In connection with the forthcoming X Layer deployment, we present our analysis for xBTC onboarding.
Summary
LlamaRisk supports the onboarding of xBTC as a part of the Aave X Layer deployment, conditional on improved liquidity conditions. The current lack of onchain supply (10 xBTC/~$1.13M) and DEX liquidity would represent onboarding an asset without meaningful demand on the network; the OKX team indicated that they intend to provide an initial $10M seed liquidity to bootstrap xBTC. The BTC wrapper is managed centrally by OKX, with key access control roles assigned to MPCs.
OKX has addressed previously identified legal concerns by confirming that all BTC supporting the xBTC program is securely held in designated, segregated addresses under the exclusive control of Aux Cayes, with no commingling or unauthorized use of assets. Access to xBTC is restricted to verified users in permitted jurisdictions, following a mandatory KYC process, with eligibility currently limited to clients of OKX Seychelles and institutional users in OKX Bahamas. Aux Cayes, incorporated in Seychelles and regulated as a Virtual Asset Service Provider under the VASP Act 2024, continues to operate lawfully under transitional licensing provisions, with its status confirmed by the Seychelles Financial Services Authority. OKX’s legal memorandum concludes that the xBTC program is fully compliant with Seychelles’ regulatory framework, authorizing Aux Cayes to offer and administer all aspects of the xBTC product.
1. Asset Fundamental Characteristics
1.1 Asset
OKX Wrapped BTC (xBTC) is a Bitcoin (BTC) wrapper backed 1:1 by native BTC custodied by OKX. xBTC is minted when users withdraw BTC from their OKX account to a supported network address (currently, Sui, Aptos, Solana, and X Layer). Underlying BTC is redeemed back into user accounts when xBTC is deposited on the OKX Exchange.
Source: OKX
1.2 Architecture
The core functions of xBTC - minting, burning, transferring, and receiving - are controlled by a permissioned system. A managed deny list controls which addresses can receive and transfer xBTC.
BTC deposits are held in OKX’s Bitcoin reserve address, which consists of BTC secured for xBTC minted on other networks. Proof of reserves is made available via the OKX homepage. The OKX team indicated that the reserve is a locked address, which strictly stores segregated BTC.
An internal alert system monitors and enforces the minting and burning of 1:1 BTC from OKX exchange addresses.
Source: Bitcoin Reserve, OKX, October 28, 2025
1.3 Tokenomics
xBTC is minted on a 1:1 basis with BTC deposits via OKX, and is burned when redeemed to maintain parity. Given that minting is facilitated by OKX, the liquidity and supply of xBTC are dependent on the availability of BTC on OKX.
Redemptions through OKX are permissioned and require an OKX account; this limits potential liquidations to OKX-approved liquidators.
1.3.1 Token Holder Concentration
A total of 10 xBTC (~$1.13M) is available on X Layer, with supply almost exclusively held in an OKX EOA. 29 holders are currently registered.
Source: X Layer explorer, xBTC, October 28, 2025
2. Market Risk
2.1 Liquidity
There is currently no meaningful liquidity to swap out of xBTC. Supply is still concentrated in an OKX deposit wallet. Following a discussion with the OKX team, they indicated that they intended to provide an initial $10M seed liquidity to an xBTX/USDT0 pool.
2.1.1 Liquidity Venue Concentration
A Uniswap USDG/xBTC pool appears to be the only pool available for xBTC currently; however, no meaningful liquidity is yet available.
2.1.2 DEX LP Concentration
DEX liquidity is yet to be established on X Layer for xBTC.
2.2 Volatility
X layer markets have yet to be established; therefore, volatility data is unavailable.
2.3 Exchanges
xBTC is currently not available on Centralized exchanges.
3. Technological Risk
3.1 Smart Contract Risk
A Zellic audit was completed on xBTC’s EVM code on October 14, 2025. 1 medium severity issue was found, which the team acknowledged. The issue is related to a custom transfer-role functions implementation, which DEFAULT_ADMIN_ROLE could bypass. However, this is by design.
The final report is yet to be published, with the team sharing an initial draft with us for this review.
3.2 Bug Bounty Program
xBTC smart contracts are covered under a live OKG bug bounty program hosted on HackerOne with a max bounty of $1 000 000.
3.3 Price Feed Risk
A Chainlink BTC/USD price feed is available on X Layer. The price feed has a 0.5% deviation and a 24-hour heartbeat.
3.4 Dependency Risk
xBTC relies on OKX to effectively maintain a 1:1 custody of the underlying BTC. As shown in section 1.2, reserves across chains are held in a single reserve address, accounting for underlying BTC on Sui, Aptos, X Layer, and Solana.
4. Counterparty Risk
4.1 Governance and Regulatory Risk
We have undertaken a detailed evaluation of the xBTC User Agreement, specifically addressing the intricacies surrounding minting and redemption rights, corresponding obligations, custody arrangements and representations, assurances of bankruptcy remoteness, as well as the segregation of assets.
