Skip to main content
bex.co
419
Blog

Bitcoin Becomes the Final Verifier: How Boundless Settles Ethereum and Base ZK Proofs on Proof-of-Work

10 min readDora NodaDora Noda
Bitcoin
Zero-Knowledge Proofs
Ethereum
Infrastructure
BTCFi
Share

For a decade, "Bitcoin can't do smart contracts" has been the unspoken premise behind every altcoin pitch. Bitcoin was the boring vault; everything interesting happened somewhere else. So here is a sentence that would have read as nonsense in 2023: Ethereum and Base are now using Bitcoin as the final court of appeals for their zero-knowledge proofs — and Bitcoin's code did not change one byte to allow it.

On January 20, 2026, Boundless — the verifiable compute network built by the RISC Zero team — went live with a cross-chain system that lets computationally expensive ZK proofs generated on Ethereum mainnet and Coinbase's Base settle and verify on Bitcoin. The framing from Boundless CEO Shiv Shankar is deliberately provocative: "Ethereum-style execution secured by Bitcoin, not running on Bitcoin." It is one of the more important architectural shifts of the year, and almost nobody outside the ZK research crowd has noticed yet.

This post explains what actually shipped, the BitVM machinery that makes it possible, why anchoring to Bitcoin is different from bridging to it, and what a multichain "Bitcoin-as-settlement" world means for the people who have to keep the infrastructure running.

The Problem: Trust Has to Bottom Out Somewhere​

Every rollup, bridge, and cross-chain message eventually faces the same question — who is the final authority when two parties disagree? For an Ethereum L2, the answer is Ethereum: post a validity proof or a fraud proof, and Ethereum's validator set adjudicates. That works, but it inherits Ethereum's trust assumptions and its roughly 12-minute economic finality.

Bitcoin sits on the other end of the spectrum. It carries the deepest, most battle-tested proof-of-work security in existence — north of a trillion dollars of accumulated hash power that has never been successfully reorged at any meaningful depth. For institutional risk committees still weighing tokenized-asset settlement, "anchored to Bitcoin's proof-of-work" is a sentence that lands differently than "secured by a proof-of-stake validator set."

The catch has always been Bitcoin's deliberately limited scripting language. Bitcoin Script can't loop, can't run a pairing-based verifier, and tops out well short of the computation a modern ZK proof requires. Making Bitcoin the verifier of an Ethereum proof sounds like asking a pocket calculator to audit a supercomputer. The breakthrough is that you don't actually need Bitcoin to run the computation — you only need it to punish a lie.

How Boundless Anchors Proofs to Bitcoin​

The system stitches together two pieces of technology that matured separately and then met at exactly the right moment.

RISC Zero's zkVM does the heavy lifting off-chain. Boundless is a decentralized proof marketplace: applications submit a computation, independent provers race to generate a succinct zero-knowledge proof of it, and they get paid in the network's ZKC token under a scheme called Proof of Verifiable Work, where rewards track useful proving effort rather than wasted hashes. By early 2026 the network had hundreds of active provers competing jobs down toward the cost floor — the supply side of "verifiable compute as a commodity."

BitVM is the part that lets Bitcoin act as judge. First proposed in 2023 and shipped to production in mid-2025, BitVM extends a slice of smart-contract capability to Bitcoin without any soft fork. Its trick is decomposition: the Groth16 verification algorithm — several scalar multiplications plus four pairing computations — gets chopped into chunks small enough to fit inside Bitcoin's per-transaction standardness limits. Verification runs off-chain by default. Only if someone disputes a result does an on-chain fraud proof execute the single contested step, slashing the liar's bonded collateral.

Put together, the Boundless flow looks like this:

  1. A computation happens on Ethereum or Base; a Boundless prover produces a ZK proof of it.
  2. That proof is committed against a BitVM construction on Bitcoin.
  3. If everyone is honest, nothing expensive ever touches Bitcoin — the proof is simply accepted.
  4. If anyone cheats, a challenger forces the disputed computation step on-chain, and Bitcoin's consensus resolves it with finality.

Shankar's phrase for it: the ability to "anchor real computation to Bitcoin without changing Bitcoin in any way." Bitcoin is not executing your DeFi trade — it is standing behind the cryptographic claim that the trade was computed correctly, ready to settle the dispute if one ever arises.

Why "Anchoring" Is Not "Bridging"​

This distinction is the whole point, and it's easy to miss. The crypto industry already has a thousand ways to move Bitcoin's value to other chains — wrapped BTC, tBTC, custodial pegs. Every one of them is a honeypot, and collectively they have leaked billions to bridge exploits.

Boundless is doing something categorically different: it moves Bitcoin's security guarantee, not its coins. No BTC is locked, wrapped, or relocated. There is no multisig holding hostage funds, no synthetic asset to depeg. What gets exported to Ethereum and Base is the credibility of Bitcoin's proof-of-work as a final arbiter. The asset stays home; only the trust travels.

That reframing matters most for real-world-asset settlement. A tokenized-Treasury or institutional credit product living on Ethereum can keep all its programmability and composability while pinning its highest-value state transitions to Bitcoin's hash rate. For a risk committee that has spent fifteen years learning to trust Bitcoin and three years learning to distrust bridges, "your settlement is anchored to PoW, and nothing was ever bridged" is a meaningfully easier sentence to sign off on.

