Bitcoin PIPEs v2 enables native covenants and ZKP verification without a soft fork

If you've been anywhere near the developer discourse this spring—whether at OPNEXT 2026 or catching the streams from Bitcoin 2026—you've heard the chatter about PIPEs v2. Released back in February by the team at [[alloc] init], the formal papers (2026/175 and 2026/186 on the IACR Cryptology ePrint Archive) outline a way to bring native covenants and Zero-Knowledge Proof (ZKP) verification to Bitcoin Layer 1. The kicker? It does this entirely without a soft fork.

On the surface, this sounds like the holy grail. We get to emulate missing opcodes like OP_CAT, OP_CTV, and OP_VAULT, bypassing the notorious governance bottlenecks that keep Bitcoin's base layer functionally frozen. But when you look past the conference applause and dig into the architecture, you have to ask: who is this actually for?

The magic trick: AADP witness encryption

To understand the hype, we have to look at the cryptographic leap PIPEs v2 makes. The v1 architecture relied on Functional Encryption (FH-MIPE), which was largely a theoretical dead end for practical block-time decryption. The v2 release pivots to Arithmetic Affine Determinant Programs (AADP) Witness Encryption.

Here is how it works in practice: during a 1-of-N Decentralized Key Generation (DKG) setup, a standard Bitcoin private key is locked behind a specific cryptographic predicate. To spend the funds, a user provides a valid ZKP that satisfies this predicate. This triggers the decryption and generates a standard Schnorr signature through a new primitive called the Witness Signature (WS).

From an on-chain perspective, this is brilliant. Complex off-chain covenant logic becomes completely indistinguishable from normal Bitcoin traffic. You broadcast a standard signature to the L1 network, and no one is the wiser. It also beats existing off-chain models like BitVM by offering a completely non-interactive verification process. No ongoing operator liveness is required.

The 338-terabyte elephant in the room

Cryptographers are taking victory laps because they managed to optimize the dominant computational cost—the determinant computation—to execute within Bitcoin's standard 10-minute block interval via heavy parallelization. They also celebrate a "massive reduction" in ciphertext size.

Let's talk about that reduction.

Previous general Witness Encryption schemes required astronomical data limits. Evasive LWE, for example, needed 10^77 TB. PIPEs v2 brings this down to 338 Terabytes for roughly 15,000 arithmetic constraints.

Read that again: 338 Terabytes. Per ciphertext.

In my decade in the tech industry, I've seen plenty of products ship with heavy technical debt, but requiring a small data center to store a single ciphertext is a tough pill to swallow. We talk constantly about creating accessible, scalable ecosystems. Who exactly is going to manage 338 TB of storage just to program a covenant?

The answer is highly capitalized actors. The sheer hardware requirements restrict covenant creation to enterprise-level players, introducing a massive risk of infrastructure centralization. If the cost of avoiding a consensus-layer soft fork is handing the keys over to a few mega-whales who can afford the server racks, we need to seriously question if this is a trade-off worth making.

Bypassing governance or building a walled garden?

There is no denying the mathematical elegance of PIPEs v2. Solving the soft fork impasse is a massive achievement, and the ability to build native zkRollups and trustless bridges on Bitcoin is a tantalizing prospect for DeFi.

But we have to look at practical innovation, not just academic milestones. Right now, PIPEs v2 feels less like a democratized tool for builders and more like a brute-force workaround to avoid the messy reality of Bitcoin governance.

There are theoretical pathways aiming to reduce this storage burden down to 100 GB, which would undoubtedly change the conversation. Until those optimizations are realized, however, PIPEs v2 remains a brilliant piece of cryptography trapped in an impractical package. It functionally ossifies Bitcoin's base layer while building a VIP lounge on top of it—one where the cover charge is measured in petabytes.