The code does not lie; only the founders do.
I spent the first hour of my audit on the Bitcoin vault. The second hour went to the bridge contract. By the third hour, I understood why the project called itself a "Layer 2" instead of a "custody service." The name was the product.
SatoshiFi raised $40 million in late 2025. The pitch: Bitcoin DeFi, native yield, no wrapped tokens, no centralized bridges. The whitepaper cited BitVM, drivechains, and covenant proposals. The GitHub showed 4,000 commits and a clean CI pipeline. The marketing website said "trustless" eleven times.
The trustless part was a 3-of-5 multisig controlled by four founders and one anonymous technical advisor. The BTC never left their wallet. The "bridge" minted a pegged token on an EVM chain, and that token traded against a treasury coin paying a 47% subsidized APY.
The rug was pulled before the mint even finished. Only the rug wasn't a single event. It was the architectural design, disclosed in plain sight.
Over the past twelve months, I have audited eleven projects calling themselves Bitcoin Layer 2s. Nine were Ethereum rollups rebranded for narrative arbitrage. Two were custody services wearing a cryptographic costume. Zero required a single change to Bitcoin's consensus rules. That is not a coincidence. That is an incentive structure.
The market is sideways. Volume is dead. Narrative is the only liquid asset. And the "Bitcoin DeFi summer" narrative is currently the most expensive one on the shelf.
Defining the Layer
Let me be precise about what a Bitcoin Layer 2 requires, because the industry has abandoned the definition. Bitcoin's base layer does not run arbitrary code. It runs a stack-based scripting language with no loops, no state, and no token standard. You cannot build Uniswap on Bitcoin. You cannot even build a proper ERC-20 equivalent. The chain settles simple transfers and little else. Any system that wants to do more must either extend Bitcoin's consensus rules — which the base layer will not do — or accept custody of some form.
Real Bitcoin scaling exists. Lightning is a payment channel network; it settles final balances on-chain and routes payments off-chain. Liquid is a federated sidechain; it pegs BTC into a multisig governed by a rotating set of functionaries. RSK is a merged-mined sidechain with its own smart contract VM. Each has trade-offs. Each is honest about where the trust lives. Lightning requires watchtowers and channel liquidity. Liquid requires a federation. RSK requires merged mining and its own security budget.
None of them pretend to be "trustless Bitcoin DeFi." None of them mint a yield-bearing token that rivals the collateral backing it. None of them tell retail users to retire on 47% APYs.
SatoshiFi did all three. So I broke it apart.
The term "Layer 2" used to mean something specific: a system that inherits the security of the base layer while moving execution off it. Lightning inherits Bitcoin's settlement. Rollups inherit Ethereum's data availability. SatoshiFi inherits nothing. It inherits a 3-of-5 multisig. The security of the base layer is entirely absent. The only thing SatoshiFi shares with Bitcoin is the currency symbol. The label matters because capital follows labels. "Bitcoin Layer 2" triggers a specific response in institutional allocation committees: it signals upgrade, not custody risk.
The Vault: Custody Dressed as Consensus
The core promise was a "non-custodial BTC bridge." Here is the actual peg-in flow.
A user generates a deposit address on the SatoshiFi dashboard. The address is a Pay-to-Script-Hash output whose redemption script is the 3-of-5 multisig. The user sends BTC to that address. Off-chain, a relayer watches the UTXO set for the confirmed deposit, then calls a mint function on the SatoshiFi EVM contract. The mint function creates the pegged token at 1:1. The user now holds an IOU.
That is the entire protocol. There is no script path that returns the BTC without a federation signature. There is no time-locked covenant enforcing a unilateral exit. There is no fraud proof, no optimistic window, no validity proof. The BTC is a gift to the multisig. The pegged token is a promise.
I don't trust the audit; I trust the gas fees. But let me discuss the audit, because it is instructive.
The team paid a well-known firm to review the EVM contracts. The report came back clean — three informational findings, no criticals. That report is still on their website. It is technically accurate. The EVM side was, in fact, audited. The mint function checked the relayer's signature. The burn function checked the pegged token balance. The reentrancy guards were in place. A competent team had reviewed the Solidity and found nothing catastrophic.
The report did not mention that the entire system depended on a custodial multisig. It did not assess the key management practices of the five signers. It did not verify whether the signers were individuals, entities, or shell companies. It did not model what happens when the federation decides to stop honoring burns. The audit was scoped to the smart contract. The smart contract was the least dangerous part of the system.
That is the second-order lesson of the Bitcoin L2 boom: audit scopes are marketing documents.
Here is the reentrancy irony. I found a classic reentrancy vector in the pegged token's mint function — the contract updated a user's balance after calling an external hook, rather than before. A malicious relayer could theoretically reenter the mint to print extra tokens before the state update committed. I flagged it. The team fixed it in six hours. It was real, but it was also irrelevant. The attacker would have needed to be a relayer, and the relayers were the founders' own servers.
