Taproot Vaults
How Non-Custodial Bitcoin Lending Actually Works
Programmable Bitcoin scripts, threshold signatures, and the escape hatch nobody can override. The architecture behind the post-Celsius Bitcoin loan.
TL;DR
Every Bitcoin-backed loan offered for the past decade has worked the same way. You send your Bitcoin to the lender. They hold it. You hope they give it back. Celsius did not. BlockFi did not. Voyager did not. Customer Bitcoin became someone else's collateral, someone else's leverage, someone else's loss.
There is a different way to build this. Lock your Bitcoin into a script on the Bitcoin blockchain that defines exactly what can happen to it. Cooperative repayment, automated liquidation, or your own escape hatch if the lender disappears. No discretion. No commingling. No rehypothecation. Verifiable by anyone with a Bitcoin node. The technology that makes this possible is Taproot, activated in November 2021. The way it is being used for lending is called a Taproot vault.
The thing that keeps killing Bitcoin lenders
Every collapsed Bitcoin lender died the same way. They held customer Bitcoin in pooled custody, which means they took everyone's deposits and mixed them into one big balance sheet. Then they did what banks do. They lent it out. To hedge funds, to internal trading desks, to sister companies, to whoever paid the highest rate.
This practice is called rehypothecation. It is legal almost everywhere, it is how virtually every traditional bank operates, and it is the source of fractional reserve banking. In a normal banking environment it works fine because there is deposit insurance, central banks acting as lender of last resort, and decades of regulatory infrastructure designed to keep the trick from unraveling.
In crypto lending, none of that exists. When the music stops, your specific Bitcoin is gone, mixed into the wreckage. You become an unsecured creditor in bankruptcy court, sometimes recovering pennies on the dollar, sometimes years later.
This is not just a Celsius problem or a BlockFi problem. It is a structural property of any lending product where the lender takes discretionary custody of your collateral. The only way to actually fix it is to remove discretion from the equation entirely. That is what Taproot vaults are for. If you have not yet locked down your own keys, our cold storage guide is a useful prerequisite.
What Taproot actually brought to Bitcoin
Bitcoin always had scripts. From day one, every Bitcoin output is locked by a small program that says "here is what you have to prove to spend me." A simple wallet locks funds with a script that says "prove you know the private key for this public key." A multisig wallet locks funds with a script that says "prove you have signatures from M out of N specified keys."
Before Taproot, complex scripts had three problems. They were public. Every condition under which the output could be spent was visible on-chain from the moment the output was created. They were expensive. Complex scripts took more block space, which meant higher fees. They were limited. The Bitcoin script language was deliberately restricted.
Taproot, activated in November 2021, changed all three. A Taproot output looks like a single public key on-chain. The complex script is hidden inside a Merkleized tree of possible spending conditions, and only the branch you actually use is revealed when you spend the output. You only pay for the branch you use, the other branches stay invisible, and the language for writing those branches (Tapscript) is more expressive than the old one.
In practice, you can create a Bitcoin output with five, ten, fifty different spending conditions, attach a different policy to each one, and have the output look like any other ordinary single-key payment on-chain until you actually need to use one of the branches. This is what makes a vault possible.
A vault, in concept
Forget the implementation details for a moment. What does the word "vault" even mean in this context?
A vault is a Bitcoin output that can be spent in more than one way, with each spending path triggering under different conditions, and where the parties with the ability to trigger each path are different.
A simple example: imagine a vault that holds family savings. It can be spent in one of three ways. Your partner signs and the funds go to a withdrawal address you both control. You alone sign and the funds go to a withdrawal address you control, but only after a 30-day timelock. A trusted family member signs along with a notary and the funds go anywhere they specify, used only in emergencies. Three doors. Each door has its own policy. A Bitcoin lending vault works on exactly the same logic.
The three doors of a Bitcoin lending vault
A non-custodial Bitcoin-backed loan vault typically has three spending paths.
