₿USD is a dollar-pegged stablecoin—one token equals one dollar—issued by a consortium of publicly traded Bitcoin treasury companies. Unlike existing stablecoins that hold fiat reserves in the form of US Treasury bills and bank deposits, ₿USD is backed entirely by Bitcoin held on the base layer in publicly addressable wallets, verifiable by any observer in real time. The instrument is classified as a Treasury-Backed Digital Currency (TBDC). The term draws a deliberate structural contrast with Central Bank Digital Currencies (CBDCs): where a CBDC is issued by an entity that can expand the money supply, a TBDC is backed by a finite reserve asset that no issuer can create, expand, or dilute. This distinction defines the economic properties of the instrument and the constraints under which its issuers operate. This paper specifies the technical architecture of ₿USD: its issuance mechanism, two-ledger reserve system, sidechain circulation layer, redemption mechanics, defensive programmability framework, fee structure, and risk analysis. The system requires no modification to Bitcoin’s base layer protocol.
The stablecoin market has grown to over $317 billion in aggregate supply, expanding at approximately $100 billion per year. These instruments—primarily USDT and USDC—are backed by US Treasury bills and bank deposits. Tether alone holds over $100 billion in sovereign debt. The stablecoin market has become one of the largest purchasers of US government debt on earth.
From Bitcoin’s perspective, this represents a structural failure. Every dollar held in a fiat stablecoin is a dollar that did not enter Bitcoin. The payment rails are digital and built on blockchain infrastructure, but the reserve asset is sovereign debt—the monetary system Bitcoin was designed to replace. ARK Invest formalized this observation in November 2025, reducing its 2030 bull-case Bitcoin price target by $300,000, specifically because stablecoins are capturing the emerging-market demand ARK had previously assigned to Bitcoin.
₿USD addresses this gap. When a consumer purchases a ₿USD token, the issuing consortium uses the incoming fiat to purchase Bitcoin at spot. Every unit of ₿USD demand is structurally identical to Bitcoin demand. The two cannot be separated.
The distinction that matters: ₿USD does not compete with Bitcoin for capital. It converts stablecoin demand into Bitcoin demand.
The ₿USD system is composed of four distinct layers, each performing a single function. The separation is deliberate: each layer is independently verifiable, and the failure of any single layer does not compromise the others.
| Layer | Function | Network | Verification |
|---|---|---|---|
| Reference Price price; ₿C cumulative average | BTCADP daily standard) | Off-chain (open trade data | Any party with |
| Reserve Layer two-ledger system layer | BTC custody in addresses | Bitcoin base | On-chain wallet |
| Token Layer circulation | ₿USD issuance and Liquid sidechain | Sidechain explorer | |
| Interface Layer and apps | Consumer wallets | Application layer User experience | |
| Interface Layer and apps | Consumer wallets | Application layer User experience |
₿USD is issued by a consortium of publicly traded Bitcoin treasury companies—firms whose primary business is acquiring and holding Bitcoin as a reserve asset. The consortium model distributes risk across multiple independent entities, each with its own Bitcoin holdings, its own jurisdiction, and its own regulatory compliance.
No single consortium member can unilaterally modify the reserve rules, alter the fee structure, or freeze a token. The governance charter codifies reserve management standards, transparency requirements, and operational procedures. The methodology—the BTCADP specification that defines the reference price and denomination—is independent of the consortium. Even a complete governance failure leaves the unit of account intact.
Consortium membership requires publicly verifiable Bitcoin holdings at institutional scale, regulatory compliance in the member’s domicile, commitment to on-chain transparency standards, and participation in the Ledger 2 backstop reserve. The distributed structure ensures no single regulatory action in any jurisdiction can shut down the entire system.
The issuance process converts fiat demand into Bitcoin demand in a single atomic operation. When a customer sends fiat to a consortium member, the following sequence executes:
Step 1. The customer sends fiat currency (e.g., $18,000) to a consortium member.
Step 2. The consortium member mints ₿USD tokens at a 1:1 dollar ratio (18,000 tokens) and delivers them to the customer on the sidechain.
