How Does Function FBTC Work?
Function FBTC is an omnichain wrapped Bitcoin token backed 1:1 by real BTC held in custody by a Security Council of three institutions (Antalpha, Cobo, and Mantle). It lets Bitcoin holders earn yield across 30+ DeFi applications on 12+ blockchains without selling their BTC. Minting requires institutional KYB verification — ordinary users buy FBTC on secondary markets or access it through approved vaults. While the multi-party custody model is more robust than single-custodian alternatives like wBTC, it still carries meaningful centralization risks: a small group of admin keyholders can pause the entire system, and the contract creator retains minting and fee-change authority.
TVL
$542M
Sector
Bridge
Risk Grade
C-
Value Grade
C-
Core Mechanisms
Custody > Custodial Bridge > MPC/TSS Multisig
NovelTSS threshold signature network with Cobo MPC infrastructure; BTC deposited to MPC addresses controlled by Security Council (Antalpha, Mantle, Cobo) using threshold signatures to prevent unilateral action
Rather than a single custodian or federated peg, FBTC uses TSS nodes so no single party holds full key shares. Cobo provides the MPC tech stack. This is a step toward trust minimization vs wBTC but still relies on a 3-party permissioned council.
Bridge > Omnichain > Cross-Chain Mint/Burn
FireBridge smart contract enables cross-chain FBTC transfers across 12+ chains. Merchants initiate burn on source chain and mint on destination; TSS network confirms and authorizes
Standard lock-and-mint bridge pattern but executed through the TSS council rather than a dedicated bridge validator set. Deployed across Ethereum, Mantle, Arbitrum, Base, BNB, Solana, Aptos, Sui, and more.
Reserve Asset > Proof of Reserve > Chainlink PoR
Chainlink Proof of Reserve oracle attests on-chain that BTC reserve addresses hold sufficient BTC to back all circulating FBTC 1:1; reserve addresses are publicly listed
Chainlink PoR integration provides transparency and prevents unbacked FBTC minting. However, the oracle update frequency and latency create a window during which reserve discrepancies may not be reflected on-chain.
Access Control > Permissioned Minting > KYB Merchant Model
Only KYB-verified merchants (institutions) can directly mint/burn FBTC. Retail users access FBTC through secondary markets or approved DeFi protocol integrations
Permissioned minting reduces retail risk but concentrates FBTC supply among institutional actors. Contract Owner (Safe MultiSig) can add/remove merchants at will, creating a centralization risk. GoPlus flagged mint authority concentration.
Yield > Aggregation > DeFi Strategy Routing
FBTC is deployed as collateral/yield-bearing asset across 30+ DeFi protocols including Aave, EigenLayer, Babylon, Ethena, and Kamino. Yield vaults route FBTC into structured strategies (lending, liquid staking, liquidity provision)
FBTC itself is passive; yield comes from underlying DeFi protocol interactions. This introduces stacked protocol risk: FBTC holders are exposed to slashing (EigenLayer/Babylon), smart contract exploits (Aave), and depegs (Ethena) in their yield strategies.
How the Pieces Interact
If the TSS Security Council (Antalpha/Mantle/Cobo) is compromised, colluded, or censors transactions, both BTC redemptions AND cross-chain transfers are blocked simultaneously — users cannot exit or rebalance across chains
Admin (Contract Owner via Safe MultiSig) can arbitrarily pause minting, burning, and cross-chain transfers — if this power is exercised maliciously or in response to regulatory pressure, FBTC holders cannot redeem their BTC
Chainlink PoR oracle latency creates a window between actual BTC reserve changes and on-chain attestation. A compromised custodian could drain reserves before the oracle reports the discrepancy, enabling unbacked FBTC to circulate
FBTC deployed as collateral across DeFi protocols (Aave, EigenLayer) faces liquidation or slashing risk; a rapid devaluation event could trigger cross-chain unwinding that strains the TSS bridge throughput, creating redemption bottlenecks
Extreme whale concentration (only ~11K FBTC tokens, near-zero daily volume) means a single large merchant exit creates acute secondary market illiquidity. DeFi protocols using FBTC as collateral could face cascading liquidations if FBTC liquidity evaporates
What Could Go Wrong
- Centralized admin keys allow contract owner to pause mints/burns, modify fees, and mint tokens arbitrarily — GoPlus flagged these as material risks
- Custodial BTC held by Cobo/Antalpha/Mantle TSS nodes: if the 3-of-3 Security Council is compromised or colluded, the entire $789M in BTC backing could be at risk
- Extreme whale concentration: only ~11,000 FBTC tokens in circulation with near-zero daily trading volume, creating acute illiquidity and price manipulation risk
Security Council Compromise or Collusion
TailTrigger: One or more TSS Security Council members (Antalpha, Mantle, Cobo) is hacked, coerced by state actors, or colluded — enabling unauthorized BTC reserve withdrawal
- 1.Attacker compromises key shares held by one TSS council member (e.g., via Cobo custody breach) — Attacker gains partial signing capability; begins probing for second key share or colluding with another council member
- 2.With 2-of-3 TSS threshold met, unauthorized redemption request initiated for large BTC withdrawal from reserve addresses — BTC begins leaving custody to attacker-controlled wallet; Chainlink PoR oracle has not yet updated to reflect reserve shortfall
- 3.Reserve shortfall discovered through on-chain analysis or Chainlink PoR oracle update; FBTC/BTC peg breaks on secondary markets — FBTC holders rush to redeem but legitimate redemptions are also paused pending investigation; DeFi protocols using FBTC as collateral trigger mass liquidations
- 4.Protocol is paused by Contract Owner; merchants cannot mint or burn; cross-chain bridges frozen — All $789M+ in FBTC TVL is frozen; users cannot exit positions; DeFi protocols with FBTC collateral face insolvency as collateral is now worthless
Risk Profile at a Glance
Overall: C- (54/100)
Lower score = safer