Merlin’s Seal (Merlin Chain)

The research assessment is adverse because Merlin’s Seal has a smaller approval set than every comparable Bitcoin wrapper this registry has already rejected. Merlin’s Seal is the BTC-locking bridge for Merlin Chain, a Bitcoin Layer 2. It uses MPC custody co-managed by Cobo and Merlin Chain, and both parties must sign to release funds. That two-party gate is smaller than WBTC’s 2-of-3 multisig or Function FBTC’s three-party Security Council, which this registry rejected for their own custody-concentration risks. Primary sources did not confirm current redemption mechanics for ordinary, non-promotional bridge transactions.

Review triggers: events that reopen the verdict
• The MPC custody threshold expands beyond a two-party gate to a broader, named signer set, or an independent third-party verifier is added to the release process
• Current redemption mechanism, timing, and any size limits for ordinary bridge transactions are independently confirmed and demonstrated at proposed size
• An independent, recurring proof-of-reserves attestation for MBTC and other Seal-bridged assets is published
• Twelve consecutive months with no depeg, custody, or bridge-release incident following threshold and redemption confirmation

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-17.

The research file

Mechanism

Users deposit BTC, ETH, USDT, USDC, or BRC-20/BRC-420 tokens into an MPC wallet co-managed by Cobo and Merlin Chain. On Ethereum, the system locks BTC, then a message triggers the minting of MBTC on Merlin’s L2 at a 1:1 ratio. To reverse the flow, the system burns MBTC and releases the locked BTC. Merlin’s Seal began as a time-boxed 2024 token-launch event, but the underlying BTC-locking mechanism remains the live bridge path reviewed here.

Control and governance

Custody uses Cobo’s MPC and threshold-signature-scheme technology. Both Merlin and Cobo must sign to release funds. This is a two-party approval structure, not a broad multisig or decentralized validator set. MPC removes a single-key failure mode, but its two-party gate is smaller than WBTC’s 2-of-3 or FBTC’s three-party council, which this registry rejected for their own concentration risks. A May 2026 upgrade added zkEVM scalability and BitVM-based Bitcoin-native security. A proof-of-stake transition planned for 2026 aims to decentralize network operation. Neither change affects the bridge’s own two-party custody gate.

Incident record

We found no confirmed exploit of Merlin Chain’s own BTC bridge or custody mechanism through this review’s 2026-08-17 search cutoff. The widely indexed ”Merlin DEX hack” from April 2023 involved an unrelated zkSync-based DEX that happens to share the Merlin name, not Merlin Chain. We note it only to prevent miscitation. Merlin Chain’s mainnet reportedly passed a CertiK audit with no critical findings before launch. The team also publishes audit reports and runs a bug bounty. We could not confirm a dedicated audit of the Seal bridge’s custody mechanism.

Exit

Non-transferable M-Tokens represented original Seal-era deposits and became redeemable in an announced 2024 unlock window. For ongoing bridge redemptions, the system burns MBTC and releases locked BTC through the same two-party MPC gate. But no primary source confirmed current redemption timing or size limits for an ordinary, non-Seal-era bridge transaction. Nor could this review confirm whether either Cobo or Merlin could withhold the required approval on its own.

Comparison

Merlin’s Seal has a smaller approval set than WBTC, whose 2-of-3 multisig led to rejection for custody concentration, and Function FBTC, whose three-party council led to rejection for an unconfirmed threshold. SolvBTC was rejected despite having the strongest governance in this batch because it suffered an actual exploit. Lorenzo enzoBTC was rejected because key disclosures remained unresolved. Merlin’s Seal most closely resembles enzoBTC. Its design is plausible and its questions remain open, rather than arising from a confirmed failure, but open questions still do not support an allocation.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• DefiLlama — Merlin’s Seal protocol record · secondary · accessed 2026-08-17
  Supports: tracked TVL
• Merlin Chain — official bridge and staking page · primary · accessed 2026-08-17
  Supports: mechanism
• Cobo — Cobo and Bitmap Tech establish Merlin Chain with MPC custody · primary · accessed 2026-08-17
  Supports: two-party MPC custody structure
• Messari — understanding Merlin Chain · secondary · accessed 2026-08-17
  Supports: protocol overview
• Xverse — what is Merlin Chain, a guide to the native Bitcoin Layer 2 · secondary · accessed 2026-08-17
  Supports: architecture summary

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.