Step 3. The incoming fiat is used to purchase Bitcoin at the current spot price. At $70,000 spot, $18,000 acquires approximately 0.2571 BTC (25,714,286 satoshis).
Step 4. The acquired satoshis are deposited into Ledger 1 (the issuance pool). At the moment of issuance, Ledger 1 holds satoshis worth exactly $18,000 at spot—perfectly backing the 18,000 outstanding tokens at $1 each.
This is the critical structural distinction from fiat stablecoins: every ₿USD token minted requires the treasury company to purchase actual Bitcoin on the open market at the current spot price. There is no synthetic exposure. There is no fractional reserve on the issuance side. 100% of ₿USD demand flows through to BTC spot as buying pressure.
Each consortium member maintains two Bitcoin ledgers on the base layer. Both hold actual Bitcoin in publicly verifiable wallets. Reserves are not lent, staked, or rehypothecated.
Ledger 1 holds the satoshis acquired with incoming fiat at the time of ₿USD token issuance. This ledger starts empty and grows as tokens are minted. The satoshis in Ledger 1 are the primary backing for outstanding tokens. In a rising market, the value of Ledger 1 grows faster than the aggregate dollar-denominated liabilities it backs, generating a natural surplus.
Ledger 2 holds Bitcoin drawn from the treasury company’s existing reserves. This ledger serves as the guarantee: if BTC spot declines and the satoshis in Ledger 1 are insufficient to cover ₿USD redemptions at $1.00 per token, the treasury company covers the shortfall from Ledger 2. The size of Ledger 2 determines how far BTC spot can fall before the system faces solvency pressure.
Ledger 2 self-fortifies over time. As BTC appreciates above the $1 obligation, surplus from Ledger 1 flows into Ledger 2. The longer ₿USD circulates without redemption, the deeper the backstop becomes—without requiring additional capital commitment from the treasury company.
The following table illustrates combined reserve behavior under different BTC spot scenarios, assuming a ₿C price of $18,000, initial issuance at $70,000 spot, and Ledger 2 holding 0.25 BTC per token-equivalent issued:
| BTC Spot | Ledger 1 | Ledger 2 | Combined | Status |
|---|---|---|---|---|
| $140,000 surplus | $36,000 | $35,000 | 394% | Significant |
| $100,000 profit on redemption | $25,714 | $25,000 | 282% | Surplus; |
| $70,000 at issuance | $18,000 | $17,500 | 197% | Fully backed |
| $50,000 covers gap | $12,857 | $12,500 | 141% | Ledger 2 |
| $30,000 2; solvent | $7,714 | $7,500 | 84% | Draw on Ledger |
| $18,000 threshold | $4,629 | $4,500 | 51% | Break-even |
| $18,000 threshold | $4,629 | $4,500 | 51% | Break-even |
Above the issuance price, every redemption generates profit for the treasury company. Between the issuance price and the ₿C price, Ledger 1 is underfunded but Ledger 2 covers the gap. These reserve dynamics only matter when tokens are redeemed for fiat. Tokens circulating on the sidechain as a medium of exchange exert zero pressure on reserves regardless of where Bitcoin’s spot price stands.
The consortium publishes daily transparency reports including: total satoshis in Ledger 1 across all members, total satoshis in Ledger 2 across all members, total ₿USD tokens outstanding, the current ₿C fiat-equivalent price, the current Ledger 1-to-liability ratio, and the combined (Ledger 1 + Ledger 2) to-liability ratio. These reports are derived from on-chain data and are independently verifiable. Surplus recognition, cost-basis tracking (weighted average cost), and cross-ledger transfers are governed by the consortium’s operating agreement and subject to independent audit on a quarterly basis.
₿USD tokens circulate as issued assets on a Bitcoin sidechain—Liquid in the reference implementation, though the architecture is compatible with any sidechain capable of issuing transferable assets, including a purpose-built chain operated by the consortium. When one user pays another, the token changes hands on the sidechain. No Bitcoin moves.
