What is BEVM?
👋 New to this? Just start reading at the top — it begins in plain English and gets more detailed as you scroll. Jump to any level:
🟢 The simple version
Plain English — no jargon. Start here.
BEVM (Bitcoin EVM) is a Bitcoin Layer 2 network that uses Schnorr threshold signatures and Bitcoin Script to create a decentralised, trustless BTC custody layer under an EVM-compatible smart contract environment — attempting to solve the trust problem that centralised multisig bridges introduce in other Bitcoin L2s.
The Bitcoin L2 trust problem
Most Bitcoin L2s (including Merlin Chain) use multi-signature custody — a group of validators collectively hold the Bitcoin that users bridge in. If enough validators collude or are compromised, bridged BTC can be stolen. This is a known weakness and the primary risk in Bitcoin L2 bridges.
BEVM's approach to this problem uses Schnorr threshold signatures and Bitcoin Script to create a custody mechanism that is cryptographically enforced rather than trusting validators. The custody contract is expressed as a Bitcoin Script that can only be unlocked by a Schnorr threshold signature generated collaboratively by a large validator set — making compromise requiring coordinated attacks on a large distributed validator network.
Schnorr threshold signatures on Bitcoin
Bitcoin's 2021 Taproot upgrade introduced Schnorr signatures — a signature scheme with a useful property for multi-party computation: multiple parties can collaboratively generate a single valid Schnorr signature that looks identical to a single-party signature on-chain. BEVM uses MuSig2 (a Schnorr multi-signature scheme) with a threshold structure: t-of-n validators must collaborate to produce a valid signature for any BTC withdrawal from the bridge. No single validator can move funds unilaterally.
EVM on Bitcoin security
Above the custody layer, BEVM runs a standard EVM-compatible execution environment. Developers deploy Solidity contracts. Users interact with DeFi protocols using bridged BTC (called BEVM-BTC or WBTC within BEVM). The EVM state is periodically committed to Bitcoin as ZK proofs or state roots, providing Bitcoin-anchored finality.
Is it legal in India?
Yes. BEVM is a VDA under Indian law. 30% tax and 1% TDS apply. See India regulation.
🟡 A bit more detail
For when you want to go a little deeper.
The decentralised bridge architecture
BEVM's bridge is designed to operate without any central custodian. The validator set runs a distributed key generation (DKG) protocol at network formation — collectively generating a threshold Schnorr key without any single party knowing the full private key. The generated public key corresponds to a Bitcoin P2TR (Taproot) address that receives bridged BTC. Withdrawals require a threshold of validators to collaboratively sign a Bitcoin transaction spending from this address. Because the key was generated with no party knowing the full secret, compromise requires attacking the threshold fraction of validators simultaneously.
BEVM launched its mainnet in 2024, targeting the same Bitcoin DeFi market as Merlin Chain but with a focus on the decentralisation narrative — users who are concerned about bridge centralisation risks. BEVM has attracted DeFi protocols and yield products using wrapped BTC. The project has positioned itself as a more trust-minimised alternative to federated Bitcoin bridges like Liquid Network and multisig-based L2s like Merlin. The Schnorr MuSig2 technology used by BEVM is the same that underlies Lightning Network's Taproot Channel improvements.
Comparison with other Bitcoin L2s
BEVM is one of several "Bitcoin EVM" L2s that launched in 2024 alongside Merlin Chain, B² Network, and BitLayer. Each makes different trade-offs: Merlin prioritises speed and Bitcoin-native asset compatibility; BEVM prioritises bridge decentralisation; B² Network focuses on ZK proof verification on Bitcoin; BitLayer uses BitVM for trustless dispute resolution. The Bitcoin L2 landscape in 2024-2026 resembles the Ethereum L2 landscape in 2021 — many competing approaches, unclear long-term winners.
Key BEVM metrics: validator set size (decentralisation indicator), TVL, bridge transaction volume, and the number of DeFi protocols deployed. The critical technical claim to evaluate is whether the Schnorr threshold signature scheme actually achieves the security properties claimed — distributed key generation protocols have had vulnerabilities in other implementations, and independent security audits are the primary way to assess real-world safety. Live data: CoinGecko · BEVM Explorer.
🟣 The full technical picture
For the technically curious.
MuSig2 and BEVM's distributed key generation
MuSig2 (Nick, Noether, Kwon, 2021) is a two-round multi-signature protocol for Schnorr signatures. In BEVM's threshold variant: n validators participate in a distributed key generation (DKG) ceremony. Each validator generates a key share and publishes a commitment. The DKG protocol produces a group public key (the Bitcoin bridge address) and individual secret shares held by each validator. To sign a withdrawal: a threshold t of validators each generate a partial signature using their share and published nonces; these partial signatures are aggregated into a single valid Schnorr signature indistinguishable from a single-party signature. The Bitcoin P2TR output requires only this single aggregated signature — the Bitcoin network sees a standard Taproot spend.
Source: BEVM documentation. docs.bevm.io · MuSig2 paper: iacr.org/2020/1261 (Nick, Noether, Kwon, 2020)
EVM execution and Bitcoin state commitment
BEVM's EVM layer uses a standard Ethereum-compatible execution environment. BEVM state roots (Merkle roots of the EVM state trie) are periodically published as OP_RETURN outputs in Bitcoin transactions. This Bitcoin-anchored state commitment provides a historical record: even if BEVM's own nodes go offline, the state root sequence is permanently preserved on Bitcoin. Anyone can use this sequence to reconstruct BEVM's valid state history. The state commitment frequency (every N blocks) determines the worst-case reversion risk — a compromise of BEVM between commitments could affect transactions since the last commitment, but not before it.
BEVM's Schnorr threshold scheme uses a (t, n) threshold where t-of-n validators must sign. For t = 2/3 × n (a supermajority threshold common in BFT protocols), an attacker needs to compromise 67%+ of all validators simultaneously to steal bridged BTC. If validators are geographically distributed, jurisdictionally diverse, and running on independent infrastructure, this represents a substantially higher attack cost than a standard 15-member multisig federation (where only 8 members need to be compromised in an 11/15 setup). The DKG ceremony's integrity is the critical assumption — a backdoored DKG could produce keys the attacker already controls without other validators knowing.
Key facts
- Type: Bitcoin L2 (EVM-compatible, Schnorr threshold bridge)
- Bridge mechanism: MuSig2 Schnorr threshold signatures (DKG)
- Key innovation: Decentralised BTC custody without trusted custodian
- Bitcoin commitment: EVM state roots in OP_RETURN outputs
- Taproot integration: P2TR bridge address (aggregated Schnorr sig)
- Mainnet: 2024
- Comparison: More decentralised bridge than Merlin/Liquid