At 13:53 UTC on 6 September 2026, a single transaction in what was then block 4,050,336 of the Liquid Network created about 4,000 L-BTC with nothing behind them. Thirty-five minutes later the federation that guards Liquid’s reserve did exactly what its software told it to do: it released 3,996.02 real bitcoin on the main chain. No signer’s key had been stolen. Blockstream’s own incident report puts it in one line: “No reviewer, internal or external, identified this risk prior to exploitation.”
That afternoon is the best introduction to the question behind every Bitcoin layer 2: when your coins leave the main chain, who decides whether you get them back? Lightning, Liquid, Rootstock, Stacks, Citrea, Ark and a dozen newer “BTC L2” chains all get the same label in exchange listings and press releases. They do not offer the same answer. This lesson gives you one test and runs every design through it, with the figures as of 9 November 2026.
It follows the previous lesson of the path, Ordinals, Runes and BRC-20, which showed how much activity now competes for Bitcoin’s block space. Layer 2s and sidechains are the other answer to the same scarcity: move the activity elsewhere and come back to the main chain only to settle.
The exit test: what a Bitcoin layer 2 really means
On Ethereum the word layer 2 has a fairly precise meaning. A rollup posts its data to Ethereum and a contract on Ethereum checks proofs, so users can withdraw even if the rollup’s operator disappears. Our guide on layer 1 versus layer 2 explains that model, the “stages” used to rate rollups and the bridge hacks that showed its weak spots. Bitcoin cannot copy it. Its Script language cannot verify a validity proof or run a general-purpose contract, so every Bitcoin system that holds coins off the main chain has to find another way to let people out.
Coindaro’s working definition is therefore built on the exit. A system is a layer 2 in the strict sense when you can take your bitcoin back on the main chain with a transaction you can publish yourself, without anyone’s permission, even if every operator vanishes or turns hostile. A sidechain is a separate blockchain with its own rules and its own block producers, where bitcoin is locked on the main chain and released by a group of signers. Many projects sit between the two, and the honest description of each one names who can block or steal your exit.
Four questions turn the definition into a checklist. Who holds the bitcoin while it is away, and how many of them would have to fail or collude? Is the data you need to prove your balance available to you, or only to the operator? Who produces blocks or processes payments, and can they censor you? And what makes a transaction final: Bitcoin’s proof of work, or the signature of a committee?
Those four questions are not ours alone. On 1 June 2024 a researcher posting as janusz proposed a risk framework on a forum used by Bitcoin developers, starting from the observation that “Bitcoin does not have a unified scaling roadmap.” The author was building Bitcoin Layers, a site that applies the framework. Its methodology page rates each project on BTC custody, data availability, network operators and finality guarantees, with a colour for each: green, yellow, red, or “Stop!” for the weakest. A green rating for custody means users can exit unilaterally with a Bitcoin transaction. Red still requires at least five publicly known signers who are external to the team building the network. The site warns that its review “is not a security audit”, and it uses no stage numbers: those belong to L2BEAT’s ratings of Ethereum rollups.
Lightning: the reference for a Bitcoin layer 2
Lightning passes the exit test, which makes it the yardstick. Two parties lock bitcoin in a 2-of-2 multisig output and then exchange signed, unpublished transactions that update their balances. Payments hop across several channels thanks to hash time-locked contracts. Our lesson on how the Lightning Network works covers channels, routing, liquidity and watchtowers in detail; the point here is narrower.
At any moment, each side holds a transaction that pays it its current balance on the main chain. If the other party stops answering, you broadcast it and wait for a timelock to expire; our lesson on Bitcoin transactions and Script shows how those timelocks are written. Nobody can stop that, provided you, or a watchtower working for you, are online often enough to catch a cheating counterparty who publishes an old state. Lightning’s limits are about practicality, not custody: you need inbound liquidity to receive, channels cost an on-chain transaction to open and close, and large payments may fail to find a route.
The public network is small in bitcoin terms. The latest reading available from mempool.space’s Lightning statistics, dated 30 August 2026, counted 16,235 nodes, 32,665 public channels and a public capacity of about 3,794 BTC. Private channels are not in those totals. DefiLlama, which uses a different method, valued Lightning at 236.8 million dollars on 9 November 2026, about 3,190 BTC at that morning’s price. Both figures are a sliver of the bitcoin held on the main chain: Lightning is used to move payments, not to store savings.