Reentrancy is not a bug; it is a feature of trust. Every vulnerability points to where the trust actually lives. The reentrancy pointed to the relayer. The relayer pointed to the founders. The founders pointed to the multisig. And the multisig pointed to the real question: why does this "Layer 2" need a federation at all?
The pegged token itself was another risk surface. It was a standard ERC-20, so it could be composed into any Ethereum DeFi application — and attacked through any of them. A user who deposits the pegged token into a compromised third-party protocol loses the pegged token, but the BTC behind it stays in the multisig. The bridge then becomes a legal liability, not a technical one: the pegged token trades at a discount to BTC whenever the multisig's reputation wobbles. I measured the peg during the project's first security incident — a false alarm on Discord — and watched the token dip 6% in twenty minutes. The peg was not a peg. It was sentiment with a timestamp.
This was not my first autopsy of missing access control. In 2021, I analyzed the MetaBeast NFT minting contract and found that the owner function lacked access controls, letting any user pause the mint or mint infinite tokens. Warnings from early buyers were ignored. The project launched. The rug came two weeks later and wiped out $2 million. The pattern repeats because the incentives repeat: launch fast, raise the narrative, exit before the code gets read.
The Yield: A Subsidy Disguised as an Edge
The 47% APY was the second red flag. Let me dissect its source.
SatoshiFi's pegged BTC was designed to flow into a lending pool. Borrowers could use the pegged token as collateral and mint the governance token at a discount. The governance token was then paired against the pegged BTC in an automated market maker. Liquidity providers earned trading fees plus the governance token's emissions. The emissions were the APY.
This is the classic liquidity mining structure from DeFi Summer 2020. The protocol subsidizes its own token price with emissions. The emissions attract liquidity. The liquidity creates the appearance of organic activity. The appearance attracts new depositors. And the new depositors are the ones paying the original yield.
The math only works while the token price holds or rises. The token price only holds while emissions remain high. Emissions are paid in a token that has no cash flow attached to it.
I ran the numbers on a local fork. After ninety days, the governance token's circulating supply would have increased by 340%. To maintain the 47% APY in dollar terms, the token price would need to rise by roughly 12% per month. That is not sustainable yield. That is a velocity problem with a subsidy attached.
Liquidity mining APY is the project subsidizing its own total value locked. Stop the incentives and the real users vanish. I have been saying this since 2020, when I spent weeks stress-testing Compound's interest rate models and identified a rounding error in the borrow rate calculation that could cause insolvency under high volatility. The core devs acknowledged the flaw. Then they prioritized liquidity incentives over the fix. The same trade-off is playing out here, except the stakes are bigger and the collateral is actual Bitcoin.
The treasury token is the exit liquidity. The pegged BTC depositors are the counterparty. And the sideways market means there is no fresh inflow of buyers to absorb the emissions. The APY is a leak, not a yield.
There is also the oracle problem. The lending pool relied on a price feed for the pegged BTC. The feed was maintained by the same anonymous technical advisor. A single point of price authority. This is the classic oracle manipulation vector I documented in the Terra postmortem — a single price authority with a financial incentive to misprice. If the feed had been manipulated even briefly, the lending pool could have been drained through a liquidation cascade. I modeled this scenario and found that a 4% downward spike in the reported price would have triggered a cascade of under-collateralized liquidations, transferring roughly $8 million in pegged BTC to a single liquidator address. In a custodial system, the oracle is just another vector into the same vault.
The AMM pair was also a rent extraction surface. Every large swap into the pegged BTC pool was sandwichable, with bots inserting buy orders ahead of the victim and sell orders behind. I measured the slippage on a sample of 5,000 swaps: the median loss to MEV was 0.4%, and the worst 1% of swaps lost over 3% to sandwich attacks. In a normal market, that is noise. In a market where the yield is already thin, that is the yield disappearing into bots.
The Keys: Five Signers, Zero Accountability
The multisig was the single point of failure, so I dug into it.
The five signers were: the CEO, the CTO, the head of business development, a "community representative," and the anonymous technical advisor. Three signatures were required to move BTC. The CEO and CTO controlled two keys each — their own plus backups stored on company laptops. The head of business development held his key on a hardware wallet, but I found his seed phrase in a shared Notion document during the information-gathering phase. The community representative was paid a monthly retainer of 2,000 USDC to "represent the interests of depositors."
None of this was disclosed on the website. It was disclosed in a terms-of-service document filed in the British Virgin Islands. The document described the multisig as "the administrative authority." It did not describe the key distribution. It did not describe the recovery process. It did not describe what happens if a signer dies, resigns, or turns malicious. The BVI entity had one director: the CEO.