Door 1: Cooperative repayment
The borrower repays the loan in dollars (usually a stablecoin). The lender's signing infrastructure verifies repayment, co-signs a transaction that releases the collateral, and the borrower gets their Bitcoin back at the withdrawal address they specified when the vault was created. This is what should happen on the vast majority of loans. It is the equivalent of paying off a mortgage and getting the deed.
Door 2: Liquidation
The borrower's collateral value drops below the liquidation threshold, or the loan term expires without repayment. This door is signed by the lender's infrastructure without the borrower's signature. The script enforces that this path can only be used to send funds to a specific liquidation address, not to wherever the lender wants. Once the funds arrive there, they enter a Dutch auction (price starts high and drops until a buyer takes it). The lender does not get to set the price. The market does. Proceeds repay the loan, with any surplus returning to the borrower.
Door 3: Unilateral exit
This is the one that matters. If the lender disappears (bankrupt, hacked, regulated out of existence, simply gone), the borrower can spend the exit door themselves. No coordination with the lender. No legal proceedings. No bankruptcy court. They construct the transaction with public tooling, broadcast it to the Bitcoin network, and the funds arrive at their wallet.
There is a catch: this path is gated by a relative timelock, typically around one year. The vault output cannot be spent through this path until enough time has passed since the deposit. The timelock gives the lender a long window to use door 1 or door 2 under normal operations. In practice, door 3 should almost never be used. It is the smoke alarm, not the front door. But the door exists, it is enforced by Bitcoin script, and no human can override it.
This is what "non-custodial" actually means in the context of Bitcoin-backed lending. Not "the lender promises to give your coins back." Not "the lender has insurance." Not "the lender uses a regulated custodian." But "if everyone running the lender vanished tomorrow, you could still recover your Bitcoin using nothing but a Bitcoin node and a piece of public software."
The locked door: the NUMS trick
There is a fourth path on every Taproot output we have not talked about. It is called the key-path spend.
A Taproot output is technically locked by a single public key, with the script paths hanging off it as a backup. Most Taproot wallets use the key-path as the cheap and private way to move funds, with all parties holding shares of the corresponding private key and signing collaboratively.
In a Bitcoin lending vault, the key-path is dangerous. If the lender and the borrower had a shared key they could use to spend the output without going through any of the three doors, the whole point of the vault would be undermined. The lender's signing infrastructure could collude (or be compromised) and move funds outside the agreed rules.
The fix is called a NUMS internal key. NUMS stands for "Nothing Up My Sleeve." The idea is to construct a public key in a way that proves nobody knows the corresponding private key. The standard approach is to take the SHA-256 hash of a known phrase (something like "SURGE-NUMS" or "BIP-341-NUMS") and use that hash as the x-coordinate of the public key. Anyone can verify the key was derived this way. Nobody can derive the private key from a hash output because that would require breaking SHA-256, which would break Bitcoin entirely.
The practical effect: the key-path spend on a properly-constructed lending vault is provably useless. The only way to spend the output is through one of the three script-path doors. The lender literally cannot bypass the rules even if they wanted to. This is the kind of detail that separates a serious non-custodial product from a marketing campaign. Always check whether the key-path is disabled in any Taproot vault you are considering trusting your Bitcoin to.
Who signs the lender's transactions: threshold signatures
Doors 1 and 2 both require the lender to sign. If the lender is a single company with a single signing key, you have just recreated the custodial model with extra steps. A compromised key, a rogue employee, or a regulatory seizure of the lender's infrastructure all become single points of failure.
The solution is threshold signatures. The lender's signing key is split across multiple independent parties, with a threshold of them required to produce a valid signature. A 3-of-5 threshold means any 3 of the 5 signers can co-sign a transaction, but 2 cannot. The signers do not need to trust each other, they just need to follow the protocol.
There are several threshold signature schemes available for Bitcoin. The two most commonly used are FROST (Flexible Round-Optimized Schnorr Threshold) and Lindell 2024. FROST is well-studied, widely implemented, and produces a valid Schnorr signature indistinguishable from a single-party signature on-chain. Lindell 2024 is newer and has a property called identifiable abort: if a signer misbehaves during the signing process, the protocol produces cryptographic evidence of who did it. That matters when you want to slash misbehaving signers economically.
