WBTC, introduced on the what is wrapped bitcoin homepage and compared row by row against native BTC on the WBTC vs native Bitcoin page, uses a custodial model: a named custodian holds the Bitcoin backing every WBTC in circulation. That is not the only way to get Bitcoin’s value onto Ethereum. A different family of designs, generally described as trustless or decentralized bridges, tries to remove the single custodian from the picture entirely. Neither approach is simply “better” — they make different trade-offs between convenience, accountability, and the number of places something can go wrong.
The two models, side by side
| Custodial (WBTC’s model) | Trustless / decentralized bridge | |
|---|---|---|
| Who holds the BTC | A named custodian (BitGo, for WBTC) in multi-signature wallets | Distributed across a decentralized set of nodes or validators, or locked via a non-custodial contract design |
| How minting is verified | The custodian confirms BTC was received, then mints | Protocol-level verification — typically threshold signing or multi-party consensus — without one party in sole control |
| What failure looks like | Custodian insolvency, compromise, or regulatory action could impair redemption | A bug in the bridge software, or collusion among enough validators to defeat the threshold |
| Regulatory accountability | Custodian can hold formal licensing — BitGo operates as an OCC-chartered National Trust Bank | Typically no single regulated entity responsible for the reserves |
| Where WBTC fits | WBTC is the clearest large-scale example of this model | Not WBTC’s design — a separate category of wrapped-asset architecture |
The trust assumption each model actually asks you to make
With a custodial model, the trust assumption is concentrated and legible: you are trusting one identifiable organization’s security practices, solvency, and regulatory standing. That concentration is also what makes formal oversight possible — a chartered custodian can be audited, licensed, and held accountable in ways a diffuse validator set cannot. The cost is a single point of failure: if that one organization fails, the whole system built on top of it is affected at once.
With a trustless or decentralized bridge model, the trust assumption is spread across a validator set or protocol design instead of one organization. In principle, no single party’s failure should be able to break the system on its own. In practice, this shifts the risk rather than removing it: instead of trusting one custodian’s operational security, a holder is trusting that the bridge’s code is correct and that its distributed verification process cannot be defeated by collusion or a software flaw. Neither risk is smaller by default — they are simply different failure modes, and a full comparison of what each actually costs in risk terms is on the WBTC risk profile page.
Frequently asked questions
Is a trustless bridge automatically safer than a custodial model?
No. It removes a single custodian as a point of failure, but replaces that risk with trusting the bridge's code and its distributed verification process. Neither model is risk-free u2014 they fail in different ways.
Why does WBTC use a custodial model instead of a trustless one?
The custodial model concentrates accountability in one identifiable, licensable organization (BitGo), which makes formal regulatory oversight possible in a way a diffuse validator set does not.
Can a custodial wrapped-BTC design be regulated?
Yes u2014 WBTC's custodian, BitGo, operates as an OCC-chartered National Trust Bank as of 2025, which puts formal regulatory oversight around the custodial role.