Cross by proof
Bitcoin and Ethereum, each way proven. Nobody signs in between.
Bitcoin, proven on Ethereum to block ·
Ethereum, proven for Bitcoin to block
Your bridges
Two chains, one state
Each chain keeps a proven copy of the other’s Tacit state. We call it reflection. A bridge is a burn on one side and a mint on the other, with a proof in between.
- No federation
- No multisig
- No soft fork
- Live on mainnet
Reflection
- Bitcoin, inEvery block, once 24 deep. Each Tacit envelope in it is folded into proven roots.
- Ethereum, inEvery finalized block, by its sync committee’s signatures, checked by a light client.
- One proof, outVerified by the pool, an immutable contract. Nobody signs it, and anyone can make it.
Burn, prove, mint
- 1 · BurnThe note is burned on Bitcoin, in one Taproot transaction. Its amount stays hidden.The note leaves the pool in a cross-out, written into the pool’s storage. Its amount stays hidden.
- 2 · ProveOnce 24 blocks deep, the burn is folded into Bitcoin’s proof, and the pool verifies it.Once Ethereum finalizes it, the cross-out is proven inside Bitcoin’s proof.
- 3 · MintThe pool mints the same note, privately, once per burn. A second claim fails.A Bitcoin transaction mints the same note, once, as a proven member of the cross-outs.
One note, two chains
A Tacit note is a Pedersen commitment on secp256k1, the curve both chains already use. The same commitment is the note on Bitcoin and in the pool on Ethereum, so a bridge moves the note without opening it.
C = v·H + r·G · amount v hidden, blinding r known to its owner alone
Bitcoin, proven on Ethereum
- Headers, by workA permissionless relay on Ethereum checks every Bitcoin header’s proof of work. The heaviest chain wins.
- Every envelope foldedA program re-hashes each block to its Merkle root and folds every Tacit envelope in it: transfers, trades, burns, locks.
- One proofSP1 proves the fold. Its tip must sit 24 blocks under the relay’s.
- Checked by the poolThe pool verifies the proof against a pinned key, then mints each proven burn once, keyed by its burn id.
Ethereum, proven back
- Finality, signedEthereum’s sync committee signs each finalized block. A light client checks the signatures, period after period, from a pinned anchor.
- The pool’s storageStorage proofs against the finalized state root read the pool’s cross-outs, the notes it consumed, and its outbox.
- Inside Bitcoin’s proofThe Bitcoin program verifies the Ethereum proof recursively. One proof carries both chains.
- Folded on BitcoinA crossed-out note is minted on Bitcoin only if its claim is a member of the proven set, and only once.
Who checks what
Every hop of a bridge is checked by math anyone can rerun.
No multisig, federation or attestor set signs a bridge message. Anyone can run the provers.
Every header’s work is checked on Ethereum by a permissionless relay. Bitcoin’s proof must sit 24 blocks deep; a deeper reorg halts reflection rather than rewriting it.
Checked inside the proof by a light client built on sp1-helios, chained period to period from a pinned anchor, and bound to Ethereum’s genesis so no other chain’s proof passes.
Every proof is verified on Ethereum against pinned verifying keys. Nobody can change them.
Bitcoin reflection 0x00bb158b…074bc5Ethereum reflection 0x00ca8171…6aea72Ops ride in Taproot witnesses. Every indexer that runs the same rules over the same chain reaches the same state, and the reflection proves that state.
Each program rebuilds byte for byte from source and is pinned by SHA-256 to its verifying key.
Rebuild it →In step, right now
The same note, proven twice
TAC on Ethereum, every one minted from TAC proven to have left Bitcoin.
- Out of the pool
A cross-out burns the note on Ethereum.
Ethereum tx - Minted on Bitcoin
Bitcoin’s side proves the cross-out and mints it.
Bitcoin tx - Burned on Bitcoin
The note goes back the way it came.
Bitcoin tx - Back in the pool
Ethereum proves the burn and mints it.
Ethereum tx
Ready for covenants
When Bitcoin can enforce where an output is spent, a cBTC lock becomes a vault that only a redemption opens, with no bond behind it. The bytes are already reserved.