The harder question, for any lender claiming a threshold signature setup, is who the signers actually are. A 3-of-5 threshold is meaningless if the 5 signers are all employees of the same company. Look for signers that are independently operated, geographically distributed, and reputationally separate. If a lender has not published the names of their signers, treat the decentralization claim as provisional until they do.
What this actually means for you as a borrower
If you are considering a Bitcoin-backed loan, the architecture above changes a few things about how you should evaluate the product.
Custody is verifiable. You should be able to look up your vault address on a Bitcoin block explorer (mempool.space works fine) and see your collateral sitting there as a regular UTXO. You should be able to verify the script, see the three spending paths, and confirm the key-path is disabled. If a lender cannot show you your collateral on-chain, you are back in the custodial model.
Rehypothecation is impossible. Your Bitcoin does not sit in a pool. It does not get lent out to traders. It does not move at all between deposit and withdrawal, unless one of the three doors is triggered. You can verify this on-chain at any time.
The escape hatch is real. If the lender disappears, you can recover your collateral yourself. Test this in advance. Run the unilateral exit tool on a testnet vault. Verify it works. Do not take the lender's word for it.
The trust assumption shifts. You are no longer trusting the lender's solvency, custodianship, or insurance arrangements. You are trusting that the Bitcoin script does what it says, that the threshold signature setup has enough independent signers to prevent collusion, and that the EVM credit contracts (if the lender uses any) have been audited.
Smart contract risk is real. Most non-custodial Bitcoin lending products use an EVM chain for the credit accounting layer. The Bitcoin side might be airtight while the EVM side has a bug. The audit posture on both sides matters.
Liquidation behavior is different. In a custodial lender, liquidation usually means "the lender sells your BTC at whatever price they can get internally." In a non-custodial vault, liquidation usually means "your BTC enters a public Dutch auction." The auction mechanic is more transparent but also slower.
A real-world implementation: Surge Credit
The most fully-developed implementation of the architecture described above is Surge Credit, a Bitcoin-backed dollar credit line that launched mainnet public beta in April 2026.
Surge constructs Taproot vaults with the exact three-door pattern described in this post. Cooperative repayment, automated liquidation via Dutch auction on Base (Coinbase's Ethereum L2), and unilateral exit with a CSV timelock of roughly one year. The key-path is disabled using a NUMS internal key derived from the SHA-256 hash of the string "SURGE-NUMS." The threshold signature scheme is Lindell 2024 with a simple-majority threshold across a Distributed Custody Network. The credit accounting runs on Base. USDC flows cross-chain via Circle's CCTP v2.
The protocol-level work is being audited by Brandon Black (reardencode), co-author of BIP-349 (OP_INTERNALKEY) and former Taproot wallet engineer at BitGo. The EVM contracts are also in audit as of writing. The governance structure is a two-entity model (Amby Inc. building the software, Surge Foundation governing the protocol) similar to Aave and Morpho.
For the purposes of this explainer, Surge is the cleanest current example of how the Taproot vault model actually gets shipped in a usable product. The vault construction is principled, the key-path disabling is correct, the threshold signature scheme is well-chosen, and the escape hatch is real and testable. Other implementations of similar architectures will follow, and should. See our full Surge Credit review for rates, terms, current track record, and the honest tradeoffs of using a beta product.
What to look for in any Bitcoin-backed lender
A quick checklist if you are evaluating any product that claims to be non-custodial.
- Can you see your collateral on-chain? Look up your vault address on mempool.space or any Bitcoin explorer. It should be a normal UTXO controlled by a Taproot script, not a balance on the lender's internal ledger.
- Is the key-path disabled? Ask the lender. The answer should be yes, and they should be able to point you to the NUMS construction. If the answer is no or they do not know what you are talking about, the vault is not actually non-custodial.
