Stacks sBTC

This review reaches an adverse research assessment because withdrawal timing remains unconfirmed, despite a signer committee comparable to an already-approved peer. sBTC uses a genuinely different design from custodial wrappers: 14 to 15 elected signers, including named entities such as Figment, Blockdaemon, and Kiln, approve mints at a roughly 70% threshold instead of using a small custodial multisig. This committee is comparable in size to Lombard BTC.b’s approved 14-member, 10-of-14 Security Consortium. But Stacks’ own documentation does not state deposit or withdrawal timing for either direction, and this review could not confirm the peg-out mechanics anywhere. A committee of comparable size is not enough on its own. Without confirmed exit terms, this registry cannot certify what a stressed redemption would actually look like.

Review triggers: events that reopen the verdict
• Withdrawal or peg-out timing and mechanics are independently confirmed and demonstrated at proposed size
• Current signer count and threshold are confirmed precisely, resolving the discrepancy across sources
• Phase 3’s permissionless, Proof-of-Transfer-integrated signer model is implemented and independently verified
• Twelve consecutive months with no depeg or signer-related incident following the above disclosures

Watched nightly: a warning on its venues or files, or a cited document that changes, reopens the memo. The first confirmation is due 2026-11-18.

The research file

Mechanism

A depositor sends BTC, formatted for sBTC, to a multisignature address controlled by a group of signers. The Emily API service tracks the incoming deposit and alerts the signers, who mint an equal amount of sBTC to the depositor’s Stacks address once confirmed. Withdrawal, or ”peg-out,” reverses this process, but Stacks’ own documentation does not state the timing for either deposits or withdrawals. This remains a real, unresolved disclosure gap.

Control and governance

The system is now in ”Phase 1”: 14 to 15 elected signers, with sources giving both figures, are reviewed and voted on by the Stacks community. This is a curated process, not a permissionless one, despite marketing language that describes it as a decentralized alternative to custodial wrapped BTC. The reported threshold is 70%, described elsewhere as either 10-of-14 or 11-of-15, depending on the source. Selection criteria include blockchain-infrastructure experience, uptime commitments above 99%, and geographic diversity. A future ”Phase 3” is planned to make the signer set open, permissionless, and rotating, integrated with Stacks’ Proof-of-Transfer consensus. That is a roadmap item, not the live state.

Incident record

This review identified no exploit of sBTC’s own signer, mint, or redeem mechanism. A June 2025 exploit of ALEX Protocol, a DeFi application built on Stacks but not sBTC itself, drained about 21.85 sBTC among other assets through a failed-transaction-verification bug in ALEX’s own contracts. Some price feeds then showed sBTC trading materially off-peg. A Stacks representative disputed this and pointed to a different oracle feed that showed sBTC on-peg throughout. This is an unresolved discrepancy between data sources, not a confirmed sBTC-level depeg. It was an application-level failure adjacent to sBTC, not a failure of sBTC’s own bridge or custody.

Exit

Peg-out from sBTC to BTC exists, but this review could not confirm its typical completion time from Stacks’ own documentation. That is a material gap for a product whose core marketing claim is a more accessible, on-chain redemption path than custodial wrappers offer.

Comparison

The committee size, 14 to 15 signers at roughly a 70% threshold, is comparable to Lombard BTC.b’s approved 14-member, 10-of-14 Security Consortium. It is larger than WBTC’s rejected 2-of-3 or Function FBTC’s rejected, unconfirmed three-party threshold. But two gaps keep sBTC below Lombard’s bar. The signer set is now curated and elected rather than open, though that alone does not rule it out because Lombard’s named institutions are also curated. More important, withdrawal timing is unconfirmed here, unlike Lombard’s disclosed nine-to-ten-day redemption window or Kraken’s disclosed KYC-gated process.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Hiro — who are the sBTC signers: breaking down SIP-028 · primary · accessed 2026-08-18
  Supports: signer count, election process, threshold, Phase 3 roadmap
• Stacks — SIP-028 update: alternate sBTC signer election upcoming · primary · accessed 2026-08-18
  Supports: signer election process
• Stacks Docs — bridging Bitcoin · primary · accessed 2026-08-18
  Supports: deposit mechanism, Emily API, no withdrawal timing specified
• Cryptonews — Bitcoin DeFi project ALEX exploited again, aBTC and sBTC depeg · secondary · accessed 2026-08-18
  Supports: June 2025 incident, disputed depeg readings
• Protos — Bitcoin DeFi project ALEX exploited again · secondary · accessed 2026-08-18
  Supports: same incident, oracle counter-claim

Inherited controls

The research above describes the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The layer with the most administrative power sets the position’s effective control; that describes control, not quality or suitability.