BABE: Verifying Proofs on Bitcoin Made 1000x Cheaper

Sanjam Garg; Dimitris Kolonelos; Mikhail Sergeevitch; Srivatsan Sridhar; David Tse

Paper 2026/065

BABE: Verifying Proofs on Bitcoin Made 1000x Cheaper

Sanjam Garg

, University of California, Berkeley, Exponential Science Foundation

Dimitris Kolonelos

, University of California, Berkeley

Mikhail Sergeevitch

, Babylon Labs

Srivatsan Sridhar

, Byzantine Research

David Tse

, Byzantine Research, Stanford University

Abstract

Endowing Bitcoin with the ability to verify succinct proofs has been a longstanding problem with important applications such as scaling Bitcoin and allowing the Bitcoin asset to be used in other blockchains trustlessly. It is a challenging problem due to the lack of expressiveness in the Bitcoin scripting language and the small Bitcoin block space. BitVM2 is the state-of-the-art verification protocol for Bitcoin used in several mainnets and testnets, but it suffers from very high on-chain Bitcoin transaction fees in the unhappy path (over $14,000 in a recent experiment). Recent research BitVM3 dramatically reduces this on-chain cost by using a garbled SNARK verifier circuit to shift most of the verification off-chain, but each garbled circuit is 42 Gibytes in size, so the off-chain storage and setup costs are huge. This paper introduces BABE, a new proof verification protocol on Bitcoin, which preserves BitVM3's savings of on-chain costs but reduces its off-chain storage and setup costs by three orders of magnitude. BABE uses a witness encryption scheme for linear pairing relations to verify Groth16 proofs. Since Groth16 verification involves non-linear pairings, this witness encryption scheme is augmented with a secure two-party computation protocol implemented using a very efficient garbled circuit for scalar multiplication on elliptic curves. The design of this garbled circuit builds on a recent work, Argo MAC, which gives an efficient garbling scheme to compute homomorphic MACs on such curves.

Metadata

Available format(s): PDF
Category: Cryptographic protocols
Publication info: Preprint.
Contact author(s): sanjamg @ berkeley edu
dimitris kolonelos @ berkeley edu
mikhail @ babylonlabs io
srivatsan @ babylonchain io
dntse @ babylonchain io
History: 2026-02-06: last of 2 revisions; 2026-01-16: received; See all versions
Short URL: https://ia.cr/2026/065
License: CC BY

BibTeX

@misc{cryptoeprint:2026/065,
      author = {Sanjam Garg and Dimitris Kolonelos and Mikhail Sergeevitch and Srivatsan Sridhar and David Tse},
      title = {{BABE}: Verifying Proofs on Bitcoin Made 1000x Cheaper},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/065},
      year = {2026},
      url = {https://eprint.iacr.org/2026/065}
}