Wrapped Bitcoin (wbtc) officially launched on chain on January 2019, part of a consortium led by BitGo and included partners such as AirSwap, Dharma, ETHfinex, GOPAX, Kyber Network, Prycto, Ren and Set Protocol. The core issue that led to this was that Kyber Network wanted a Bitcoin denominated market on their decentralized exchange. The problem being that Kyber Network ran on the Ethereum blockchain, whereas Bitcoin was its own blockchain and protocol. Wrapped Bitcoin launched creating the connective tissue between Bitcoin and Ethereum, it was now possible to hold Bitcoin on Ethereum and use it to buy other ERC-20 tokens on Ethereum.
In 2020 I launched wrapped.com to scale this out to every asset. Why just Bitcoin when you can connect every asset out there to the Ethereum blockchain? With every blockchain-asset on Ethereum you now open up distribution and use cases that are not available on the native chains.
Quick Note on Regulatory Structures (not legal advice)
For this method to work, it requires three parties or concepts to come together. A legal issuer, a custodian and a technology provider. Generally speaking if 1:1 parity or greater is maintained between the underlying asset and the wrapped asset, these fall under commodities laws and need to be exchangeable with the underlying by authorized users.
Centralized vs. Decentralized
At the time, there was a lot of skepticism around using a centralized solution, the industry was hyper-focused on fully decentralized protocols.
“How can you trust a centralized custodian?” people would ask me.
“How can you trust an anonymous group of people with your money?” I would respond.
Looking at the teams running these bridges back then, several things made me uncomfortable. Most of them did not have a background in cybersecurity, and I could not find any track record of them working at notable tech companies.
When I looked at the GitHub repository for Anyswap, a major bridge at the time, I noticed that almost all of their commits were coming from a single developer. For a properly managed codebase, you want diversity of development and a second pair of eyes. A single developer committing directly to production creates a single point of failure that can compromise the entire protocol. In reality, it looked less like a decentralized operation and more like a group of people coding behind a single shared account.
There was also the basic question of accountability. If you are a finance professional managing other people’s money, you generally have publicly verifiable credentials and a reputation built over time. Entrusting hundreds of millions of dollars in cross-chain liquidity to pseudonymous, unaccountable profiles had become too commonplace.
Over time, even with the better-regarded teams, architectural weaknesses led to billions in bridge hacks:
Bridge Date Stolen Amount Primary Attack Vector
Ronin Bridge Mar 2022 ~$624M Social engineering & validator key compromise (Lazarus Group)
Poly Network Aug 2021 ~$611M Privilege escalation via cross-chain keeper overwrite (EthCrossChainData)
BSC Token Hub Oct 2022 ~$586M Cryptographic proof forgery (IAVL Merkle tree validation bug)
Wormhole Feb 2022 ~$326M Signature verification bypass on Solana via spoofed sysvar account
Nomad Bridge Aug 2022 ~$190M Contract upgrade error setting trusted Merkle root to 0x00
Anyswap Jul 2021 ~$126M+ ECDSA R-value reuse (2021); centralized MPC key compromise & server seizure (2023)
Harmony Horizon Jun 2022 ~$100M Inadequate multi-sig threshold (compromise of 2 out of 5 validator keys)
Orbit Bridge Dec 2023 ~$81.5M Multi-sig validator private key compromise
Qubit (QBridge) Jan 2022 ~$80M Unhandled address(0) logic error in ETH deposit routineSo Why Centralized?
The reason to stay centralized was that the technology around keys at the time was hardened. The ins and outs of custody had been figured out, the operational controls of it were something I understood well, having made the first multi-signature wallet for Ethereum. Additionally, bridges had and still have to wait a significant amount of time prior to clearing the asset on the other side. With a centralized solution, the confirmation requirements follow what exchanges have learned to follow to avoid risk of transaction reorgs. All of the elements of a centralized bridge had been battle tested by 2020, the only piece of the puzzle that was new was the minting and burning logic.
Welcome to the App Store
Wrapping an asset onto Ethereum future-proofs it. As decentralized options, perps and loans came about, these assets are ready on day one for integration. Because they are ERC-20 compatible, the new applications are already compatible with all of the wrapped assets that are launched. .
The progression:
Wrap every asset: Whether it is a layer-one blockchain or a security, bring it to Ethereum for distribution and composability.
Generate yield: A static 1:1 receipt is just the beginning. The next phase is turning every idle balance sheet into productive capital.
Shouldn’t every financial asset work this way? Today we have cryptocurrencies. Tomorrow, every stock and financial asset will be launched with native access to the App Store for generations to come.
Originally published on The Masonic. Subscribe for occasional writing on tokenization, compliance, and what’s actually happening at the frontier of financial technology.