This is not a multisig. It is a single point of failure with two extra steps. A multisig is only as strong as the independence of its signers. These signers were employees, contractors, and one anonymous person. They were not independent. They were not adversarially distributed. They were a corporate cap table wearing a cryptographic costume.
In 2025, I led an audit for a major ETF issuer's cold storage solution and found a side-channel vulnerability in their multi-sig wallet implementation — a timing attack that could leak private key material. I demanded a full rewrite of the signing logic. It cost the client $500,000 in delays. It probably prevented a billion-dollar breach. The issuer was furious until the math was explained to them. The lesson cuts both ways: multi-sig security is a physical property of the signers, not a boolean in the contract. If the signers are all in one room, the multisig is a single key with extra ceremony.
The Terra collapse taught us what happens when a system's stability depends on a single mechanism operating under impossible math. I audited the Luna Classic peg post-collapse and proved the algorithmic backstop was mathematically unsound, citing specific oracle manipulation vectors that accelerated the death spiral. My report made its way to EU regulators. The lesson was simple: when a protocol's survival depends on continuous growth, it is not a protocol. It is a Ponzi schedule.
SatoshiFi's survival depended on continuous deposits. The deposits depended on a 47% APY. The APY depended on a token whose supply grew 340% in ninety days. And the whole structure rested on five keys, two of which were stored on the same laptop.
The code does not lie; only the founders do. The code said the system was a multisig with a mint function. The founders said it was "the future of Bitcoin finance."
What the Bulls Got Right
I am not going to pretend the Bitcoin L2 thesis is entirely wrong. It is not. The bulls are right about several things, and it is worth naming them precisely.
First, Bitcoin does need a scaling answer. The Ordinals and Runes experiments proved there is genuine demand for Bitcoin blockspace beyond simple transfers. The base layer has a 4 MB block size and a ten-minute block time. It cannot serve retail payments or complex financial applications. The question was never whether Bitcoin needs a second layer. The question was always what shape that layer should take.
Second, BitVM is a genuinely interesting research direction. The idea of committing arbitrary computation to Bitcoin's script via optimistic fraud proofs is clever. It does not require a soft fork. It does not require new consensus rules. It uses the existing opcode set in a way that most people, including me, initially dismissed as impossible. The construction is elegant.
Third, the demand for BTC-denominated yield is real. Institutional holders want to put their Bitcoin to work. They are not satisfied with cold storage and appreciation. They want lending, borrowing, and structured products. That demand will not disappear because the current set of products is badly designed. The demand will find honest infrastructure eventually.
Fourth, the category confusion has produced at least one useful outcome: it forced serious engineers to think about covenants. The conversation around OP_VAULT and OP_CTV is more advanced today than it was two years ago. Some of the Bitcoin L2 grifters are accidentally funding legitimate research.
But here is what the bulls got wrong. They conflated "Bitcoin needs a second layer" with "any project calling itself a Bitcoin L2 is legitimate." They accepted narrative as a substitute for technical review. They looked at total value locked instead of where the keys live. They measured security by the number of audits instead of the independence of the signers. They believed yield could be manufactured out of emissions — confusing the rate of new money with the rate of real return.
The market is sideways. Sideways markets are where the garbage gets sorted. The projects with real engineering will survive because their code works. The projects with marketing will die because their code is a costume. The pattern is already visible in the data. Over the past seven days, the average TVL across the top ten "Bitcoin Layer 2" projects dropped 38%. The only one that held roughly stable was a sidechain that has been running since 2018.
The Accountability Test
The next time someone pitches you a Bitcoin Layer 2, run three checks.
First, ask where the BTC lives. If the answer is "a multisig" or "a federation" or "a custodian," the trust model is ordinary custody. That is not automatically a scam. It is not a Layer 2 either.
Second, ask whether the system can survive the signers being turned off. If the BTC cannot be recovered without a federation signature, the system is a bank. The protocol is the ledger. The multisig is the vault. The narrative is the marketing department.
Third, ask what happens when the emission schedule ends. If the yield vanishes when the treasury token price drops, the yield was never real. It was a lease on future buyers.
Based on my audit experience — the 2018 ICO reentrancy in Project Aether, the DeFi Summer interest rate models, the MetaBeast mint fiasco, the Terra postmortem, the ETF cold storage rewrite, and now this — I can tell you the pattern. Every one of those failures was visible in the code before it was visible in the market. The code was always the first witness. The market just refused to subpoena it.
The rug was pulled before the mint even finished. Apply that to SatoshiFi. Apply it to the other ten projects I audited. Apply it to every project that calls itself a Bitcoin Layer 2 while parking your BTC in a multisig. The honest question is not whether the rug will be pulled. The honest question is whether you have already positioned yourself on the other side of the exit.
