FAQ

Short answers. The whitepaper and the specification at github.com/zk-BTC/zkbtc are the sources.

What is zkBTC?

A one-to-one Bitcoin-backed token on the zkCoins protocol: private transfers, redeemable for on-chain bitcoin. The reserve sits in vaults that spend only along pre-signed BitVM2 fraud-proof paths, not in a custodian. It is effectively trustless if you join the operator set before the first mint: you are an operator, and you trust nobody else with your bitcoin.

Is zkBTC trustless? Do I have to trust operators or a gatekeeper?

Effectively trustless. You do not trust a company, a federation, or a gatekeeper with your bitcoin. You are an operator. Anyone may join the operator set. That set only grows: new people can join, nobody is removed, and every new vault is signed by all current operators, including you. A thief cannot later open a private vault, because you would have to co-sign it, and you will not sign a graph that lets them steal. You can also pay yourself out. Join before the first coin of the asset is minted. An admitted operator who refuses later presigns freezes new mints until they cooperate again. In-place rotation needs the old key; if that identity key is lost, new mints stay frozen. Already-presigned vaults and existing coins stay exit-able. A gatekeeper, if present, only checks new deposits; it cannot freeze, seize, or block exit, and it is not what makes zkBTC trustless. What this does not magically remove: Bitcoin itself (a 51% attack), bugs in the cryptography, the need for at least one honest live challenger in each window, a private-fork mint residual (Attack A — Bitcoin-class unless a designated gatekeeper honestly checks the canonical chain), and the need to actually register if you want these guarantees. If nobody honest was in the set at the first mint, those early coins can also drain later vaults, because the token is fungible.

Can I use it today?

No. This is a design specification and an informative paper. There is no production implementation. Two engineering gates remain: converting the zkCoins compliance proof into a form BitVM2 can verify, and standing up a live open operator-registration market. It is not a product you can mint or redeem on mainnet today.

How do I get zkBTC, and how do I get bitcoin back?

Mint: lock bitcoin, wait for deep confirmation of the vault move (on the order of 2016 blocks), then receive the token. Redeem: burn the coin first, then a registered operator fronts bitcoin and reclaims from the vault. There is no un-burn. Set max_fee high enough or the burned coin can sit unserved.

Is there a gatekeeper? Can it freeze my coins?

A gatekeeper is optional per asset and acts only at mint: it can refuse new deposits. It has no key on the vault and cannot freeze transfers or block redemption. After a coin exists, the gatekeeper is out of the path. It is not a custodian and it is not what makes zkBTC trustless. Operator theft and a Sybil drain of the pool are closed by you joining the growth-only operator set before the first mint and refusing a malicious graph, not by the gatekeeper. Joining later does not make the asset Attack-B-safe if nobody honest was already in the set at the first mint.

Do I have to trust some other operator to exit?

No. Anyone may join the operator set, including you. The set only grows; a new vault cannot drop old operators. If you register, you can front and reclaim your own exit, and you are the honest signer of every later vault. A holder who never registers waits for some registered operator and has no Attack-B guarantee of their own. Registration is required beforehand; there is no registration-free self-reclaim on bitcoin as it is today.

Can operators steal the reserve?

No, not if you—or an operator you treat as honest—were in the set before the first mint. Every new vault is signed by all current operators. You will not sign a graph that pays the vault to a thief, and because the set never shrinks, a later private club cannot omit you. Under the remaining assumptions — you (or some honest operator already in the set) deleted the epoch signing key, at least one honest live challenger acts in each window, and the circuit and BitVM2 graph are sound — the worst case is freeze, not theft. A critical soundness bug is the theft case. Sound circuit and graph crypto is a standing assumption. Join before the first mint so there is no untrusted prefix.

How private is it?

Internal transfers are shielded: amounts, parties, and the graph stay off the public ledger except for a 64-byte nullifier. Peg-in and peg-out are ordinary public bitcoin transactions, so amounts and timing at the boundary are visible.

How do I become an operator? What does it cost?

Anyone may join. You generate an identity key you must never lose (losing it freezes new mints, not existing coins), post a bond, take part in that epoch's signing ceremony, then delete the epoch signing key. Join before the first mint of the asset if you want the effectively-trustless guarantee. The specified intended launch bond is two bitcoin, locked until every vault of that epoch has no remaining reimbursement claim path — comparable to Clementine — plus time and fees. That can outlast the epoch calendar. It is a bonded commitment, not a free click. Wallets must refuse to build a deposit unless your operator key is already in the set.

Who pays if I challenge a fraudulent claim?

Anyone with a Bitcoin full node may challenge. If the challenge succeeds, the slash transaction pays you a bounty from the operator's slashed bond on Bitcoin; the rest of the bond is burned. You fund the Bitcoin fees up front and are reimbursed only if you win. A design that leaves challengers to self-fund with no bounty is the anti-pattern this rule exists to close. Challenge being possible is not the same as someone actually doing it in time.

Why is there no homepage?

On purpose. The official marketing site comes later. The paper lives at /white-paper from day one so that URL stays the one search engines list.