It broadcasts one attestation to the world; the signature is not addressed to any particular contract, and the oracle has no idea who used it, how much was at stake, or that a contract existed at all. Dryja put it memorably in his original talk, as recounted in coverage of the presentation: “That’s the lonely life of an oracle. You can’t even tell if there was even a contract even after it happens.” An oracle that signs a false outcome, by contrast, produces cryptographic evidence of the lie that anyone can check, so it cannot quietly cheat a single contract without publishing a provably wrong statement for everyone to see.

Oracle infrastructure is a real, if quiet, part of the ecosystem. The firm Suredbits, led by Chris Stewart, built the bitcoin-s library, an oracle application called Krystal Bull, and an Oracle Explorer for publishing and browsing announcements. One early and widely cited DLC demonstration was a wager between Stewart and Nicolas Dorier, the creator of BTCPay Server, on a United States election. The oracle is still a trusted component, and that is the honest caveat of the whole design, but it is a blind, accountable, and replaceable trust. It never touches the coins.

Contract Execution Transactions and the Adaptor Trick

For every possible outcome, the two parties pre-sign a Contract Execution Transaction, or CET, that pays out the way that outcome requires. Each CET is signed with an adaptor signature locked to the oracle’s anticipated signature for that specific result. When the oracle finally attests to the real outcome, exactly one CET becomes completable, and the party it favors can broadcast it. The Bitcoin network sees a normal-looking transaction and has no way to know it was the settlement of a contract.

Naively, a Bitcoin price contract would need a CET for every possible dollar value, which does not scale. The DLC specification solves this with digit decomposition: the oracle signs each digit of the number, so the count of signatures grows with the number of digits, not the number of possible prices, and payout curves group nearby values into ranges. To avoid trusting a single oracle, a contract can require a threshold, say two of three oracles to agree, and settle on the median so that one dishonest or offline oracle cannot swing the result as long as the majority stays honest. All of this happens off-chain. Bitcoin only ever records the funding and the settlement.

How a DLC Differs From an Ethereum Smart Contract

People reach for the phrase “smart contracts on Bitcoin,” but a DLC is almost the opposite of how a smart-contract chain works. On Ethereum, the logic is public bytecode that lives on-chain, executes in the open, and can be called by anyone. In a DLC, the logic lives in private signatures and is settled by a single ordinary-looking transaction. That difference drives everything else.

Two of those rows are the entire 2026 argument for DLCs. There is no contract bytecode to audit or exploit, which sidesteps the audited-yet-hacked pattern that keeps producing eight and nine-figure losses even at firms carrying clean reports, a paradox we traced in CertiK’s August ledger. And because nothing about the contract is visible in the mempool, there is no order flow to sandwich or front-run. The flip side is real too: DLCs are barely composable. Each one is a private deal between two parties, and they do not snap together into the money legos that make DeFi powerful.

Bitcoin’s Lending Reset After the 2022 Collapse

To understand why lending is the first serious DLC market, you have to remember what broke. In 2022, a generation of crypto lenders (Celsius, BlockFi, Genesis) collapsed, and the cause was rarely the loans themselves. It was custody and rehypothecation. These firms took customers’ Bitcoin, lent it out, re-lent the collateral behind it, and could not honor withdrawals when prices turned. Depositors learned the hard way that handing over coins to earn yield meant trusting a black box.

The 2026 rebuild starts from the opposite premise: the lender should never hold the borrower’s coins and should be structurally unable to rehypothecate them. A DLC delivers exactly that. Jay Patel, a co-founder of the DLC lender Lygos, put the priority plainly in launch coverage: “The biggest point in my mind is definitely the rehypothecation piece.” Institutional desks, meanwhile, have increasingly asked for Bitcoin credit with fixed terms and predictable outcomes rather than opaque yield, and deterministic DLC settlement fits that request cleanly.

