Why Bitcoin can't just run DeFi contracts itself
DeFi applications — a lending pool, a decentralized exchange, a stablecoin protocol — are smart contracts: programs that live on a blockchain and execute automatically when conditions are met, with no company on the other side of the trade. Building one requires a scripting language expressive enough to encode arbitrary logic. Ethereum was built for exactly that. Bitcoin's own scripting language, by contrast, is deliberately limited — it can check signatures, enforce timelocks, and require multiple keys to authorize a spend (the same primitives Chapter 9 and the last chapter's staking mechanism both rely on), but it was never designed to run arbitrary programs. That's not an oversight; it's a security tradeoff made on purpose, the same instinct behind proof-of-work's simplicity over proof-of-stake's added complexity that Chapter 18 covered. A smaller, simpler set of things the base layer can do is a smaller attack surface to secure.
So Bitcoin, as such, doesn't run DeFi. What people mean by "Bitcoin DeFi" is almost always BTC's value being moved somewhere that does.
Wrapped Bitcoin: how BTC's value actually gets there
The dominant method is wrapping. A custodian holds real bitcoin in reserve and mints an equivalent amount of a pegged token on a programmable chain — Wrapped Bitcoin (WBTC) on Ethereum is the best-known example, an ERC-20 token meant to always be redeemable 1-for-1 for the BTC actually held in custody. That token can then be supplied to a lending protocol to earn interest, deposited into a liquidity pool to earn trading fees, or used as collateral to borrow a stablecoin — the full menu of things DeFi contracts can do, now available to a token that represents Bitcoin's value even though the underlying bitcoin itself never left its own chain.
Notice what this reintroduces: a custodian holding your actual bitcoin, exactly the arrangement Chapter 13 described for exchanges and Chapter 8 named as the one rule that outranks every other rule. A wrapped-BTC balance in a DeFi wallet is a claim on a custodian's reserve, not bitcoin you hold the keys to — the DeFi contract you're using might be genuinely trustless, but the token you fed into it isn't.
How many things have to keep working
The custodian isn't the only dependency wrapping adds — it's worth counting all of them side by side against the two custody models earlier chapters already covered, self-custody and exchange custody. Each additional box below is one more thing that has to keep working correctly, indefinitely, for the arrangement to hold.
What's actually gone wrong, on the record
This isn't a hypothetical risk. In 2024, WBTC's primary custodian announced a restructured custody arrangement; the new setup's ties to a separately controversial entity were enough to prompt several major DeFi protocols to reconsider whether they'd still accept WBTC as collateral at all, and Coinbase removed WBTC from its exchange listings around the same period in favor of a competing wrapped token it controls directly (cbBTC) — a reminder that "wrapped Bitcoin" isn't one static thing with one fixed custodian, but a category with real, live governance and business risk behind the peg. Separately, the bridges that move value between chains — a related but distinct piece of DeFi infrastructure — have an even starker track record: billions of dollars have been lost to bridge exploits since 2016, and wrapped BTC has been directly caught up in some of the largest, including a 2023 flash-loan exploit on the lending protocol Euler Finance that resulted in roughly $197 million in losses across several assets, wBTC among them.
None of this means every wrapping arrangement is a scam — reputable custodians publish reserve audits, and the category has existed and mostly functioned for years. It means the honest description of "Bitcoin in DeFi" includes a custodian, a peg that has to hold, and — if the token crosses a bridge rather than being minted directly by a single custodian — a second, separate piece of software that has repeatedly been the most-attacked part of the entire stack.
Bitcoin-native attempts to close the gap
A separate category of project tries to bring DeFi-like functionality closer to Bitcoin's own security instead of exporting BTC's value to someone else's chain — Bitcoin "Layer 2s" such as Stacks or Rootstock, which settle back to the Bitcoin blockchain in some form while offering smart-contract functionality Bitcoin's own base layer doesn't. These are a genuinely different trust model than plain wrapping — worth knowing exists, and worth exactly the same scrutiny before using: what secures the layer 2 itself, who can freeze or reverse a transaction there, and what happens to funds if the bridge back to Bitcoin ever fails. A layer built on top of Bitcoin inherits some of its security, not all of it, in the same way Chapter 10 was honest that Lightning channels carry their own liquidity and uptime tradeoffs distinct from the base chain underneath them.
Where this connects to the last chapter
This is exactly the overlap the previous chapter flagged: wrapped BTC deployed into a lending pool or liquidity contract is one of the three things commonly marketed as "Bitcoin staking," and everything this chapter just covered — the custodian, the peg, the bridge risk — is the specific mechanism behind that particular case. The other two cases from that chapter (custodial lending relabeled as staking, and native self-custodied delegation via something like Babylon) don't touch DeFi contracts at all. If a product combines the words "stake" and "DeFi" for Bitcoin in the same pitch, it's very likely describing wrapped BTC in a lending or liquidity contract — which means everything in this chapter about custodians and bridges applies directly.
Bitcoin's base layer was built narrow on purpose. Everything that makes it look like it's "in DeFi" is a bridge someone else built to reach it — and a bridge is exactly the part of this stack with the worst track record.