Paper 2025/709

Thunderbolt: A Formally Verified Protocol for Off-Chain Bitcoin Transfers

Hanzhi Liu, University of California, Santa Barbara

Yanju Chen, University of California, San Diego

Jingyu Ke, Shanghai Jiao Tong University

Dahlia Malkhi, University of California, Santa Barbara

Yu Feng, University of California, Santa Barbara

Abstract

We present Thunderbolt, an off-chain protocol that transfers Bitcoin UTXO ownership with seconds-scale latency, requires no channel graph, no routing, and no liquidity rebalancing, and lets the recipient be offline at the time of transfer. A single UTXO is locked once on-chain under a fixed public key jointly held by the current owner and a threshold committee; ownership then passes through an unbounded sequence of holders; each transfer is a purely off-chain, asynchronous operation whose on-chain cost is zero. The chain sees exactly two transactions regardless of how many transfers occur. The core invariant is an algebraic cancellation: at each transfer the recipient's fresh secret is added to the holder's share and subtracted from the committee's share, so both shares rotate while the on-chain key stays fixed. To enforce this, the recipient publishes an invoice to a shared append-only ledger (the Thunderbolt Ledger): a public commitment, an encrypted copy for himself, and an encrypted copy for the committee, together with a zero-knowledge proof that all three encode the same fresh secret. The sender fetches the invoice, verifies the proof, homomorphically folds her secret into the recipient's ciphertext to produce a new ownership credential, and publishes the result with a second zero-knowledge proof. Both proofs use a single Sigma-protocol response to force the same witness across elliptic-curve and Paillier verification equations, requiring no trusted setup. The committee operates under a standard $(t,n)$-threshold honest-majority assumption: at most $t{-}1$ of $n$ members may be corrupted. The recipient decrypts at any later time; the committee subtracts the fresh secret from its share. By binding each transfer to a distinct fresh secret and context identifier, multiple UTXOs can be transferred independently in parallel. On our benchmark machine, a complete off-chain transfer finishes in 1022ms with a combined proof size of 3.8KB. General-purpose SNARK (Succinct Non-interactive Argument of Knowledge) backends are orders of magnitude slower on the same relations: even a reduced-parameter instantiation already exceeds our native proving time by two orders of magnitude, and a faithful realization at the deployed 3072-bit Paillier modulus exceeds the memory budget of consumer hardware.

@misc{cryptoeprint:2025/709,
      author = {Hongbo Wen and Hanzhi Liu and Yanju Chen and Jingyu Ke and Dahlia Malkhi and Yu Feng},
      title = {Thunderbolt: A Formally Verified Protocol for Off-Chain Bitcoin Transfers},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/709},
      year = {2025},
      url = {https://eprint.iacr.org/2025/709}
}