Lygos, Lava, and the DLC Lending Beachhead

A DLC loan works like this. The borrower locks Bitcoin in a 2-of-2 output shared with the lender. Together they pre-sign a set of CETs across a range of oracle-attested prices: one branch returns the collateral when the loan is repaid, another routes it to the lender if the price falls through a liquidation threshold. There is no margin-call phone tree and no human discretion. The oracle attests the price, and the matching CET settles. The comparison with a DeFi money market is instructive: instead of a public, keeper-run liquidation with its familiar bad-debt tail, which is how DeFi liquidations work, a DLC’s outcome is fixed in advance by signatures both sides already hold.

Two names anchor the 2026 wave. Lygos was formed when Atomic Finance, a DLC pioneer founded by Tony Cai and Matthew Black, folded its technology into an institution-focused lender co-founded by Jay Patel and Francis Corvino; the deal was brokered at Blockspace’s 2025 OPNEXT conference and targets loans from 25,000 to 100 million dollars. Lava, reachable through lava.xyz, aims at individuals with non-custodial DLC loans priced around 5 to 6.5 percent, self-custodied and backed by public proof-of-reserves. A third approach, from DLC.Link, mints a token called dlcBTC that represents DLC-locked collateral for use in DeFi. The table below sets the DLC-based lenders against the custodial and multisig options.

One caution belongs here. “Non-custodial” is a spectrum, not a badge, and the label deserves scrutiny. In 2026, Lava faced pointed questions from users who noticed its consumer app had quietly shifted parts of its custody model. The lesson is to read how the 2-of-2 and the exit paths are actually built, and who can broadcast what, rather than trusting the marketing word. A DLC can be genuinely non-custodial, but only if the construction is.

A DLC Loan, Step by Step

It helps to walk through a concrete case. Suppose a holder wants to borrow 40,000 dollars against Bitcoin worth about 100,000 dollars, a loan-to-value of roughly 40 percent. The borrower and the lender jointly create a funding transaction that locks the collateral into a single Taproot output the two of them control together. Before any money changes hands, they sit down and pre-sign the outcomes.

They build CETs for a ladder of oracle-attested prices. If the loan is repaid on schedule, one CET returns the full collateral to the borrower and the principal plus interest to the lender. If the price of Bitcoin falls toward the level where the collateral barely covers the debt, another set of CETs hands the lender just enough Bitcoin to make itself whole and returns the remainder to the borrower. Each of these is signed in advance with an adaptor signature keyed to what the oracle will later attest. Nobody has to trust anybody to behave, because the only transactions that can ever settle are the ones both parties already agreed to.

When the term ends, or when the price crosses a threshold, the oracle publishes its attestation and exactly one CET unlocks. There is no keeper bot racing to liquidate, no discretionary margin call, and no pool of other people’s deposits standing behind the loan. The borrower never surrenders custody in the sense that broke Celsius and BlockFi; the coins sit in the joint output the entire time. That determinism is exactly what institutional credit desks say they want, and it is why the least glamorous DLC use, a plain overcollateralized loan, is the one finding paying customers first.

The Prediction-Market Boom That Skipped Bitcoin

If lending is where DLCs found traction, prediction markets are the foil that explains why. Kalshi and Polymarket posted their biggest months on record in 2026, with combined volume topping 50 billion dollars during the World Cup, and prediction markets moved from a crypto curiosity to a mainstream financial product almost overnight. The mechanism they sell is exactly the one a DLC provides: stake money on an outcome that a neutral source will resolve.

The difference is who holds the money. Kalshi and Polymarket are custodial venues; they hold the funds and run the order book, and they operate mostly off Bitcoin, on regulated rails or on other chains. A DLC does the same job with no venue in the middle. So why has Bitcoin-native betting not exploded the same way? Because open betting is the hardest thing to build with a DLC. You have to find someone to take the other side, both of you must be online to construct and sign the CETs, the oracle needs liquidity and credibility, and the wallet experience is still rough. Lending sidesteps all of that: the counterparty is a professional lender who is always there, the “bet” is just a price threshold, and the oracle only has to attest a Bitcoin price. Prediction markets as a coordination tool are even spreading into places like settling machine-learning work, as our look at Gensyn describes, but the money in those systems still sits with an intermediary. DLCs are the bet on doing it without one.

