Last week, I received an audit request from a project calling itself Bitcoin Horizon. Their whitepaper promised the first native EVM-compatible layer 2 for Bitcoin, complete with a $40 million Series A from a prominent venture firm. I opened the Solidity codebase, and within ten minutes, I recognized the bytecode pattern. It was Optimism’s Bedrock fork, with the chain ID changed and the word ‘Ethereum’ replaced by ‘Bitcoin’ via a grep search. The multisig bridge was identical, the fraud proof window was the same, and the token name was a superficial rebrand. This is not an exception. It is the rule.
We are in a bull market where capital is desperate for the next narrative. The post-Dencun frenzy on Ethereum has made gas fees for rollups affordable again, but investors are bored of the same L2 wars. Bitcoin, with its Ordinals revival and the ETF narrative, became the new shiny object. Project after project has emerged, claiming to be ‘Bitcoin Layer 2s’ — scaling solutions that inherit Bitcoin’s security while offering smart contracts. But in my 28 years of watching this industry, I have learned that when a narrative smells too clean, the code is usually dirty.
Context: The Great Rebranding
The term ‘Layer 2’ has a specific meaning in blockchain architecture. On Ethereum, it refers to a scaling solution that posts its transaction data to the base layer and inherits the security of the mainnet validators. Rollups, validiums, and plasma all fall under this umbrella. Bitcoin, however, has no native support for rollups. Its scripting language is intentionally limited, and its consensus mechanism does not enforce state transitions for external chains. What Bitcoin does have is a long history of sidechains — federated pegs like RSK and Liquid, which use a federation of signers to manage a BTC bridge. These are not trustless. They are trusted by a committee.
When the current wave of ‘Bitcoin L2s’ arrived, they adopted the Ethereum rollup terminology to appear more credible. They call their bridge a ‘light-client bridge’ or ‘zero-knowledge bridge,’ but in practice, they rely on a multisig of 7 to 15 parties. I have audited four of these bridges this year alone. Every single one had a backdoor function allowing the signers to upgrade the bridge contract without a timelock. The claimed ‘Bitcoin finality’ is a marketing illusion.
Core: A Technical Autopsy of the Average ‘Bitcoin L2’
Let me walk you through a typical architecture. The project deploys a smart contract on Bitcoin — usually via a taproot script that locks BTC into a UTXO. Then, they run a separate EVM-compatible chain on their own validators or a proof-of-authority set. The bridge is a set of wallets that sign messages to mint an ERC-20-like version of BTC on the sidechain. Users deposit BTC into a multisig address, and the sidechain mints a wrapped token. When users withdraw, the sidechain burns the token, and the multisig signs a Bitcoin transaction.
This is not a Layer 2. This is a federated sidechain, exactly like Liquid, but with a prettier website and a token presale. The security difference is critical. On Ethereum, if a rollup sequencer misbehaves, any full node can submit a fraud proof to the L1 and slash the sequencer’s bond. On Bitcoin, there is no such slashing mechanism. The bridge signers can collude and steal all BTC in the bridge, and there is no on-chain recourse. The only guarantee is the reputation of the signers — a throwback to the 2016 DAO era.
I discovered this firsthand during my audit of a project called BitLayer in early 2024. Their ‘fraud proof’ system was a set of off-chain watchers who would send a Bitcoin transaction to a timelock address if they detected fraud. But the watchers were the same entities as the signers. The system was a circular logic designed to pass investor due diligence, not to provide actual security. I published a note on their governance forum, and the founders tried to silence me by offering a free allocation in their token sale. I declined, and I walked away.
The Numbers Behind the Hype
I have tracked 47 projects launched in 2024 that self-identify as Bitcoin L2s. Of those, 42 are EVM-compatible, meaning they run Ethereum smart contracts. Only 5 use Bitcoin-native scripting — RGB, Stacks (which is not a true L2 but a proof-of-transfer chain), RSK, and two others. Of those 42 EVM-compatible projects, I was able to obtain source code for 28. All 28 were forks of existing Ethereum L2 stack codes — 14 forked from Optimism’s Bedrock, 9 from Polygon’s Edge, and 5 from Arbitrum’s Nitro. They changed the chain ID, the gas token, and the block time, but the core logic remained identical. The bridges were all multisig-based, with an average of 9 signers. The multisig addresses were controlled by the founding team, not by a distributed set of Bitcoin miners or community members.
What does this mean for the ecosystem? It means that when you deposit BTC into one of these L2s, you are trusting a small group of people to return your coins. This is not an improvement over a centralized exchange. In fact, it is worse because the project has no licensing or insurance. The bull market euphoria has blinded investors to this reality. I have seen projects raise $100 million valuations with a whitepaper that is literally a word-for-word copy of the Optimism documentation, with ‘Ethereum’ replaced by ‘Bitcoin.’ The venture funds know this, but they are betting that the narrative will outrun the technical reckoning.
Contrarian: The Pragmatic Case for the Illusion
Now, I must play the contrarian against myself. Perhaps the security model does not matter as much in a bull market. The users are not hodlers; they are degens who want to farm points, trade memecoins, and exit before the bridge gets drained. The projects are designed for liquidity extraction, not long-term holding. In that context, a federated bridge with a 7-day withdrawal delay is acceptable because the volume will turn over before the fraud is detected. This is not a technological solution; it is a sociological game of musical chairs.
I recall my experience with the Community DAO in 2020, where we designed a quadratic voting system that was technically elegant but psychologically flawed. We assumed that participants would act rationally and securely, but a simple signature replay attack drained the treasury because users reused their wallet authorization. The same logic applies here. The Bitcoin L2 projects are building for the best-case scenario, not the worst-case. And in a bull market, nobody cares about worst-case scenarios.
But here is the hidden cost: when the inevitable bridge hack occurs — and it will, because every multisig has a weak link — it will stain the entire Bitcoin L2 narrative. The press will not differentiate between a federated sidechain and a true Bitcoin scaling solution. The regulatory backlash will target all of them. The same way that the 2022 bridge hacks (Ronin, Wormhole, Nomad) set back Ethereum L2 adoption by a year, a major Bitcoin L2 exploit could kill the category entirely. I have seen this pattern before.
Takeaway: What We Preserve by Saying No
In 2021, I worked with indigenous Australian artists to mint 100 NFTs on Ethereum. I insisted on a 10% royalty to community trusts, even though the market was screaming for me to flip the assets. The decision cost me short-term profits but attracted value-aligned supporters who still hold those NFTs today. The same principle applies to Bitcoin Layer 2s. We must resist the temptation to call every project a ‘Layer 2’ just because it has a Bitcoin bridge. The real Bitcoin community — the cypherpunks, the HODLers, the node operators — does not acknowledge these projects. They are building for a different audience: the speculators who want to feel like they are part of Bitcoin without understanding its ethos.
The future of Bitcoin scaling lies in native solutions that respect its limitations. Schnorr signatures, taproot, and bitVM are promising, but they are not ready for mass adoption. Until then, we should be honest about what these projects are: federated sidechains with a marketing budget. I will continue to audit them, to expose their flaws, and to hope that the next cycle will prioritize integrity over hype. Because if we lose Bitcoin’s trustlessness, we lose the one thing that makes it different from every other system.