Trustless institutional OTC: block trades that settle across Bitcoin and EVM with no desk holding the funds

Building the settlement engine was the infrastructure job. Turning it into something an institution will move a large block trade through, trustless and crosschain, is a different job, and it is the one that proves the technology is real. I built that product on top of Portal to Bitcoin's atomic core: two institutions settle a sizable BTC to EVM block trade with no bridge, no wrapped asset, no escrow desk, and no reason to trust each other or me. Real deals settled on mainnet.

Context#

Institutional block trades have always settled through a middle you have to trust. A clearing counterparty, a dealer, or an escrow desk sits between the two sides, takes custody or takes your word, and each party carries counterparty risk plus a reconciliation bill until the trade clears. The entire tokenized asset push happening now is an attempt to delete that middle: onchain delivery versus payment, where both legs of a trade settle atomically or neither does, so no intermediary ever holds the funds. That is the direction real world asset settlement is converging on.

I shipped a working crosschain version of exactly that, for the hardest pair there is: native Bitcoin against EVM assets. On top of the settlement layer I owned at Portal, I engineered the OTC path where an institution commits to a block trade and it either clears in full on both chains or unwinds cleanly, with each side holding its own keys the entire time. No wrapped BTC, no bridge operator, no trusted desk. I own the EVM contract layer this product settles through.

What I built#

I engineered the institutional settlement product on top of the audited core: the flow from a committed quote, to funds locked on both legs, to atomic settlement across Bitcoin and the EVM, to a clean unwind if either side stalls. The mechanism underneath is the core's, atomic settlement built on hashlocks and timelocks with ERC-6909 multitoken accounting settling the balances. What I added was the institutional product around it.

Native on both legs. The Bitcoin leg settles in native BTC through Bitscaler, the EVM leg through ERC-6909 accounting, and both commit together or neither does. The shortcut every other desk reaches for, wrap the BTC and settle a token, is exactly the trust assumption an institution came here to avoid, so I refused it and paid the cost of keeping both sides native.

Built for size. Institutional tickets change the threat model. A settlement window that is a nuisance on a retail swap is an economic weapon on a multimillion dollar block, so the product runs on the core's calibrated settlement and penalty mechanics rather than a looser path, and the liquidity, timeout, and unwind handling were all sized for the case where the money at risk is large and the counterparty is sophisticated enough to grief you if the economics ever allow it.

Reliability as the deliverable. No institution clears size on a rail that fails one settlement in eight. I drove the settlement failure rate on that path from 12% to 0.03% under load, and held it through peaks above 400,000 settlements in a day in stress testing, before a real institutional deal ever ran across it.

The calls that mattered#

Eliminate counterparty risk, do not just collateralize it. The comfortable version of institutional settlement reduces trust with collateral, reputation, and legal recourse. I built the version where the trade is atomic, so counterparty risk is not managed, it is gone: neither side can end up having paid without being paid. For an institution deciding whether to clear a large block with a party it does not fully trust, removing that risk by construction rather than pricing it is the entire product.

Keep both legs native, even though wrapping is the easy path. Every shortcut in crosschain settlement routes through a wrapped asset or a bridge, and every one of them reintroduces the custodian the institution came here to avoid. I kept native BTC on one leg and native EVM assets on the other, and ate the engineering cost of doing it, because a noncustodial promise you break in the middle of a settlement is worse than never making it.

Settle the product through the audited core, not a codebase beside it. The tempting path for a new institutional product is a fresh contract set built just for it. I refused it. A parallel money handling system would have doubled the attack surface and split the audit and test effort across two codebases that both hold real value. Instead the product settles through the same engine and the same ERC-6909 accounting the protocol already runs, fuzzed and invariant tested and put through external adversarial review, so it shipped with the core's security posture instead of starting its own from zero.

Treat the failure rate as the headline feature. A settlement product is only as good as the fraction of trades that actually clear. I made the success rate the number I optimized above almost everything else, because a rail that fails 12% of the time is a demo and a rail that fails 0.03% of the time is something a desk can put real size on. Getting from the first to the second was most of the work, and it is the part that turns a clever mechanism into a product an institution will wire money into.

Outcomes#

• Real institutional block trades settled live on Ethereum mainnet, trustless and crosschain, notional in the millions. The figure is self reported and the repository is private, so I am glad to walk a hiring team through the deals and the settlement traces under NDA.
• Counterparty settlement risk eliminated by construction, with each side holding its own keys through the entire trade. No bridge operator and no wrapped assets anywhere in the path.
• Settlement failure rate on that path driven from 12% to 0.03% under load, holding through peaks above 400,000 settlements in a day in stress testing before real size ran across it.
• The product settles through the same externally audited, invariant tested core the protocol runs on, and carries the same clean security record. I am happy to walk through the settlement construction and the audit trail decision by decision.

The transferable claim is not Bitcoin OTC. It is that I can take a settlement mechanism and turn it into something institutions actually clear real size through, and make it reliable enough that they do. That is the same job under a centralized exchange standing up an OTC or block settlement desk, a real world asset venue clearing redemptions and maturities as onchain delivery versus payment, or a perps venue settling collateral and block size across chains, anywhere large trades have to settle without either side trusting the other.