Bitcoin Virtual Machine (BitVM)

BitVM, short for Bitcoin Virtual Machine, is a design for verifying arbitrary computation on the Bitcoin network without changing Bitcoin's consensus rules. Proposed by developer Robin Linus in a whitepaper published in October 2023, it allows a party called the prover to claim that a program produced a certain result, while one or more verifiers can challenge the claim on-chain if it is false. Because the computation happens off-chain and Bitcoin only steps in when there is a dispute, the approach is described as optimistic, similar to optimistic rollups on Ethereum.

BitVM matters because Bitcoin's scripting language is intentionally limited and does not support general smart contracts. Its main intended use is to build bridges and layer 2 systems that move bitcoin to other environments with fewer trust assumptions than the federations used by most bridges today. Several teams formed the BitVM Alliance to develop the idea, and an improved design, BitVM2, was published in 2024. As of November 2026, BitVM-based systems remain at an early stage of deployment.

Imagine two people agree on the answer to a long maths problem, and one of them puts money in a box that the other can open only if the answer turns out to be wrong. Most of the time, nobody needs to check every step. But if the other person suspects cheating, they can point to a single line of working and ask for proof, and a referee checks just that line.

BitVM uses Bitcoin as that referee. Bitcoin cannot run long programs, but it can check one small step at a time. As long as honest participants are watching and ready to challenge, a false claim can be caught and punished, and the money in the box goes to the challenger. If nobody challenges, the claim is accepted without Bitcoin ever doing the heavy work.

The original BitVM paper described a scheme between two parties:

1. Compiling the program. The computation is broken down into a circuit of very simple logic gates.
2. Committing. The prover commits to values in the circuit using hash-based locks, and the possible challenge steps are placed in a large tree of scripts made possible by Bitcoin's Taproot upgrade of 2021.
3. Locking funds. Both parties pre-sign a sequence of transactions and lock bitcoin in an address controlled by those scripts.
4. Challenging. If the verifier disputes the result, they force the prover to reveal values for specific gates. Each round narrows the dispute until a single gate can be checked on-chain.
5. Settlement. If the prover's claim is shown false or they fail to respond in time, the verifier can claim the deposit; otherwise the prover's claim stands.

The process relies on cryptographic hashes and Bitcoin's existing opcodes. It requires large amounts of off-chain data and pre-signed transactions, and a dispute can involve many on-chain steps.

The first design worked only between two fixed parties, which limited its usefulness. BitVM2, published in 2024, introduced permissionless challenges, so that anyone watching can dispute a false claim, and reduced a dispute to a much smaller number of on-chain transactions by verifying a compact proof rather than a full circuit. Developers have since worked on verifying zero-knowledge proofs within the BitVM framework, which lets complex computations elsewhere be checked on Bitcoin. The design of zero-knowledge rollups that settle on Bitcoin is one of the main goals of this research.

The most discussed application is a bridge that lets users move bitcoin to another chain and back. In such a bridge, bitcoin is locked on Bitcoin under BitVM scripts, a representation is issued elsewhere, and an operator who processes withdrawals must prove correct behaviour or risk losing a deposit. Security depends on at least one honest participant being able to challenge, a "one-of-n" assumption that is weaker than trusting a majority of a federation. This could reduce a key risk of crypto bridges, which have suffered some of the largest hacks in crypto. Other proposed uses include layer 2 networks, trust-minimised sidechains and games or contracts that settle disputes on Bitcoin. These systems are part of the wider field of Bitcoin DApps.

BitVM is complex. Participants must exchange and store large amounts of data, operators often need to front liquidity for withdrawals and be reimbursed later, and the security model depends on watchers staying online and responding within deadlines. Some designs still require a group of signers to pre-sign transactions honestly at setup. Critics argue that a new opcode, such as those proposed in various covenant proposals, would make many of these goals far simpler, while supporters reply that BitVM works today without waiting for changes to Bitcoin that may never be agreed. Claims by projects to be "secured by BitVM" should be checked carefully, because implementations vary and many are still on test networks or in limited release. The base network is covered in Bitcoin Blockchain.

• BitVM