SwitchBitcoin — Trustless Bitcoin UTXO Ownership Transfer

What it is

SwitchBitcoin settles a two-party coin swap with a novel composition of well-understood primitives: MuSig2 (BIP 327) Taproot escrows, adaptor-signature atomic settlement, ordered refund timelocks, and baked-in fees — composed so that a funded swap always has exactly two exits: it completes, or it refunds. There is no third state, and no party who can hold your coins.

Equal outputs by construction. Every swap moves exactly the tier amount D on both sides — equal-amount escrows are the anonymity-set guarantee, so amounts never fingerprint a swap.
Coordinator-free. Peers meet by exchanging a one-line skt1… rendezvous ticket out of band and connect directly. No relay sees your swap; no operator can front-run, censor, or fail.
Forward-or-refund is the load-bearing invariant. Refunds are single-signed and pre-armed at negotiation time — before any coin is at risk. A crashed device, a vanished peer, or a dead machine routes to the refund timelock automatically.
A second-device watchtower can fire your pre-armed refund while your main machine is off. It can only ever broadcast your own refund (and fee-bump it): it holds no signing keys for completions, cannot steal, and cannot grief.
Parameters arrive signed, never as settings. Settlement parameters ship on BIP340-signed, strictly-versioned manifests verified against a build-time pinned operator key. Your config file deliberately cannot alter them.

Protocol lineage: v3.16 specification, unchanged (formerly developed under the internal codename "Swap Key"; current spec document: v18). Pinned, audited cryptography only — MuSig2, adaptor signatures, and nonces come from libsecp256k1 bindings; nothing curve-related is hand-rolled.

Honest status — read before touching anything

Testnet only

Mainnet is structurally impossible in this build — no configuration reaches it. That stays true until the external cryptographer review clears. Treat every coin this software touches as expendable test money.

~Half of swaps refund, by design

A safety pre-commitment fix is deliberately deferred to the cryptographer review. Until it clears, convention-mismatched attempts refuse and close through the refund path — funds come back automatically at the timelock. A refunded swap is the safety system working.

The hard gate is open

This is a novel composition, and novel compositions are where sound primitives are most often assembled unsoundly. The scoped external cryptographer review is the gate to everything beyond testnet — it is not substitutable by internal analysis, and its packet is ready and waiting.

Named debts, not waived

Corpus fuzzing under sanitizers (host limitation; a seven-surface hostile-input sweep ran interim), Tor transport, discovery, third-party watchtower delegation, enclave custody — all named, all deferred, none quietly dropped.

Proven live on testnet4

The settlement core is implemented in full as a Rust crate — 435+ automated tests green in the default configuration, 477+ with the Bitcoin Core backend, lint-clean in both — and the claims below are backed by on-chain evidence recorded in the repository's artifact log:

2026-07-16 — first live swap. Exact-D outputs on both sides, 124 vB Setup and Completion transactions, baked fees consumed exactly as signed. No coordinator, no external input.

2026-07-17/18 — dead-device refund drill. Wallet process killed after both escrows funded; the watchtower re-armed from a restored backup and survived a real machine reboot mid-timelock. The pre-armed refund fired on the tower's first poll after re-arm: 143 vB exact, confirmed on chain, wallet reconciled to Refunded.

2026-07-18 — signed-manifest governance round. The fleet converged on manifest v2; a staggered-rollout drill refused before dialing as designed; a four-arm operator-error matrix (retired key, corrupted payload, corrupted signature, version swap) refused cleanly on every arm. The round included a real operator key rotation after a passphrase loss — the documented recovery procedure, exercised for real, with anti-rollback held throughout.

MuSig2 / BIP 327 Taproot escrows Adaptor signatures TRUC / v3 + P2A anchors CPFP congestion backstop Signed-manifest governance

Downloads

Pre-alpha tester package — 0.1.0 (git d2955ba6a), Windows x86_64: switchbitcoin-prealpha-0.1.0-d2955ba6a-windows-gnu.zip (~8.8 MB) · release page. It ships the two binaries (switchbitcoin-cli, switchbitcoin-manifest), the tester guide, the bug-report template, the current signed manifest, the local HTML wallet UI, and SHA256SUMS — built by a release script that refuses to package any binary failing the full test gates or carrying a test trust root.

Zip SHA256 (verify before extracting):

25a02006d15aff68f23a978c6d14f67ea701fe3acd8070ca55070b7c59efa3dd

Pre-alpha testers are hand-picked. Verify the zip hash and the per-file SHA256SUMS before running anything, and check switchbitcoin-cli version prints the pinned trust root below.

Trust root (operator public key)

Every wallet build pins this BIP340 x-only public key at compile time. Signed parameter manifests that do not verify against it are refused. Cross-check the key your binary prints (switchbitcoin-cli version) against this page:

fedd62229b6c8a194d6d174d68ad0ce303623cbd49df4b968b9b06ea9e6ec7fe

This is the SECOND operator key (generated 2026-07-16). The first (fbb01df4…a2191e) was retired via the documented key-loss rotation; manifests it signed no longer verify — by design.

Signed parameter manifests

Settlement parameters are distributed as signed constants — never wallet settings. Each manifest is a 169-byte BIP340-signed envelope with a strictly-increasing version; wallets refuse replays, downgrades, and anything the pinned key didn't sign. Everyone in a test round runs the same version; ingest with switchbitcoin-cli manifest ingest <file>.

Version	Files	Status
v2 (current)	v2.manifest · v2-params.toml (readable source)	Signed 2026-07-16 by the current operator key. Id `cdda51a90e6d719b05e747666102483d1f7c799ae762b9d962bdddc4b011300e`. Sole change vs v1: onboarding delay 1–2 h (testing period; the production-scale 24–72 h returns in the first post-testing round).
v1 (history)	v1.manifest · v1-params.toml	Signed by the RETIRED first key — no longer verifies, kept as the governance-history record of the 2026-07-16 rotation.

Even a compromised operator key cannot push parameters that violate the wallet-side ordering invariant — bounds are asserted signature-blind on every compose, ingest, and load.

Testing & bug reports

Start with the Tester Guide — it takes you from nothing to a completed swap (own Bitcoin Core node required; there is deliberately no hosted RPC option) and keys every troubleshooting entry to the exact strings the wallet prints.

Bugs: run switchbitcoin-cli diag (redacted by construction — no seed, mnemonic, passphrase, or RPC secrets), fill in the bug-report template shipped in the package, and send it through the channel you were onboarded with. Pre-alpha testers are hand-picked; there is no public tracker yet.