Liquid, the federated Bitcoin sidechain
Liquid has been running since September 2018. Blockstream announced the launch on 10 October 2018 with 23 founding members, most of them exchanges, and the original purpose was plain: let traders move bitcoin between venues in minutes instead of waiting for main-chain confirmations. It runs Elements, a fork of the Bitcoin Core code, and produces a block about every minute. A transaction is considered final after two confirmations.
How Liquid holds your bitcoin
Bitcoin enters Liquid through a peg-in. You send BTC to an address controlled by the federation and, after 102 Bitcoin confirmations, you can claim the same amount of L-BTC on Liquid. The technical overview explains that the long wait protects against deep reorganisations of the main chain. Amounts and asset types are hidden by Confidential Transactions, even from the federation.
The federation has more than 80 members, according to the documentation, but the work is done by a smaller group of functionaries. Blockstream’s September 2026 report describes 15 functionary nodes and says blocks need at least 11 of their 15 signatures to be accepted; the documentation states the rule as at least two-thirds of block signers. The same functionaries hold the keys of the bitcoin reserve.
Leaving is the hard part. A peg-out is processed in batches and usually takes 11 to 35 minutes, but only holders of a Peg-out Authorization Key, a PAK, can request one. In practice, ordinary users exit through a member such as an exchange or a swap service that holds a PAK. Updating the list of authorised keys takes three days, a delay meant to give the network time to spot an attacker who has compromised some functionaries. By the exit test, Liquid is a sidechain: your way back depends on the federation and on the PAK holder you go through.
6 September 2026: when the federation followed the wrong rules
The attack did not break any key. It exploited the software that tells functionaries which transactions are valid. According to Blockstream’s incident assessment, a change made in April 2018 to how range-proof checks were cached left out part of the data the cache should have covered. A researcher reported that flaw on 2 August 2026 and a fix reached the bridge nodes the next day. When the fix was merged publicly on 1 September, it exposed a second weakness in the same code: the cached fields were joined without length markers, so an attacker could craft a transaction whose bytes matched a valid entry already in the cache.
| Time (UTC) | Event, per Blockstream’s report |
|---|---|
| 6 Sept 2026, 13:53 | Liquid block 4,050,336 includes a transaction creating about 4,000 unbacked L-BTC |
| 6 Sept, 14:00 | The attacker tests a 2.5 L-BTC peg-out through SideSwap |
| 6 Sept, 14:28 | Federation signers release 3,996.02 BTC on Bitcoin (block 965,783); SideSwap forwards it in the same block |
| 6 Sept, 18:26 | Bridge nodes halted; the reserve has fallen from about 4,205 BTC to 197 BTC |
| 7 Sept, 16:09 | The attacker returns 3,400 BTC to the federation’s peg wallet (block 965,950) |
| 9 Sept, 21:05 | Block production resumes with a replacement block 4,050,336; peg operations stay suspended |
| 20 Oct 2026 | The federation reopens swaps through participating providers; direct peg-outs stay restricted |
The second weak point was human. SideSwap, the federation member through which the L-BTC was pegged out, kept its peg-out signing key online and applied no size limit, no velocity control and no wallet-history check to peg-out orders, so a 4,000 L-BTC order went straight through. The Federation Charter asks members to “keep the bitcoin receiving wallet offline and secure”, and the report says SideSwap has publicly acknowledged those choices and their impact. About 602 BTC had not been returned at Blockstream’s last count. The attacker posted on-chain that it was acting as a white hat; whether that claim holds is disputed, and our report on Liquid’s staged recovery follows the story.
The federation’s update of 20 October 2026 reopened semi-automated swaps between BTC and L-BTC through participating providers, and says peg-outs for PAK holders will return only once full 1:1 backing is restored and the remaining security and operational requirements are met. It gives no date and does not say how the gap will be filled. As of 9 November 2026, direct peg-outs have been closed for more than two months. The lesson is not that 11 of 15 signers colluded: they did not. It is that a federation is only as safe as the rules its members’ machines enforce, and that a reserve held by signers can be drained without stealing a single key.