The BTC reserves sit untouched on Bitcoin’s base layer in transparent, on-chain wallets. Bitcoin is only bought or sold at two moments: when a new token is minted (fiat enters, BTC is purchased) and when a token is redeemed for fiat (BTC is sold to return fiat). Everything between minting and redemption is token circulation—peer-to-peer transfers on the sidechain with no interaction with Bitcoin’s base layer and no exposure to spot price volatility.
A million ₿USD transactions can occur on the sidechain without a single satoshi moving on Bitcoin’s base layer. The base layer secures the reserves. The sidechain handles commerce.
When a customer redeems a ₿USD token, the treasury company returns $1.00 per token. The Bitcoin backing that token in Ledger 1 is sold to fund the redemption. The token is burned. If Bitcoin’s spot price has risen since issuance, the Ledger 1 position is in surplus—the surplus remains in the consortium’s holdings. If spot has fallen, Ledger 1 may be insufficient, and Ledger 2 covers the shortfall. The customer always receives $1.00 per token.
In the default redemption path, the consortium transfers Bitcoin at spot value directly to the redeemer’s wallet. No market order is placed. No slippage occurs. The spot price is unaffected by the redemption. This single design choice eliminates the most dangerous attack vector—forced selling. Fiat redemption remains available as a premium service with slower processing, higher fees, and velocity limits.
Fiat redemption requires the consortium to sell Bitcoin from reserves to return dollars. This is the only exit path that creates selling pressure. The fee structure, detailed in Section 11, reflects the actual cost this exit imposes on the reserve system.
The economic engine of the ₿USD model is the structural divergence between a moving asset and a fixed liability. The satoshis in Ledger 1 appreciate at the BTC spot rate. The dollar-denominated liabilities they back are fixed at $1.00 per token—they do not move at all. As BTC spot rises, the gap between asset value and liability value does not grow linearly. It widens at an accelerating rate, because the asset side tracks a rising spot price while the liability side is permanently fixed.
Consider a concrete example. A treasury company issues $18 million in ₿USD tokens (18 million tokens at $1 each) when BTC spot is $70,000. The consortium deposits approximately 257.14 BTC into Ledger 1. The redemption liability is $18 million—fixed regardless of what Bitcoin does next.
| BTC Spot Value** | Ledger 1 Liability | Redemption Surplus | Treasury Alone | **vs. Holding |
|---|---|---|---|---|
| $70,000 (issuance) | $18,000,000 | $18,000,000 | $0 | 0% (neutral) |
| $100,000 holding | $25,714,000 | $18,000,000 | $7,714,000 | +43% above |
| $140,000 doubled intake | $36,000,000 | $18,000,000 | $18,000,000 | +100% — |
| $200,000 holding | $51,428,000 | $18,000,000 | $33,428,000 | +186% above |
| $500,000 holding | $128,571,000 | $18,000,000 | $110,571,000 | +614% above |
| $500,000 holding | $128,571,000 | $18,000,000 | $110,571,000 | +614% above |
The profit accelerates because the denominator—the $1 liability—is permanently fixed while the numerator—the BTC asset value—compounds with spot. The ₿USD model converts a linear BTC holding into what is effectively a leveraged position on Bitcoin’s upside, without borrowing, without margin, and without any risk beyond what the company has already accepted by being a Bitcoin treasury company.
The surplus dynamics above describe a single issuance cohort. In practice, the treasury company is continuously issuing and redeeming ₿USD tokens. Each profitable redemption leaves surplus satoshis in Ledger 1. Those surplus satoshis are not withdrawn—they remain in the pool, appreciating at spot alongside all other satoshis. New issuances add more satoshis. In a sustained rising market, Ledger 1 becomes a compounding engine.
Surplus sats from early redemptions appreciate alongside new issuance sats. New issuances at higher spot prices deposit fewer sats per token (because each sat is worth more), but the surplus from prior issuances continues growing. Over time, the aggregate surplus in Ledger 1 can exceed the aggregate liability—at which point the pool is self-sustaining and Ledger 2 becomes purely a precautionary reserve that is never tapped.
