 |
BitcoinOS and Starknet aren’t waiting around for the controversial OP_CAT hard fork to add new functionality to Bitcoin, with both projects devising innovative ways to scale Bitcoin using zero-knowledge (ZK) proofs right now.
The projects have both demonstrated it’s possible to verify ZK-proofs on Bitcoin’s existing mainnet — even if Bitcoin’s ultra-simple scripting language makes it difficult and expensive. This could create genuine Bitcoin L2s that inherit much of its security, and unlock the intriguing possibility of creating programmable tokens on Bitcoin itself.
Best known as an Ethereum L2, Starknet wants to use the tech to scale Bitcoin to thousands of transactions per second, up from just 7 TPS today. “The ecosystem in Starknet is very, very enthusiastic about also expanding to Bitcoin,” co-founder Eli Ben-Sasson tells Magazine.
BitcoinOS, meanwhile, claims it will soon unveil technology that unlocks “smart contract functionality directly” on Bitcoin’s mainnet itself, rather than requiring BTC to be sent to a Bitcoin L2. This could enable almost $2 trillion of Bitcoin to be used natively in DeFi.
“That’s a whole lot of money just sitting there and doing nothing,” says CTO Gadi Guy. “We want to put this money to work.”
In November, BitcoinOS sent the first trustless transaction using its Grail zk bridge between Bitcoin and the Merlin Bitcoin L2. Merlin is an Ethereum Virtual Machine-compatible blockchain, and BitcoinOS intends to publicly demonstrate a transaction between Bitcoin and Ethereum soon.
In fact, Guy suggests they may have already done so.
“Well, we’ve sort of been doing these demos for a while now,” he says. “The next step is launching the actual product.”
More than 185,000 users have tried out the BitcoinOS (BOS) Grail bridge on testnet, which uses BitSNARK verification to send funds between chains (a SNARK is a type of cryptographic proof). Arbitrum, CoreDAO, BNB Chain, Mode and Merlin have been integrated so far, with 30 more coming, including Cardano.
Guy isn’t a fan of the term “trustless,” however. “I would prefer to present this as a No Counterparty Bridge, which means that there’s nobody who can run away with the money,” he clarifies.
Guy said the ability to lock and bridge funds using zk is “just the very beginning.”
“Once we can do this, we can write decentralized applications on Bitcoin. We can write exchanges, we can write lending systems, we can build staking systems, we can build gambling systems. There’s a whole bunch of things that we can do that are happening on Ethereum that can’t be done [currently] on Bitcoin.”
Smart contract functionality on Bitcoin via zk
As the very first blockchain project from 2008, Bitcoin script has extremely limited functionality. As a result, most Bitcoin L2s are just sidechains with inferior security and consensus mechanisms that enable users to interact with tokens representing locked or pegged Bitcoin.
Guy compares Bitcoin script to the machine code that computer scientists had to work with back in the 1960s and says it doesn’t have essential programming constructs like loops, conditional statements, or even the “goto” command.
So the vision for the 30-member BitcoinOS team is to create an operating system on top of that code in the same way Windows was originally built on top of the text command-driven MS-DOS. Guy says this will enable access to security features, user management, and provide an environment where devs can build “interesting applications” for Bitcoin.
He’s keeping the precise details about how they’ll achieve this to himself, but insists the expanded functionality will not be on an L2.
“No, we’re going to build smart contract functionality directly. That’s the point. We have a few white papers that we’re very near completing that will explain how we’re going to do this. Some of this is very innovative. BitSNARK was just the beginning.”
There are a few clues, however. According to the project’s roadmap from December, a Programmable Token Framework will play a big role.
“BOS enables tokens inscribed with zk proofs that embed smart contract logic directly on Bitcoin. These tokens could represent DeFi cash flow sequences or tokens with automatic SAT distribution across order books.”
Another primitive called Merklemesh will facilitate “genuine” Bitcoin rollups by sequencing “data into SNARK proofs validated on Bitcoin mainnet.”
According to the BOS site, the system “operates via a cluster of permissionless nodes that execute BOS computations, verify ZK-proofs, and monitor all parts of the BOS tech ecosystem.” Mainnet is scheduled to launch this quarter.
“Our slogan is you’re early to Bitcoin again,” Guy says.
Why Bitcoin doesn’t have “genuine” L2s, and how zk can help
BitcoinOS’s breakthrough technology is called BitSNARK. The team successfully verified the first zk-SNARK proof on the Bitcoin Blockchain at Bitcoin Nashville in July 2024.
A prover submits the proof to the network, claiming a computation was performed correctly. If challenged, a series of six back-and-forth transactions zero in on any disagreements in computation. The verification program is essentially broken into 300KB chunks to fit under the maximum a Bitcoin transaction can handle.
Spending hours and 12 transactions to verify proofs is a time-consuming and expensive workaround, but as an “optimistic” solution, it’s designed not to be used. Guy says the threat of using it should keep the vast majority of transactions honest. The same principle underpins Ethereum’s optimistic rollups, which assumes transactions are true unless they are challenged via fraud proofs.
“Worst case scenario is that this whole thing can take a day, maybe,” he says. “But I think 99.9% of the payouts will only take about 30 minutes.”
While he supports the proposed OP-Cat fork, he says it “isn’t the panacea that some people will think it is.
“It’s not a magical solution. It does make things easier, yes,” he says.
