Bitlayer
About
Bitlayer is a Bitcoin Layer 2 solution that combines Bitcoin's security with EVM compatibility, serving as infrastructure for Bitcoin-based financial applications (BTCFi). It's described as the first rollup solution purpose-built for Bitcoin, introducing Turing-complete programmability while being fully compatible with the Ethereum Virtual Machine (EVM). The platform enables developers to build and migrate decentralized applications from Ethereum while leveraging Bitcoin's security foundations.
Where Does Yield Come From?
Bitlayer's yield system works through something called the YBTC.B vault. Users deposit their Bitcoin (BTC) into this vault. The vault then puts that Bitcoin to work in various strategies to earn more Bitcoin.
The deposited funds are spread across different types of earning strategies. These include:
- On-chain DeFi activities like providing trading liquidity on decentralized exchanges (DEXs), lending and borrowing (earning the difference between rates), and yield farming.
- Off-chain quantitative trading strategies such as taking advantage of price differences between spot and futures markets (arbitrage), using risk-balancing techniques (hedging), and capturing funding rate payments.
- Fixed-income products that involve tokenized real-world assets, like government bonds.
All these strategies aim to generate returns that are paid out in Bitcoin.
Several institutional partners manage these strategies:
- Blockin Capital runs quantitative trading and market-making activities with dynamic risk management (hedging).
- Jupiter handles decentralized exchange aggregation and perpetual contracts, sharing 70% of trading fee revenue with liquidity providers.
- Folks Finance enables cross-chain lending and borrowing.
- Plume connects to tokenized real-world assets such as government bonds.
- Sui and Navi provide the underlying high-performance blockchain infrastructure and lending services.
The overall approach combines both on-chain decentralized finance activities and off-chain institutional strategies. When the earning cycles finish, users get back their original deposit plus the earned interest, all in Bitcoin.
Audits
| Audit / Date | Findings | Verdict |
|---|---|---|
ScaleBit19-11-2025 |
| The audit found only a centralization risk that was acknowledged by the development team, with no critical or major security vulnerabilities identified in the bridge contracts. |
ScaleBit19-11-2025 |
| The audit found only a single acknowledged centralization risk with no critical or high-severity vulnerabilities, suggesting the bridge implementation is relatively secure but relies on trusted admin controls for key operations. |
SlowMist29-03-2024 - 02-04-2024 |
| The audit found no critical or high severity vulnerabilities, with all medium and low issues addressed before deployment, indicating reasonable security posture for the bridge contracts though reliance on privileged roles remains a design consideration. |
SlowMist13-05-2024 - 14-05-2024 |
| The audit revealed one high-severity vulnerability plus several medium and low risks, all of which were addressed or acknowledged by the development team, resulting in a medium-risk overall assessment for the Bitlayer Bridge Phase 2 contracts. |
SlowMist29-03-2024 - 02-04-2024 |
| The audit identified medium-severity privilege management risks in the bridge's upgradeable architecture, but all findings were addressed before mainnet deployment, resulting in a codebase with acknowledged design considerations for cross-chain security. |
SlowMist13-05-2024 - 14-05-2024 |
| The audit revealed several design logic and authority control issues, with one high-severity vulnerability fixed but residual medium risks acknowledged as acceptable design choices; overall security posture is medium risk with centralized validator dependencies. |
Hacken02-04-2024 - 04-04-2024 |
| The audit found no critical or high severity vulnerabilities, with the single medium issue mitigated and low severity issues either fixed or acknowledged, resulting in a perfect security score of 10/10 and indicating robust contract security post-remediation. |
| Unable to analyze the audit findings as the Hacken.io website consistently timed out, preventing access to the audit report document for Bitlayer's bridge and getBTC functionality. |
Legal
Registration jurisdiction
Singapore
Status and notes
The official GitHub organization (bitlayer-org) lists its location as Singapore. No explicit legal entity name, registration number, or organizational form is disclosed in the accessible documentation, whitepaper, or GitHub profile. The documentation site (docs.bitlayer.org) contains technical content but no dedicated legal/terms sections. Contact email [email protected] is listed on GitHub.