Rootstock: merge-mined, but the peg still has signers
Rootstock, often still called RSK, takes another route. It is an EVM-compatible chain whose blocks are produced by Bitcoin miners through merge mining: a miner works on Bitcoin and Rootstock at the same time, and a hash that meets Rootstock’s lower target secures a Rootstock block without costing extra energy. Rootstock’s documentation claims that over 85 percent of Bitcoin’s hash power merge-mines it. That is the project’s figure, but if it holds, rewriting Rootstock’s history would cost close to what it costs to attack Bitcoin.
Block production is only half of the story. The bitcoin itself sits in a multisig called the PowPeg. Its signers, the pegnatories, each run a node and a PowHSM, a tamper-resistant device built on a secure element that holds one key share and signs a peg-out only when shown enough cumulative proof of work behind the request. The PowPeg security model says the federation currently signs as 5 of 9, with plans to grow towards 20 members, and that not even a majority of pegnatories can release bitcoin without a valid command from the bridge contract backed by that work.
Moving in and out is slow on purpose. A peg-in needs 100 Bitcoin confirmations, roughly 2,000 Rootstock blocks, before RBTC appears; RBTC has a fixed supply of 21 million, one for each bitcoin that could ever be pegged. A peg-out waits for 4,000 Rootstock blocks, which the documentation equates to about 100 Bitcoin blocks of cumulative work or about 200 Bitcoin blocks of wall-clock time, before the PowHSMs sign. The minimums are 0.005 BTC to enter and 0.004 RBTC to leave.
The trade-off is clear once you apply the test. Miners make Rootstock’s ledger hard to rewrite, and the hardware rule makes a quick theft harder. But the exit is still a signature from a small, known set of signers running particular firmware. You cannot leave alone. DefiLlama counted 84.2 million dollars in the Rootstock bridge on 9 November 2026, about 1,130 BTC.
Stacks and sBTC: a separate chain with a signer-set bridge
Stacks predates most of the current wave. Its miners bid bitcoin for the right to write Stacks blocks, a design it calls Proof of Transfer, and every Stacks block is anchored to a Bitcoin block. The Nakamoto upgrade, scheduled for Bitcoin block 867,867 and activated in late October 2024, separated Stacks block production from Bitcoin’s ten-minute rhythm: once it took effect, a signer network could confirm Stacks blocks within seconds while Bitcoin blocks still serve as checkpoints.
For years Stacks had no trust-minimised way to bring bitcoin in. sBTC is the answer it shipped. According to the sBTC documentation, all the pegged bitcoin sits in a single UTXO at a Taproot multisig address controlled by the sBTC signers, a group separate from Stacks’ block signers. A post by Hiro of 10 December 2024 counted 15 signers at launch, including Figment, Blockdaemon, Kiln, Chorus One and Asymmetric Research, with 70 percent of them, 11 of 15, needed to move funds. Deposits are meant to clear within three Bitcoin blocks and withdrawals within six.
The rollout was gradual. Stacks says the first, deposit-only phase was completed through two capped rounds, on 17 December 2024 and 10 February 2025, and brought in more than 3,000 BTC. Withdrawals opened only on 29 April 2025, with a temporary limit of 150 BTC per day. For months, in other words, bitcoin could go in and not come out. DefiLlama showed 184.7 million dollars in sBTC on 9 November 2026, about 2,490 BTC.
Run the test and sBTC lands next to Liquid and Rootstock: a known group of institutions holds the coins, and you need most of them to cooperate to get yours back. The signers are better known and the bridge is younger, which cuts both ways. Stacks blocks inherit some finality from Bitcoin; the bitcoin inside sBTC does not inherit Bitcoin’s custody rules.
BitVM2 and Citrea: bridges that need only one honest party
If Bitcoin cannot check a proof, can it at least punish a lie? That is the idea behind BitVM, a paper Robin Linus published in October 2023. A prover makes a claim about some computation and posts collateral; a verifier who spots a false claim can prove it on Bitcoin, step by step, and take the collateral. Nothing in Bitcoin’s rules has to change, because the dispute is encoded in large trees of Taproot scripts and pre-signed transactions (Taproot itself is the subject of our lesson on SegWit and Taproot). The first version only worked between two fixed parties. BitVM2, a paper Linus and five co-authors published in August 2024, lets anyone with a full node challenge, and the project’s site now lists a bridge paper and research on a third version.