Read also
Starknet takes a starkly different approach
As the name suggests, BitSnark uses zk SNARKs, which offer smaller and cheaper proofs but also have some disadvantages compared to zk STARKs
StarkWare founder Eli Ben Sasson says zk STARK technology, which he invented, is the most future-proof solution for scaling blockchains as “it is post-quantum secure, fastest to scale, safest, no trusted setup.”
“Ultimately, I think that it will be adopted on all blockchains, not just Ethereum,” he says.
Starknet’s recently published Bitcoin Roadmap sets the rollup’s goal as “becoming Bitcoin’s execution layer” and scaling it to thousands of TPS. It also plans to be the first L2 to settle on both Bitcoin and Ethereum.
Plan A for Starknet requires the OP_CAT Bitcoin fork to proceed. The op code significantly expands Bitcoin’s scripting capabilities and was originally included in Bitcoin by Satoshi Nakamoto himself before being withdrawn in 2010.
The enhanced functionality would enable rollups to execute and batch transactions offchain and post ZK-proofs showing they were executed correctly to Bitcoin. In March, Starknet successfully verified the first Stark proof using the op code on Bitcoin’s Signet test network.
Starknet has also launched a $1 million research fund to look into the pros and cons of the fork, but Ben-Sasson is very wary of being seen as driving the proposal and says the decision is ultimately up to the community.
Read also
The future of the fork is uncertain because many Bitcoiners are wary of undermining its store of value status with expanded functionality, particularly after the Taproot fork resulted in unintended consequences like Ordinals and BRC tokens. A more limited change like the CTV+CSFS fork might be embraced instead, which Tom Brand, StarkWare’s head of product, says would provide some useful “stepping stones” but would not be as valuable as OP_CAT.
“They make certain constructions easier (like trust-minimized bridges and BitVM-based interactions) but do not yet enable direct, efficient zk-STARK verification at Bitcoin’s base layer,” he says.
Scaling Bitcoin with zk proofs without OP_CAT
Starknet also has a Plan B and Plan C in place. It’s experimenting with alternate approaches, including the use of Bitlayer’s BitVM for bridging and interoperability.
The system allows for offchain smart contracts to be verified on Bitcoin. It’s also optimistic and assumes the proofs are correct, except if challenged via an economic fraud proof system.
Bitlayer says its trust-minimized BitVM bridge will connect to Starknet, Arbitrum, Base, SonicSVM, and Plume Network.
Starknet is also working on verifying zk STARK proofs on mainnet without a fork. Late last year, StarkWare and Blockstream researchers devised ColliderScript, which is a method of enforcing covenants (rules on how and where BTC can be spent in future) on Bitcoin without a fork. It could enable trustless lending and other financial agreements without third-party custodians. As a workaround, it was theoretically brilliant, but not one likely to go into production.
“ColliderScript is something that is completely safe, but it costs something like $10 million per transaction,” Ben-Sasson says.
Recently, researchers unveiled a greatly improved version of the technology called ColliderVM. It significantly reduces the complexity and costs ofadding smart contract-style functionalityto Bitcoin, and moves it closer to feasibility, but it’s not there yet.
“Our techniques are inspired by ColliderScript, but are more efficient, reducing the number of hash evaluations required by at least ×10000. With it, we estimate that the Bitcoin script length for STARK proof verification becomes nearly practical.”
Ben-Sasson says it’s just a matter of time.
“Like the famous joke: We established the fact, and now we’re just negotiating the price,” he says.
“Whether it will reach, I don’t know, $10,000, which is probably where it becomes completely viable — I don’t know, but it can’t stay at $10 million per STARK.”
All in on Bitcoin either way
Starknet is trying out a raft of other methods for getting Bitcoin into DeFi too, and this week, it announced at the Dubai Staking Summit that it would roll out staking for Bitcoin on Starknet in the third quarter.
It’s also partnered with Bitcoin wallet Xverse to provide staking and yield farming, albeit with more trust assumptions than genuine DeFi, as it uses multisig co-signers for bridging, according to XVerse. However, Starknet and Bitcoin self-custodial Braavos Wallet enable yield up to 10% on native Bitcoin without bridging.
A bridge via Atomiq also enables users to convert from Bitcoin to Wrapped Bitcoin via trustless atomic swaps. The WBTC can then be used in Starknet lending and yield protocols like Vesux and Nostra Finance.
1/ Bringing BTC from Bitcoin to Starknet just got easier.
The @atomiqlabs cross-chain swap is now live, letting you convert BTC from Bitcoin to wBTC on Starknet, seamlessly, with zero slippage, and secured by Bitcoin’s Pow.
But why bring your BTC to Starknet? 🧵 pic.twitter.com/XCPIqE1jIy
— Starknet 🐺🐱 (@Starknet) April 16, 2025
Integrity web comprised of Bitcoin and Ethereum
Eli Ben-Sasson says the ultimate aim is to create an “integrity web” connecting genuinely decentralized protocols, useful services, and governance processes.
Starknet’s role will be holding it all together with the “glue of integrity through math.”
“Our mission is to bring about a world in which integrity is never assumed but demonstrated publicly and upheld by all,” he says.
“This needs to appear on any blockchain that is fully decentralized and capable of supporting it. So right now, I would say the only two truly decentralized blockchains are probably Ethereum and Bitcoin.”
Subscribe
The most engaging reads in blockchain. Delivered once a
week.
Andrew Fenton
Based in Melbourne, Andrew Fenton is a journalist and editor covering cryptocurrency and blockchain. He has worked as a national entertainment writer for News Corp Australia, on SA Weekend as a film journalist, and at The Melbourne Weekly.