Ledger 1 operates as a pooled reserve, not on a per-token basis. Tokens are issued at different spot prices and redeemed at different times. At any given moment, a percentage of outstanding tokens are "in the black"—their backing satoshis are worth more than the $1 obligation—and a percentage are "in the red," where spot has declined below their issuance price.
Over a long enough time horizon, the proportion of tokens in the black grows structurally. Every day that BTC spot remains above prior issuance prices, more cohorts move into surplus. Older tokens—those issued months or years ago at lower spot prices—are deeply in the black. Their surplus more than offsets the shortfall on recently issued tokens that may be temporarily underwater. A token issued at $50,000 spot and redeemed when spot is $80,000 generates a surplus of $0.375 per token. A token issued at $90,000 and redeemed at $80,000 generates a shortfall of $0.125 per token. In a pooled reserve, the surplus tokens subsidize the underwater ones.
This is the retention effect. Long-term holders do not redeem during a downturn. They have no reason to—their ₿USD token’s $1.00 peg is stable regardless of what BTC spot does on any given day. The tokens most likely to be redeemed during a downturn are recently minted tokens held by short-term participants—precisely the tokens with the thinnest margin. But the bulk of the pool—the older, deeply in-the-black tokens—sits undisturbed, its surplus growing with every passing day that spot exceeds the historical average.
The longer the system operates, the deeper its structural surplus becomes. Time itself is a reserve asset. The model does not merely survive a rising Bitcoin price—it converts that rise into accelerating, compounding returns for the consortium while maintaining a hard $1 peg for every holder.
Every ₿USD token is a programmable instrument. The word "programmable" carries justified suspicion—in the context of CBDCs, programmability means surveillance and spending restrictions. ₿USD programmability inverts this relationship entirely.
Each token carries provenance metadata about itself—not its holder. The metadata includes: mint date, mint-day BTC spot price, mint-day ₿C price, block age, and transfer count. No holder identity, spending pattern, geographic location, or transaction purpose is recorded. The data does not exist at the protocol level because the protocol was designed never to produce it. This is an architectural constraint that would require dismantling the sidechain to override.
The token contract has read access to aggregate metrics derived from on-chain data: total outstanding supply, aggregate redemption velocity (rolling 24h, 7d, 30d windows), BTC spot relative to ₿C, the coverage ratio, and reserve attestation status. None of these metrics require information about individual holders. They are system-level vital signs—independently verifiable by any participant.
Each mechanism is deterministic, transparent, and applies equally to every participant. None requires human intervention to activate. None can be overridden by the consortium.
BTC-Default Redemption: Eliminates forced selling. The coordinated short-plus-redemption attack depends on forced BTC liquidation—with BTC-default redemption, there is no forced selling.
Time-Weighted Redemption Fees: Fiat redemption fees are a function of token age. 0–7 days: 3.0%. 8–30 days: 1.5%. 31–90 days: 0.5%. 91–180 days: 0.1%. Over 180 days: 0.0%. BTC-default redemption and ₿C lateral conversion are exempt.
Volume-Triggered Fee Escalation: When rolling 7-day fiat redemption volume exceeds defined thresholds as a percentage of total supply, an additional surcharge applies. Below 1%: no surcharge. 1–2%: +0.5%. 2–5%: +1.5%. Above 5%: +3.0%.
Adaptive Velocity Limits: Daily fiat redemption cap of 5% of outstanding supply under normal conditions, tightening as velocity rises. BTC-default redemption and ₿C conversion remain unlimited at all times.
₿C Lateral Conversion: Any holder can convert to a ₿C-denominated position at any time, at no cost, with no delay. During panic, holders move to the denomination tracking Bitcoin’s lifetime average rather than spot volatility. No Bitcoin is sold. The system absorbs fear without absorbing outflow.
Redemption Notice Periods: Small fiat redemptions process immediately. Above $100,000: 48 hours. Above $1,000,000: 7 days. BTC-default redemption remains instant at any amount.