The Regulatory Fault Line: Swap, Gambling, or Neither?

United States regulators spent 2026 fighting over precisely the outcomes DLCs settle. On 10 June 2026, the Commodity Futures Trading Commission published a proposed rule on prediction markets and public-interest determinations that would allow most sports event contracts to trade while banning contracts on player injuries, referee decisions, in-game altercations, youth sports, and single-player props, per analysis from Ropes and Gray.

Then the courts split. On 28 August 2026, the Ninth Circuit ruled 3 to 0 that Kalshi’s sports contracts are gambling, not swaps under the Commodity Exchange Act, freeing states to enforce their gaming laws; the panel wrote that “The substance of the sports event contracts offered on Kalshi’s DCM is sports gambling, regardless of whether Kalshi calls them swaps.” That conflicts with a friendlier Third Circuit decision, and a Supreme Court petition was expected within days. The jurisdictional question over even the custodial, registered version of this market is unsettled.

So where does a DLC sit? Awkwardly outside all of it. Kalshi is a registered intermediary that the CFTC and the courts can name, license, and sanction. A DLC between two individuals has no exchange, no clearinghouse, and no custodian, which means there is nothing obvious to license. The CFTC regulates derivatives and event contracts, the SEC regulates securities, and neither has a clean home for a private, non-custodial contract that never routes through a registered venue. The realistic near-term pressure falls on the businesses around DLCs, the lenders and oracle providers, rather than on the primitive. Because a self-custody DLC wallet is not a custodian, it also sits outside the exchange obligations and the crypto travel rule that bind registered platforms. The moment a DLC product starts to resemble a pooled investment or a tradable token, though, the SEC’s securities questions can re-enter through the side door.

Beyond Betting: Derivatives, Hedging, and Insurance

The same machinery is a general-purpose derivatives engine. A payout curve spread across CETs can encode a futures position, an option-like payoff, or a contract for difference; the P2P Derivatives project and the cfd-dlc library were early demonstrations of exactly that. A miner could hedge the hashprice it earns, a merchant could hedge Bitcoin against the dollar, and a farmer could buy parametric insurance in which an oracle attests rainfall and the contract pays out automatically if a drought threshold is crossed. None of these use cases needs a new Bitcoin opcode or a soft fork. They need Schnorr signatures, which are already live, and an oracle willing to attest.

Miners are the most natural early customers for the derivatives version. A mining company earns Bitcoin but pays for power and hardware in dollars, so a sustained price drop can turn a profitable month into a loss. With a DLC, a miner and a counterparty can pre-sign a contract that pays the miner more Bitcoin if the price falls and less if it rises, locking in a floor without handing coins to an exchange or posting margin at a clearinghouse. The same shape covers a merchant who wants to accept Bitcoin but budget in dollars, or a corporate treasury that wants price protection it can audit down to the individual signature.

This is the underrated line in the Taproot story. The 2021 upgrade did not just make payments cheaper and multisig private. It quietly added a way to express financial contracts on Bitcoin without turning Bitcoin into a general smart-contract platform, and without the systemic surface area that comes with one. The expressiveness was always latent in the signatures; 2026 is the year builders started aiming it at products rather than proofs of concept.

DLCs Meet Lightning: PTLCs and Off-Chain Contracts

Adaptor signatures have a Lightning-native cousin: the point time-locked contract, or PTLC, which is designed to replace the hash time-locked contract that routes Lightning payments today. Because a PTLC uses a distinct cryptographic point at every hop, it breaks the payment correlation that HTLCs leak across a route, and it enables so-called stuckless payments, as Bitcoin Optech documents. PTLCs are still largely on paper in 2026, but the groundwork landed underneath them.

Lightning’s dominant implementation, LND, moved Simple Taproot Channels to production in its version 0.21 release in June 2026, putting channels on the same key-path and MuSig2 footing that DLCs use. A DLC can also be executed inside a Lightning channel, keeping the entire contract off-chain until someone actually needs to settle it on the base layer. Research on off-chain, ticketed DLCs points at where this is heading: contracts that never touch the chain unless a dispute forces them to, which is the same trust-minimizing instinct behind the rest of Bitcoin’s scaling work.