- Does the unilateral exit path exist, and can you test it? Ask for the exit tool. Run it against a testnet vault if available. Verify the timelock duration. Verify the path works without any dependency on the lender's infrastructure.
- Is the threshold signature setup transparent? How many signers? Are they named? Are they independent? Is there a path for new signers to join over time?
- What is the audit posture? Who audited the Bitcoin script side? Who audited the EVM side? Are the reports public? Have remediations been completed?
- What happens in liquidation? Is it a Dutch auction, an internal sale, a centralized order book? Where do auction proceeds go? Does surplus return to the borrower?
- Where does the lender hold its keys? Hardware security modules? Hot infrastructure? Multi-cloud? Geographic distribution?
- What is the governance structure? Is the protocol upgradable? Who controls the upgrade keys? Is there a foundation? Is the team accountable to anyone beyond their VCs?
A lender that fails on any single one of these is not necessarily a bad lender, but each gap is something you should understand before deciding how much capital to entrust to them. Lenders that score well across the whole checklist are rare today. They will become less rare over the next few years.
The frontier and what still needs solving
The Taproot vault model is not finished. Several things still need to mature before it becomes mainstream-ready.
DCN decentralization at scale. Today, distributed custody networks are typically small (3 to 10 signers) and often opaque about identities. Scaling to dozens or hundreds of independent signers, with public reputation and economic skin in the game, is an open problem.
Cross-chain dependency. Most non-custodial Bitcoin lenders use an EVM chain for the credit engine because Bitcoin script alone cannot easily handle interest accrual, variable rate calculations, or multi-asset accounting. If the credit chain goes down, the day-to-day borrow flow is broken. The unilateral exit path remains available, but the live experience is degraded. Reducing this dependency is an active area of research.
Native Bitcoin off-ramps. Most products today output USDC, a stablecoin on an EVM chain. Getting from USDC to fiat in a bank account still requires a centralized exchange or a service like MoonPay. Bitcoin-native fiat off-ramps need to mature for the experience to feel as smooth as a custodial lender.
Tax and legal clarity. Non-custodial loans against Bitcoin collateral occupy a different legal category than traditional secured loans. The treatment under different countries' tax codes is unsettled. Borrowers should consult their tax advisor.
Cross-vault privacy. Today, every vault looks slightly different on-chain, which means a sophisticated observer could potentially cluster all of a lender's vaults together based on script patterns or transaction graphs. Improving the on-chain anonymity set is ongoing.
Closing
The Bitcoin-backed loan market is in the middle of a transition. The custodial model that defined the 2020-2022 cycle ate three of its biggest players. The next cycle is being built on a different foundation, one where the lender's promise is replaced by a script anyone can verify and an escape hatch nobody can override.
It is not finished. The decentralization story has gaps, the user experience has friction, and the audit infrastructure is still maturing. But the direction is right, and it is the only direction that addresses the actual root cause of why Bitcoin lenders keep blowing up. If you are going to borrow against Bitcoin, understand which model you are using. If you are going to lend Bitcoin (or stablecoins backed by Bitcoin), understand who actually holds the keys. The technology to do this properly exists today. The products that use it correctly are still rare. But the gap is closing, and "trust us" is a less acceptable answer with every cycle.
Frequently Asked Questions
What is a Taproot vault?
A Taproot vault is a Bitcoin output locked under a Taproot script with multiple possible spending paths, where each path triggers under different conditions and is enforced by Bitcoin script rather than by a custodian. In the context of Bitcoin-backed lending, a typical vault has three paths: cooperative repayment, automated liquidation, and a unilateral exit for the borrower if the lender disappears. The vault address is a regular Bitcoin UTXO you can look up on any block explorer like mempool.space.
What is rehypothecation and why does it matter for Bitcoin loans?