Under normal network conditions—the vast majority of the token’s life—every defensive mechanism is dormant. Transfers are instant and free. Redemptions are fast and cheap. The token behaves identically to any other stablecoin. The mechanisms activate only when the network’s vital signs indicate abnormal stress, and the thresholds are public, auditable, and identical for everyone.
The exit structure is designed around a governing principle: every exit path should reflect the actual cost that exit imposes on the Bitcoin ecosystem, and the fee should route capital toward the path that keeps it inside the ecosystem.
| Exit Path | Friction | Market Impact | Ecosystem Effect |
|---|---|---|---|
| ₿USD → ₿C in ecosystem. | Near zero | None. Capital stays | Strongly positive |
| ₿USD → BTC directly. No market selling. | Moderate fee stays in Bitcoin | BTC transferred | Neutral—holder |
| ₿USD → Fiat reserve at spot. | Highest fee exits Bitcoin | BTC sold from | Negative—capital |
| ₿USD → Fiat reserve at spot. | Highest fee exits Bitcoin | BTC sold from | Negative—capital |
The practical consequence is a natural gravity that keeps capital inside the Bitcoin economy. The lowest-friction paths are the ones that keep capital closest to Bitcoin. The highest-friction path—fiat exit—is the one that imposes the greatest cost on the reserve system.
The consortium generates revenue through three channels: (1) A holding fee of 1–2% annually on outstanding ₿USD float—on $10 billion in circulation, this produces $100–200 million annually. (2) Surplus on redemptions—when BTC spot has risen since issuance, the difference between the reserve value and the $1 obligation is retained. (3) Issuance and exit fees. All fee revenue is deployed to purchase additional Bitcoin until coverage thresholds are met.
A bear market drives BTC spot below the average minting price. Holders panic. Redemptions spike. Each fiat exit forces the consortium to sell Bitcoin into a falling market, depressing the price further, triggering more redemptions. This is a bank run—the oldest failure mode in monetary systems.
The ₿USD system deploys five structural defenses against this scenario:
First: Reserve pressure exists only at the fiat exit. Tokens circulating within the ecosystem create zero reserve pressure at any BTC spot price. The run scenario requires holders to not only panic but to convert to fiat specifically—abandoning the ecosystem entirely.
Second: BTC-default redemption eliminates forced selling. The consortium transfers Bitcoin rather than liquidating it. No market order, no slippage, no spot impact.
Third: Time-weighted fees price out mint-and-redeem attack loops. A freshly minted token faces 3% fiat redemption fees, making the attack deeply unprofitable.
Fourth: Volume-triggered fee escalation and velocity limits create congestion pricing at the fiat exit ramp during stress events.
Fifth: ₿C lateral conversion provides a zero-cost escape valve. Holders can move to the ₿C denomination without touching reserves. The system absorbs the fear without absorbing the outflow.
Consider a coordinated short-plus-redemption attack: an attacker mints $100M in ₿USD, builds a $100M BTC short position, then attempts mass fiat redemption to force selling and crash spot. The obstacles stack: BTC-default redemption means no forced selling. Time-weighted fees cost 3% ($3M) on freshly minted tokens. Volume-triggered escalation adds another 3% ($6M total). Velocity limits spread the redemption over weeks, during which the short accrues carrying costs. The attack’s expected return is deeply negative.
The defender’s advantage is structural, not tactical. The protocol does not need to detect the attacker, identify their strategy, or respond in real time. It applies the same rules to everyone. The rules happen to make the attack uneconomical.
The technical capability is identical—both CBDCs and TBDCs embed conditional logic at the token level. The architecture is the same. The philosophy is opposite.
| Property | CBDC | TBDC (₿USD) |
|---|---|---|
| Programmability serves | The issuing authority its holders | The token network and |
| Holder surveillance impossible—no identity metadata | Built in by design | Structurally |
| Spending restrictions Expiration, category limits, geo-fencing | None—holders spend freely | |
| Crisis behavior accounts at discretion | Authorities freeze autonomously | Protocol hardens |
| Redemption control discretion | Issuer can deny or delay Deterministic rules, no | |
| Collateral verifiable in real time | Government promise | Bitcoin on base layer, |
| Failure mode lifetime average (no precedent) | Policy change, overreach BTC sustained below | |
| Failure mode lifetime average (no precedent) | Policy change, overreach BTC sustained below |
The most consequential property of ₿USD is the demand flywheel that activates at scale. Each component reinforces the others, and the cycle has no natural ceiling.
