6 Months of Clementine - First Trust-Minimized Bitcoin Bridge

Historically, Bitcoin bridges have relied almost exclusively on federated multi-signature setups (such as 3-of-5 or 5-of-7 signers). These legacy designs require users to place complete trust in a small committee of key holders, creating central points of failure and significant custodial risks.

Citrea’s trust-minimized bridge, Clementine, fundamentally shifted this security model when it launched into live production. Powered by BitVM and zero-knowledge (ZK) cryptography, cBTC debuted as the first trust-minimized BTC representation on a fully programmable Bitcoin layer.

150 BTC Volume

The Clementine Bridge requires peg-in transactions to be exactly 10 BTC or multiples thereof. Over its first six months in production, Clementine has successfully processed 150 BTC in total bridging volume, making it the first BitVM-based bridge to a fully programmable platform to achieve such a milestone.

Moving large amounts of Bitcoin requires minimizing trust assumptions as much as possible. Clementine achieves this by reducing the peg-out trust to a 1-of-N honesty assumption. As long as a single Signer and a single Watchtower remains honest, incorrect peg-outs cannot succeed. Because of these strong cryptographic guarantees and the resilience against any attacker controlling less than ~45% of Bitcoin's hash rate, Citrea’s institutional partners have actively used Clementine as their chosen bridge to carry large volumes of capital safely.

Why Institutions Choose to Use Clementine Bridge

Institutions choose Clementine because it cryptographically protects funds against both liveness failures and theft. Instead of trusting a multisig committee, security relies on an optimistic verification on Bitcoin via BitVM2. Operators must lock a slashable collateral, which backs an entire round of multiple user withdrawals. If an Operator acts maliciously, a single successful challenge will slash their entire collateral, heavily disincentivizing fraud while remaining highly capital efficient.

How Funds Move Around

To understand how Clementine safely moves capital between Bitcoin L1 and Citrea, we can look at the two core flows:

Peg-In (Depositing to Citrea)

1. User Deposit: A user sends 10 BTC to a Taproot address encoded with two paths. The first is the Bridge path, spendable only with all Signers' signatures and the user's EVM address inscribed. The second is a Refund path, allowing the user to reclaim funds via a timelock (after 200 blocks) if the bridge fails to act.
2. Move to Vault: Signers sign a transaction that moves the deposit into a "vault" UTXO. This step effectively ensures funds can only follow Clementine’s pre-approved exit paths.
3. Minting cBTC: Once the vault transaction is finalized (6+ blocks), the Bridge smart contract on Citrea verifies it using a Bitcoin Light Client contract. Upon success, 10 cBTC is natively minted to the user's Citrea address.

Peg-Out (Withdrawing to Bitcoin L1)

1. Initiating Exit: A user burns cBTC on Citrea via the system contract's safeWithdraw function, submitting a Payout transaction template to the Operators.
2. The Instant Optimistic Payout: If all signers are online, they can execute an Optimistic Payout natively. If a signer is offline for 12 hours, an Operator steps in, attaches their own input to the user's template using SIGHASH_SINGLE|ANYONECANPAY, and front-pays the user on Bitcoin L1.
3. Operator Reimbursement: The Operator posts a KickOff claim to Bitcoin to ask for reimbursement. This triggers a dispute window. If no disputes occur, the Operator successfully reimburses themselves from the bridge vault.
4. Dispute & Challenge: If an Operator makes a fraudulent claim, a Challenger detects it and initiates a dispute. A Watchtower then posts the current finalized canonical Bitcoin header-chain proof. To defend themselves, the Operator must provide a zkSNARK Light Client Proof showing their committed chain has more proof-of-work and includes the valid user payout. If the Operator is malicious, they cannot produce a valid proof; they lose the challenge, their BTC collateral is completely slashed, and they are kicked out of the operator set.

What's Next? - Improving Clementine's Design

While Clementine successfully proved that BitVM2-based bridging works in production and is trusted with large volumes, it can further improve to reduce required operator collateral and simplify the protocol.

We’re actively working on improving Clementine’s design with BitVM3. We’ll soon release a technical write-up about Clementine’s upcoming design.

Read more about Clementine: Whitepaper & Official Documentation.