The Hard Parts: Liveness, Oracles, and Onboarding

None of this makes DLCs a finished product. The limitations are real, and they explain why a technology from 2017 is only now finding markets.

• Interactivity: both parties must be online to construct and pre-sign the CETs. That is fine for a loan set up once, and painful for spontaneous betting.
• Counterparty discovery: someone has to take the other side. Lending solves this with a professional lender; open markets have no such anchor.
• Oracle dependence: DLCs remove custody, not trust. You still rely on an oracle to attest honestly, and multi-oracle setups reduce that risk only at the cost of more complexity and more signatures.
• Storage and exit: parties must keep their CETs safe and broadcast the correct one, and unilateral exit costs on-chain fees for every contract.

These frictions are why DLCs stayed a research favorite for years while the products lagged. The cryptography was ready in 2017; the oracle liquidity, the wallets, and the business models were not. Lending is simply the first place all three lined up at once.

What Taproot’s Contract Layer Means Now

The Taproot developments that made headlines in 2026 were the fights: the soft fork that failed to activate, the running war over data in OP_RETURN, and the quantum-computing clock that has developers drafting migration plans. The capability that may matter more got almost no airtime, precisely because it works quietly and looks like a normal payment on-chain. Taproot outputs settled into a steady share of Bitcoin transactions after a 2024 spike driven by Ordinals and Runes, and a growing slice of that spare expressiveness is now pointed at finance rather than speculation.

With Bitcoin near 77,000 dollars, the primitive is Bitcoin-native, non-custodial, and private, and the wedge is lending, where a stable counterparty and a simple price oracle make the hard parts manageable. If prediction markets are the loud, custodial version of betting on an outcome, DLCs are the quiet, self-custodied one. In a year defined by Bitcoin’s arguments about what it should become, adaptor signatures answered a narrower and more useful question: what it can already do.

Frequently Asked Questions

What is a discreet log contract (DLC) in Bitcoin?

A DLC is a contract between two or more parties that redistributes their locked Bitcoin based on a real-world outcome reported by an oracle, with no custodian and without publishing the contract terms on-chain. It was proposed by Tadge Dryja in 2017, settles on Bitcoin’s base layer, and, thanks to Taproot, looks like an ordinary payment.

How does Taproot make DLCs better?

Taproot shipped Schnorr signatures, whose linearity enables the adaptor signatures that DLCs are built on. Taproot’s key-path spend also lets the two-party funding output combine into a single key, so a DLC becomes indistinguishable from a normal single-signature bc1p payment, which lowers fees and improves privacy compared with the older ECDSA-based approach.

Are DLC-based Bitcoin loans really non-custodial?

In a properly built DLC loan, your Bitcoin sits in a 2-of-2 output that neither the lender nor any custodian can move alone, and it cannot be rehypothecated. Providers such as Lygos and Lava use this model. Even so, non-custodial is a spectrum, and you should verify how the multisig and exit paths are constructed, because at least one provider was questioned in 2026 over a quiet change to its custody model.

How are DLCs different from prediction markets like Kalshi and Polymarket?

Prediction markets are custodial venues that hold your funds and run the order book, and most of them operate off Bitcoin. A DLC does the same job, staking on an outcome an oracle resolves, but peer-to-peer with no venue holding the money. The trade-off is that a DLC requires you to find a counterparty and for both sides to be online, which is why lending, not open betting, is the first real use.

Do DLCs need a Bitcoin soft fork or a new opcode?

No. DLCs run on features Bitcoin already has: Schnorr signatures from the 2021 Taproot upgrade and adaptor signatures built on top of them. There is no contract code deployed on-chain and no consensus change required, which is part of why DLCs avoid the smart-contract audit and exploit risks common on other chains.

Marcus Okafor covers Bitcoin’s base layer and Lightning for HOGE Wire.