BitVM Got Cheap at Exactly the Right Time​

None of this would be economical on the original BitVM. Early designs settled disputes through tediously interactive challenge-response games — many rounds, lots of on-chain footprint, real cost.

The economics flipped in two steps:

  • BitVM2 collapsed dispute resolution to roughly three on-chain transactions and adopted a 1-of-N trust model — the system stays safe as long as a single honest participant is watching, no matter how many others collude.
  • BitVM3, which landed in December 2025, introduced garbled circuits and made disputes on the order of 1,000x cheaper than BitVM2. In one production implementation by the Bitcoin L2 BOB, on-chain dispute costs fell 87%, down to roughly $11 per dispute. BitVM3 also swapped the old interactive fraud-gate search for a succinct ZK proof: if the prover's attestation fails to verify, the protocol simply halts — no drawn-out challenge rounds required.

An $11 worst-case dispute cost is what turns "theoretically possible" into "ship it." Boundless launching Bitcoin settlement just weeks after BitVM3 made disputes nearly free is not a coincidence — it is the supply chain of an idea finally clearing its last cost bottleneck.

A Crowded, Fast-Moving Bitcoin-ZK Field​

Boundless is the cross-chain entrant in a broader 2026 surge of "ZK meets Bitcoin" work, and it helps to place it on the map:

  • Citrea launched in January 2026 as Bitcoin's first production ZK rollup — a full EVM environment whose zkEVM (also built on RISC Zero) compresses STARK proofs to Groth16 and inscribes them on Bitcoin, using Bitcoin for both data availability and settlement. Citrea makes Bitcoin the home chain; Boundless makes Bitcoin the shared judge for other chains.
  • BitVM-based L2s like BOB and GOAT Network use the same fraud-proof machinery to build execution layers that settle to Bitcoin.
  • Client-side validation approaches (RGB and friends) push computation entirely off-chain with a different trust model.
  • Soft-fork proposals — OP_CAT, the covenant designs around BIP-347 — would give Bitcoin richer native scripting, but none has reached deployment, which is precisely why no-fork approaches like BitVM have momentum.

The throughline: after years of "Bitcoin is just digital gold," 2026 is the year builders stopped waiting for Bitcoin to change and started building expressive systems around it. Boundless's specific bet is that Bitcoin's best role isn't to compete with Ethereum on execution, but to sit above the entire multichain stack as the verifier of last resort.

The Boundless Network Underneath​

It's worth remembering that Bitcoin settlement is a feature riding on top of a real, running marketplace. Boundless hit mainnet beta on Base in July 2025 and full mainnet that September, and the integration list is the most credible signal of product-market fit:

  • Wormhole is adding Boundless ZK verification to Ethereum consensus, giving Native Token Transfers an optional cryptographic guarantee instead of pure guardian multisig trust.
  • EigenLayer uses it to power AVS slashing logic.
  • Celestia uses it to prove data-availability validity on any chain.
  • Taiko folds it into a multi-prover setup; Lido uses it for a ZK-based staking oracle.

The token layer ties it together: ZKC is an ERC-20 capped at an initial 1 billion supply, emitting 7% in year one and tapering toward 3% by year eight, with proving rewards split 75% to provers and 25% to protocol stakers. The network is also designed to be proof-system agnostic — support for competing zkVMs like Succinct's SP1 is on the roadmap — which positions Boundless less as one zkVM and more as the neutral marketplace where verifiable compute clears.

What This Means for Builders and Infrastructure​

For application developers, the near-term unlock is optionality. You no longer have to choose between Ethereum's programmability and Bitcoin's settlement gravity — you can write Solidity, prove it through Boundless, and pin the result to proof-of-work. The first adopters will almost certainly be the highest-value, lowest-frequency flows: RWA settlement, major protocol upgrades, large cross-chain transfers — anywhere the marginal cost of a Bitcoin anchor is trivial next to the value at stake. High-frequency, low-value activity will stay on cheaper layers, exactly as it should.

For infrastructure, this quietly redraws the map. A world where Ethereum proofs settle on Bitcoin creates a genuinely new RPC and indexing workload — one that spans Bitcoin header streaming, BitVM/taproot proof verification, and Ethereum state-transition attestation in the same request path. Multi-chain archive coordination stops being a nice-to-have and becomes the substrate the whole pattern runs on. The teams that can serve a Bitcoin node and an Ethereum archive node and a proof-verification endpoint as one coherent surface will be the ones who make "Bitcoin-secured Ethereum execution" feel like a single product rather than a science project.

The open question is honest: will proof-aggregation and dispute economics stay cheap enough to make Bitcoin settlement worthwhile beyond a handful of marquee use cases, or will it remain a premium guarantee reserved for the highest-value state transitions? BitVM3's $11 disputes suggest the cost curve is bending the right way. If it keeps bending, "anchored to Bitcoin" could become a checkbox on far more of crypto's infrastructure than anyone expected when the year began.

Either way, the conceptual wall has already fallen. Bitcoin spent ten years as the chain that couldn't. In 2026 it became the chain everything else answers to.

Building across Bitcoin, Ethereum, Base, and the long tail of chains in between? bex.co provides enterprise-grade RPC and indexing APIs across 30+ networks, so multi-chain settlement architectures don't have to mean multi-vendor headaches. Explore our API marketplace to build on infrastructure designed to last.

Sources​

Related articles

One API key for 30+ chains

bex router is a single multi-chain gateway — one key, one bill, metered in compute units instead of an account per network.

Explore bex router
Back to all posts