What does it mean for a system to be trustless? The question is not academic. It sits in the first line of Cube, a project introduced at the end of May by the developer known as Burak, who describes it as bringing trustless smart contracts to Bitcoin. Burak built the Ark protocol and once froze funds across the Lightning Network for hours with a single Taproot transaction. He knows the technology. The word is what we should examine.

Cube is described as a virtual machine that runs smart contracts natively on Bitcoin, without a fork, a new token, or a federation of strangers holding your coins. It leans on BitVM, on timeout trees borrowed from Ark, and on a fresh accounting trick the post calls “shadowing.” The pitch is that you keep self-custody throughout, that you can always exit unilaterally, and that the coordinator can never move your money on its own. If that holds, it is a genuinely interesting piece of engineering. The question is whether “trustless” means what you think it means when you read it.

What Cube Actually Does

What sets Cube apart from most attempts at this is where it puts the trusted setup. Many BitVM-based systems lean on a single global ceremony that every user must trust indefinitely, so if that ceremony was ever compromised, the whole network inherits the flaw. Cube scopes the setup to each user individually, performed once between you and the coordinator when you register, which means a bad setup harms only that one account rather than everyone.

The second novelty is “shadowing.” Bitcoin understands keys, not contract logic, so a smart contract cannot natively hold coins the way a person with a private key can. Shadowing bridges that gap by projecting a contract’s obligations back into per-user claims that stay redeemable on Bitcoin itself, so the coins sit under contract logic while your right to exit with your share remains enforceable. Whether it works as advertised is the open question. The ambition, at least, is real.

The Case for Building Up

Start with the part that is not in dispute. Bitcoin’s base layer is slow on purpose. The ceiling is roughly seven transactions per second, and the limit is not a flaw but a deliberate constraint. Keep throughput low and a full node runs on modest hardware, while blocks stay small enough to propagate across the planet before the next one arrives. That is what keeps Bitcoin genuinely decentralised: anyone can verify it, and no one can quietly inflate the supply.

That constraint is the entire reason layer 2 exists. If Bitcoin is ever going to be money for eight billion people rather than a settlement network for the patient and the wealthy, the day-to-day activity cannot happen on the base chain. It has to happen somewhere else and settle back down to Bitcoin periodically. Lightning does this for payments. Ark, Aqua, and Cashu each take their own run at it, with their own trade-offs. Cube is trying to do it for arbitrary computation.

You cannot have global money at seven transactions per second. A network that can only ever serve a handful of users per second is not money, it is a vault, and a vault is a fine thing to be but it is not what was promised. Refusing to build any layer 2, insisting that Bitcoin remain a pristine ledger that does one thing, is not principled caution. It is a decision to let other chains capture every use case beyond simple transfer, and then to act surprised when they do.

That case is correct as far as it goes. The throughput ceiling is real, and refusing all layer 2 development is not a serious position. Money that cannot be spent at scale is a museum piece. The builders are right about the problem.

What “Trustless” Actually Asks of You

So the real question is not whether to build layer 2. It is what each layer quietly asks you to trust, and whether the marketing says so plainly.

BitVM-based systems, the category Cube belongs to, do not eliminate trust. They relocate it and shrink it. The standard description is a “1-of-n” honesty assumption: out of some set of participants involved in the setup, at least one must be honest for the system to behave. That is a real improvement over a federation that needs a majority to stay honest, and worlds better than a custodian who can simply decide not to give your coins back.

But one-of-n is not zero. There is also a liveness assumption on top, which is the polite way of saying that if the coordinator goes dark or turns hostile, your money is not stolen, but it may be frozen while you fight your way out. Cube’s design includes exactly this: a unilateral exit path you can trigger if the coordinator stops cooperating, with a three-month timeout on one of its onboarding outputs. The exit exists because the failure it guards against is real, not theoretical.

None of this is hidden, to be fair. The Cube post is unusually candid about its own architecture, and the unilateral exit mechanism is the whole point of the design. The complaint is not that the project is dishonest. It is that the headline word flattens all of this into a single reassuring syllable, and most readers will absorb the syllable and skip the architecture. “Trustless” is doing the work that three paragraphs of caveats should be doing.

Verify, Don’t Trust

This is where the old discipline earns its keep. Verify, don’t trust. It is the closest thing Bitcoin has to a founding instruction, and it does not stop applying just because a new layer is wrapped in the same vocabulary. If anything it applies harder, because every layer you add sits on top of the last one and brings its own assumptions with it.

The base chain asks you to trust almost nothing. A payment channel asks you to trust a little, and to stay online. A programmable rollup with an optimistic coordinator and a localised trusted setup asks for more again. The trust does not vanish as you climb. It accumulates, quietly, one reasonable-sounding layer at a time, each step individually defensible while the stack as a whole drifts further from the thing that made the base layer worth trusting in the first place.

That is not a reason to dismiss Cube, or Ark, or any of the others. It is a reason to read them properly. A layer 2 is a trade: you give up some of Bitcoin’s hard guarantees in exchange for speed, programmability, or cost. Whether that trade is worth it depends on what you are doing and how much you are putting at risk, and that is a judgement no announcement can make for you. The useful question is not “is it trustless,” because the honest answer is always “less than the base layer, more than a bank, and it depends.” The useful question is narrower. What must stay honest, what must stay online, and what happens to my coins on the worst day, when both of those assumptions fail at once.

Cube is a few days old as a public idea, I had seen no word of it before today. It is code in a repo and a long technical post, not a battle-tested system holding billions through a market panic. That is not a criticism either. Everything that works started as code in a repo. But it is the difference between a promising design and a proven one, and the gap between those two is measured in years, not in the confidence of a launch announcement.

So treat the next one of these the way you would treat any claim about your money from someone who wants you to relax. Read past the headline word. Find the assumption it is hiding. Then decide for yourself whether the trade is one you want to make. Nobody can make that call on your behalf, and anybody who tells you the question has been settled is selling you the one thing Bitcoin was built to let you refuse.