WBTC is the dominant Bitcoin bridge for DeFi with $9B TVL, but its centralized custody model concentrates significant risk in a small number of regulated entities. The 2024 custodian controversy and subsequent DeFi delistings demonstrate how off-chain governance decisions can rapidly impact on-chain market confidence. Rate: C (medium risk) — suitable as a DeFi primitive only for users comfortable with custodial bridge risk.
Risk Breakdown
Top Risks
Custodial dual-entity risk: WBTC relies on BitGo (now a federally OCC-chartered bank, NYSE-listed as BTGO since January 2026) and BiT Global (Justin Sun-affiliated, HK) as co-custodians holding ~118,000 BTC. While BitGo's federal charter significantly de-risks the primary custodian, a BiT Global insolvency, regulatory seizure, or governance dispute would impair the 1:1 backing.
Co-custodian governance concentration: The WBTC DAO 17-member multisig can change custodians without on-chain timelock. The 2024 BiT Global transfer demonstrated this risk. With BiT Global as active co-custodian (Justin Sun-affiliated, operating under HK SFC jurisdiction), off-chain governance changes could rapidly devalue WBTC in DeFi markets.
DeFi integration contagion: WBTC is deeply embedded as collateral in Aave, Compound, MakerDAO, and Curve. A loss of confidence event (e.g., BiT Global regulatory action or custody dispute) would trigger simultaneous DeFi liquidations across billions of positions, even if BitGo operations remain unaffected.
Proof-of-Reserves lag: Chainlink PoR feeds are updated monthly and rely on custodian cooperation. A custodian that has secretly lost BTC could continue providing attestation for weeks before detection. During this lag, WBTC would trade at full BTC value despite impaired backing.
Cross-chain bridge surface: WBTC deployed on 20+ chains via LayerZero OFT. During a custody crisis, cross-chain bridge contracts add an additional failure layer (bridge exploit, withdrawal queue) precisely when users most need to exit. LayerZero DVN was hardened in April 2026 after KelpDAO exploit.
Frequently Asked Questions
Is WBTC (Wrapped Bitcoin) safe to use?
What are the main risks of using WBTC (Wrapped Bitcoin)?
What is WBTC (Wrapped Bitcoin)'s risk score breakdown?
How does WBTC (Wrapped Bitcoin) compare to other Bridge protocols?
Has WBTC (Wrapped Bitcoin) ever been hacked or exploited?
Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.