Citrea presents itself as the first production system built on this approach. Its mainnet went live on 27 January 2026 together with Clementine, a bridge that turns BTC into cBTC. Citrea’s six-month review of Clementine, published on 4 August 2026, describes how it works.
A peg-in goes to a Taproot address with two spending paths: one for the bridge’s signers acting together, and a refund path that lets the depositor take the coins back after 200 blocks if the bridge does nothing. Once the coins sit in the bridge’s vault for six or more blocks, a contract on Citrea checks the deposit through a Bitcoin light client and mints cBTC. Amounts are rigid: “The Clementine Bridge requires peg-in transactions to be exactly 10 BTC or multiples thereof.”
The exit is where BitVM2 earns its place. If every signer is online, a peg-out is paid normally. If a signer has been offline for 12 hours, an operator pays the user from its own bitcoin on the main chain and then claims a refund from the vault, opening a dispute window. Anyone running a challenger can contest a false claim; a watchtower posts the heaviest chain of Bitcoin headers, and the operator must answer with a zero-knowledge proof of a light client showing more proof of work and a valid payout. If it cannot, it loses its whole collateral and leaves the operator set. Citrea says one honest signer and one honest watchtower are enough to stop a wrong payout, and claims resilience against an attacker with less than about 45 percent of Bitcoin’s hash rate.
That is a real step up from “trust 11 of 15”. It is not yet a unilateral exit in Lightning’s sense: you rely on at least one honest party existing and being online, and on operators with enough capital to front payouts. The numbers also show how early this is. Clementine handled 150 BTC of bridging volume in its first six months, according to Citrea, and DefiLlama counted 8.2 million dollars in the Citrea bridge on 9 November 2026, about 111 BTC. Citrea says it is already working on a revised design based on BitVM3.
Ark and statechains: sharing UTXOs without a new chain
A second family does not build a chain at all. It splits ownership of on-chain coins between many users and keeps an exit open for each of them.
Ark: virtual UTXOs and rounds
In Ark, as described on Bitcoin Optech’s Ark topic page, an operator gathers users into rounds. Each round produces one on-chain output that commits to a tree of pre-signed transactions, and each leaf of that tree is a virtual UTXO, or VTXO, belonging to one user. To leave alone, you broadcast your branch of the tree and your leaf, and you get an ordinary Bitcoin output.
There is a catch built into the design. Every VTXO expires after an absolute timelock, after which the operator can also spend it, so users must move their coins into a new round before expiry. Payments inside Ark need the sender and the operator to cooperate, and until a received VTXO is rolled into a new round, the receiver trusts that the sender and operator are not colluding. Ark works on today’s Bitcoin, though proposals such as OP_CTV would make it cheaper. Optech logs a mainnet demonstration on 18 October 2024, Ark Labs’ Arkade launch on 21 November 2025 and Second’s Bark implementation going live on mainnet on 19 June 2026.
Statechains and Spark
A statechain moves the ownership of an on-chain output without moving the output. The owner and an operator share control; each time the coin changes hands, the new owner receives a pre-signed exit transaction that becomes valid sooner than the previous owner’s. Optech notes that the operator cannot steal unless it colludes with a previous owner, and that every owner can always spend on chain without the operator’s permission. Mercury Layer was announced in January 2024 as a statechain implementation, and Spark, built by Lightspark, was announced in November 2024 as a statechain-like protocol.
Spark’s documentation says each user signs pre-signed exit transactions with the operators before depositing, and that each transfer shortens the timelock so the current owner’s exit becomes valid first. If the operators disappear or turn hostile, the owner broadcasts the chain of transactions down to its leaf and waits; the documentation gives about 100 blocks as the shortest case. That is close to a unilateral exit, with one condition: you trust that operators really deleted the key material of earlier owners.
Babylon: staking bitcoin is not a layer 2
The largest figure in any “BTC in layers” chart belongs to a project that is not a layer at all. Babylon lets holders lock bitcoin in a script on the main chain and use it as stake to secure other proof-of-stake chains, starting with its own Babylon Genesis chain. The coins never leave Bitcoin. Babylon’s documentation describes three spending conditions on the staked output: the holder’s signature, the expiry of a timelock, and a covenant committee.