Rehypothecation is when a lender takes your collateral and uses it for their own purposes: lending it out to traders, posting it as collateral for their own loans, or otherwise putting it at risk. It is legal almost everywhere and it is how virtually every traditional bank operates. In crypto lending, it was the mechanism that bankrupted Celsius, BlockFi, and Voyager. When the lender's bets fail, your specific Bitcoin is gone, mixed into the wreckage of their balance sheet. You become an unsecured creditor in bankruptcy court. Non-custodial Taproot vault designs make rehypothecation structurally impossible because your Bitcoin never leaves the script.
What is the NUMS trick?
NUMS stands for "Nothing Up My Sleeve." In a Taproot lending vault, the key-path spend is a fourth potential way to move funds that would let the parties bypass the script paths. To disable it, builders construct the internal public key from the SHA-256 hash of a known phrase like "SURGE-NUMS" or "BIP-341-NUMS." Anyone can verify the key was derived this way, and nobody can derive a private key from a hash output because that would require breaking SHA-256. The result: the key-path is provably useless and the lender cannot bypass the script even by collusion.
Can my Bitcoin be moved without my permission in a Taproot vault?
Only through one of the explicit script paths, never through discretion. Cooperative repayment requires you to repay the debt and then both parties co-sign. Liquidation can only happen if your collateral ratio breaches the liquidation threshold, and even then the proceeds must flow through a defined liquidation address and Dutch auction. Outside those two cases, the only remaining path is your own unilateral exit, which is gated by a relative timelock of roughly one year. There is no path that just lets the lender take your Bitcoin.
Do audits actually help?
Yes, but only when they are public, recent, and performed by people who understand the specific technology being audited. For Taproot vault lending products, you want at least two audits: one on the Bitcoin script side from a Bitcoin-specific protocol specialist (not a generic crypto auditor) and one on the EVM smart contract side that handles the credit accounting. Both reports should be public and any findings should have documented remediations. If a lender claims audits exist but cannot show you the reports, treat the claim as unverified.
FROST vs Lindell 2024 (Lin24): which threshold signature scheme is better?
Both produce valid Schnorr signatures on-chain that are indistinguishable from a single-party signature. FROST is older, more widely studied, and the default for most threshold signature deployments. Lindell 2024 is newer and has a specific property called identifiable abort: if a signer misbehaves during signing, the protocol produces cryptographic evidence of who did it. That matters when you want to slash misbehaving signers economically. For a borrower, both are reasonable choices and both are stronger than a single signing key. The harder question for any lender is who the signers actually are, not which scheme they use.
Why do most non-custodial Bitcoin lenders use Base or another EVM chain?
Because Bitcoin script alone cannot easily handle interest accrual, variable rate calculations, multi-asset accounting, or Dutch auctions. EVM chains can. The split is: Bitcoin holds the collateral in the Taproot vault, and the EVM chain (commonly Base, Coinbase's Ethereum L2) runs the credit engine. USDC moves cross-chain via Circle's CCTP. The tradeoff is real smart-contract risk on the EVM side, and a dependency on that chain being functional for day-to-day borrowing and repayment. The unilateral exit path remains available even if the EVM chain goes down.
Can I recover my Bitcoin if the lender disappears?
Yes, if the vault is built correctly. The unilateral exit path is the entire point of the design. After a relative timelock (typically around one year), you can construct a Bitcoin transaction yourself using the public exit tool, broadcast it to the Bitcoin network, and the funds arrive at your wallet. No coordination with the lender. No bankruptcy court. You should test the exit tool in advance on a testnet vault to verify it works, not take the lender's word for it.
Further reading
Surge Credit Review
Honest review of the first mainstream Taproot vault credit line.
Best Bitcoin Loans 2026
Full comparison of every major Bitcoin-backed loan platform.
Hodl Hodl / Debifi Review
Non-custodial multisig P2P loans. A different non-custodial model.
Bitcoin Cold Storage Guide
How to actually hold your own Bitcoin in the first place.
Bitcoin Privacy Guide
How to protect your transactions and limit information leakage.
Bitcoin Security Guide
Self-custody best practices that pair well with non-custodial lending.