Minting creates Bitcoin demand. Every ₿USD minted requires purchasing BTC at spot. Commerce-driven demand is persistent and does not reverse when sentiment shifts.
Rising spot expands issuance capacity. As BTC rises, the ₿C-denominated value of consortium holdings increases. More ₿USD can be issued. More BTC gets purchased.
Fee reinvestment deepens reserves. 100% of fee revenue is deployed to purchase additional Bitcoin until coverage thresholds are met.
Scale reduces redemption risk. As more commerce occurs natively in ₿USD, the proportion of tokens redeemed for fiat declines. The system becomes structurally safer as it grows—the inverse of traditional fractional reserve banking.
A sustained, severe decline that depresses BTC spot below the average acquisition price of reserves is the most acute risk. The structural mitigation is Ledger 2 overcollateralization. The ₿C denomination’s stability also reduces the correlation between spot declines and redemption pressure—the value a holder sees does not change materially when spot moves 10%. The critical framing: each consortium member already carries this price risk on its balance sheet. The Ledger 2 commitment formalizes an existing exposure with a defined perimeter.
The regulatory treatment of a Bitcoin-backed stablecoin pegged to $1 USD remains untested in most jurisdictions. The structural mitigation is the consortium’s distributed jurisdiction. The ₿C denomination itself requires no permission to compute—it is an open mathematical standard.
Multiple independent companies must cooperate on reserve management and operational standards. The critical design principle is that the BTCADP specification is independent of the consortium. The denomination survives the institutions that use it.
Protocol vulnerabilities, oracle manipulation, and private key compromise are inherent in any blockchain financial infrastructure. Mitigations include multi-signature wallets, formal verification of sidechain scripts, geographically distributed key management, and insurance against operational losses. The BTCADP oracle is resistant to manipulation by design—the trimmed mean methodology and exchange qualification filters prevent any single entity from influencing the reference price.
When deployed alongside the ₿ond savings product, ₿USD operates within a four-ledger reserve architecture. The ₿ond and ₿USD are structurally different instruments with different redemption mechanics, duration profiles, and risk characteristics. Pooling their reserves would allow a stress event on one product to consume the reserves of the other.
The four-ledger separation is as follows: ₿ond L1 holds BTC purchased with saver deposits, locked to the maturity schedule. ₿ond L2 is the backstop reserve sized actuarially against the known maturity book. ₿USD L1 holds BTC backing outstanding $1 tokens. ₿USD L2 self-fortifies over time as BTC appreciation creates surplus above the $1 obligation. All four ledgers are held in publicly addressable Bitcoin wallets on the base layer.
₿USD provides a dollar-stable medium of exchange backed entirely by Bitcoin—the only asset whose supply is fixed by protocol and whose custody requires no counterparty. The system converts stablecoin demand into structural Bitcoin demand, channels fee revenue into additional Bitcoin purchases, and becomes more robust as adoption grows.
The architecture requires no modification to Bitcoin’s base layer. It uses existing sidechain infrastructure for token circulation, existing publicly traded companies as issuers, and a published open-source specification for its reference price. The denomination outlasts the institutions that use it.
The defensive programmability framework inverts the CBDC paradigm: tokens that read the state of their own network to protect all holders equally, rather than tokens that report on their holders to serve the issuing authority. Under normal conditions, every mechanism is dormant and the token behaves identically to any other stablecoin. Under stress, the protocol hardens autonomously.
The transition is not an ideological project. It is the emergent consequence of a stablecoin that is better: backed by harder collateral, verified in real time, issued by institutions with aligned incentives, and defended by its own architecture.
CC0 Public Domain · btcadp.org · 2026
CC0 Public Domain — free to use, share, and build upon without restriction.