Slashing is the reason the design exists. Finality providers sign with extractable one-time signatures, so signing two conflicting blocks reveals a private key and lets a slashing transaction take part or all of the stake. The documentation says the covenant committee carries out slashing by majority consensus, which makes that committee a trusted party in the penalty path. Babylon Labs counted 57,290 BTC staked in the three capped rounds of its first phase, between August and December 2024, roughly 0.3 percent of the bitcoin then in circulation. DefiLlama valued Babylon’s staking at 3,023 million dollars on 9 November 2026, about 40,720 BTC. The point for this lesson: Babylon adds a risk to bitcoin you still hold; it is not a place where you spend it.
Drivechains: the soft fork Bitcoin never activated
Drivechains are the oldest idea in this lesson and the only one that would change Bitcoin’s own rules. BIP 300, “Hashrate Escrows”, written by Paul Sztorc and CryptAxe and assigned its number on 14 August 2017, would let sidechains hold bitcoin in a special escrow on the main chain. Withdrawals would be grouped into bundles that miners approve over a window of 26,300 blocks, roughly six months; a bundle needs 13,150 approvals, half the window, to pay out. BIP 301, its companion, describes blind merged mining, so that miners could produce sidechain blocks without running the sidechain’s software.
In this model the miners hold the keys, in effect, and a majority of hash power acting for six months could approve a theft. Supporters argue that the delay and the public vote make that costly; critics see a new reason to attack or bribe miners. BIP 300 is still a draft and has not been activated. Activation would need a soft fork, the mechanism explained in our guide to soft and hard forks. The politics of such changes belongs to the next lesson of this path, on Bitcoin governance and BIPs.
“BTC L2” chains: what happened to the 2024 wave
Between 2024 and 2026 dozens of EVM chains marketed themselves as Bitcoin layer 2s. Many of them hold users’ bitcoin in a multisig or with a custodian, which by the exit test makes them sidechains or bridges rather than layer 2s. Bitcoin Layers sorts the projects it reviews into Bitcoin-native layers, sidesystems and alternative chains, which is a more honest set of labels.
Botanix is the clearest case of what can go wrong without any hack. The project, which ran a network called Spiderchain with a federation of operators, announced in June 2026 that it was shutting down. Users had until 9 July 2026 to withdraw; after that, the federation would sweep remaining funds, and assets left behind would become unrecoverable, according to Bitcoin.com’s report of 10 June 2026. The team said fee income had never come close to covering its costs and that users preferred wrapped bitcoin on Ethereum. DefiLlama lists the Botanix bridge at zero.
Usage tells the rest of the story. On 9 November 2026 DefiLlama showed 380.7 million dollars in Merlin’s Seal, the contract that feeds the Merlin chain, against 6.3 million dollars of DeFi activity on Merlin itself. BOB’s chain held 5.2 million dollars. A large deposit contract next to so little activity on the chain itself suggests bitcoin parked for rewards rather than used. If you meet a new “Bitcoin L2”, the exit test and our guide to cross-chain bridges are better guides than its marketing.
Bitcoin layer 2s compared: trust, exit and figures
The first table sorts the designs by who can stand between you and your coins. The second gives the dated figures; its rows measure different things and should not be added up.
| Design | Who can stop your exit | How you leave | Example and dated state |
|---|---|---|---|
| Payment channel | Nobody, if you or a watchtower stay online | Publish your latest commitment transaction, wait for the timelock | Lightning: about 3,794 BTC public capacity (mempool.space, 30 Aug 2026) |
| Pooled UTXOs | Nobody for the final exit; the operator for payments inside Ark | Broadcast your branch and leaf before the VTXO expires | Ark: Arkade (21 Nov 2025), Bark on mainnet (19 Jun 2026) |
| Statechain | Nobody, if the operators deleted old key shares | Pre-signed timelocked exit transactions | Spark (announced Nov 2024), Mercury Layer (Jan 2024) |
| BitVM2 bridge | Needs one honest signer and one watchtower; operators post collateral | Payout by signers or by an operator, open to challenge | Citrea Clementine: 150 BTC bridged in six months (4 Aug 2026) |
| Signer-set bridge | 70% of about 15 named signers | Withdrawal in about six Bitcoin blocks | Stacks sBTC: withdrawals since 29 Apr 2025 |
| Merge-mined sidechain | The PowPeg signers (5 of 9) and their PowHSMs | Peg-out after 4,000 Rootstock blocks | Rootstock: about 1,130 BTC in its bridge (9 Nov 2026) |
| Federated sidechain | 11 of 15 functionaries and a PAK holder | Peg-out via a PAK holder, 11 to 35 minutes when open | Liquid: direct peg-outs restricted since 6 Sep 2026 |
| Timelocked staking | Nobody once the timelock expires; a covenant committee executes slashing | Wait for the timelock | Babylon: not a payment layer |
| Drivechain (proposal) | A majority of hash power over about six months | Bundle approved by miners | BIP 300/301: not active |
| Layer or product | What DefiLlama measures | Dollars, 9 Nov 2026 | About BTC |
|---|---|---|---|
| Babylon | Bitcoin staking | 3,023.0 million | 40,720 |
| Merlin’s Seal | Deposits feeding the Merlin chain | 380.7 million | 5,130 |
| Lightning Network | Value in channels | 236.8 million | 3,190 |
| Stacks sBTC | Bridge | 184.7 million | 2,490 |
| Rootstock bridge | Canonical bridge | 84.2 million | 1,130 |
| Rootstock | DeFi on the chain | 63.0 million | 850 |
| Stacks | DeFi on the chain | 57.3 million | 770 |
| Citrea bridge | Bridge | 8.2 million | 111 |
| Merlin | DeFi on the chain | 6.3 million | 85 |
| BOB | DeFi on the chain | 5.2 million | 70 |
| Botanix bridge | Canonical bridge | 0 | 0 |
The BTC column uses a price of 74,239 dollars, mempool.space’s reference price at 09:55 UTC on 9 November 2026. Liquid’s reserve does not appear in DefiLlama’s list; Blockstream gave it as about 4,205 BTC before the attack and 197 BTC just after.
How to judge a Bitcoin layer before you move coins
None of this is a recommendation to use or avoid any network. These are the questions that separate the designs, in the order the 2026 incidents suggest asking them.
Start with the exit. Find, in the project’s own documentation, the sentence that says how you get bitcoin back if the operator disappears tomorrow. If the answer is “the federation processes withdrawals”, count the signers, find out who they are and how many must agree. Five named institutions in different countries are harder to coerce at once than three wallets run by one company, but they are still a group you trust.
Then read the fine print of the exit. Liquid’s peg-outs need a PAK holder; Citrea’s peg-ins come in units of 10 BTC; sBTC’s withdrawals opened more than four months after its deposits; Ark coins expire if you do not refresh them. Each rule is defensible, and each one can leave a user stuck at a bad moment.
Check what happens on a bad day. Was there a pause, a cap or an incident, and how was it handled? Liquid published a minute-by-minute report; Botanix gave a month’s notice. Ask whether the code that decides what the signers sign has been reviewed recently, and remember Blockstream’s admission that nobody saw the risk in advance.
Last, compare the size of the network with its promise. A bridge holding 111 BTC and a staking protocol holding about 40,000 BTC are not the same kind of bet, and neither number says how secure the design is.
Taxes and rules for US and UK readers
Moving bitcoin into a sidechain token can have tax consequences. In the United States the IRS treats digital assets as property, and swapping one for another is a sale of the asset you give up, at the fair market value of what you receive. For wrapping and similar operations the IRS has not published a dedicated rule, and Notice 2024-57 only postpones broker reporting, as our guide to crypto taxes in the United States explains. Whether a peg-in from BTC to L-BTC, RBTC, sBTC or cBTC is a taxable swap is therefore not settled: keep records of the date, amount and value of every peg-in and peg-out.
In the United Kingdom HMRC’s guidance says exchanging one cryptoasset for a different one is a disposal for Capital Gains Tax. If a pegged token counts as a different cryptoasset, a peg-in can use part of your £3,000 annual allowance, as our UK crypto tax guide describes. A chartered tax adviser is the right person for a large or complex position.
The trust questions above matter more than any label a regulator might attach. A federation or a signer set holding your bitcoin is a custodian in practice, whatever its legal status, and the protection you have if it fails depends on its own rules and the courts of the countries its members sit in. The next lesson of this path looks at how Bitcoin’s own rules change, through BIPs and soft forks: that is where drivechains and covenant proposals such as OP_CTV are argued over.