4.1.1. Mint/Redeem Rights and Obligations
Minting (Subscription):
The Agreement prescribes that the user initiates a ‘subscription’ to xBTC by withdrawing BTC from their OKX account to a designated blockchain-compatible wallet address. On completion of this process, the user receives xBTC, which constitutes a wrapped on-chain representation of BTC, minted by an OKX-proprietary smart contract. It is expressly stipulated that this conversion is neither guaranteed to be instantaneous nor immune from suspension, rejection, or outright failure, all of which rest wholly within OKX’s discretion. During such periods of delay or failed execution, Users may find themselves unable to access either the withdrawn BTC or the newly minted xBTC. Furthermore, OKX retains unfettered authority to deny, pause, or terminate any xBTC subscription activity at any time and without advance notice or any obligation of redress. Redemption of xBTC is strictly circumscribed—permissible exclusively via the procedures articulated in the Agreement—and any off-platform transfer, sale, or disposition results in the forfeiture of redemption privileges tied to the associated BTC. Stringent compliance obligations are imposed, including Know-Your-Customer (KYC), anti-money laundering (AML), and Travel Rule requirements. Critically, the minting and associated functionalities are customized for and managed solely by OKX, with no recourse to third-party validation or adherence to open standards.
Redemption:
The process of converting xBTC back to BTC is similarly defined and equally restrictive: redemption is only initiated by depositing xBTC into the user’s OKX account. This purportedly straightforward transaction is, however, also potentially subject to delays, outright failure, or rejection, all at the discretion of OKX. The Agreement is unequivocal that redemptions undertaken outside this process are unsupported and thus void. While OKX commits to using “best efforts” to maintain a 1:1 redemption parity between xBTC and BTC, it simultaneously disclaims responsibility for any divergences in this ratio arising on external platforms. Should the aggregate BTC reserve held by OKX fall short of the total outstanding xBTC, redemptions become available solely on a pro-rata basis; thus, users must accept the real possibility that full redemption may be unattainable, and the Agreement offers no guarantee against such shortfalls. OKX reserves the unqualified authority to halt or suspend redemptions at any juncture, further underscoring the absence of any assurance as to user convertibility rights.
As a result, the entire mint and redeem framework is characterized by broad, largely unrestrained discretion on the part of OKX. There exists neither an absolute nor an irrevocable entitlement for users to subscribe to or redeem xBTC. Users are thereby exposed to elevated risks of asset inaccessibility, whether due to technical disruptions, policy amendments, compliance barriers, or the necessity of proportionate redemption if reserve assets prove inadequate.
4.1.2. Custody Commitments and Assurances
The Agreement purports that BTC utilized for xBTC subscriptions “will be segregated”; however, it immediately qualifies this by affording OKX the latitude to “from time to time pool such BTC with other users’ assets in non-segregated omnibus accounts, at its discretion.” This flexibility is further substantiated through direct reference to Clause 4.5 of the overarching OKX Terms of Service, which explicitly provides: “By accepting these Terms, you expressly agree to the pooling of your Digital Assets with the Digital Assets of other users. Digital assets of users are not protected by deposit protection or a deposit insurance scheme. In the case of an irreconcilable shortfall, deposited assets or funds may not be fully recoverable.” Accordingly, the legal or physical segregation of user assets is not only unguaranteed but flatly superseded by provisions enabling asset pooling and collective management.
Within this framework, users are made subject to all risk factors outlined throughout this Agreement and the more comprehensive OKX Terms of Service, both of which contain numerous, explicit disclaimers of liability. OKX specifically disavows responsibility for the vast majority of losses—most notably those deriving from technical malfunctions, unauthorized access, hacking, operational errors, catastrophic events, or otherwise. Furthermore, OKX offers no guarantee regarding the value of the asset, the absolute ability to redeem it, or the efficacy and security of the custody infrastructure and underpinning digital asset networks.
It is therefore evident that OKX’s custody undertakings are minimal and extensively caveated. The Agreement permits, and indeed contemplates, the routine comingling of user assets in a non-segregated, pooled context. Any assurances of asset protection or custodial transparency are limited, placing the risk burden squarely on users’ shoulders.
4.1.3. Bankruptcy Remoteness and Segregation of Assets
The Agreement is silent with respect to bankruptcy remoteness, offering no explicit assurances that user assets will be insulated from claims by OKX’s general creditors in the event of insolvency. There are no provisions establishing a trust, instituting escrow arrangements, or designating third-party custodians to safeguard user BTC; accordingly, the Agreement fails to confer any form of statutory, contractual, or structural protection that would elevate user assets above the reach of an insolvency administrator or liquidator. The language concerning asset pool shortfalls—specifically the application of a “pro rata return” mechanism—implicitly recognizes that users hold no individualized property rights in specific BTC. Rather, their interests are limited to an undifferentiated claim against a collective asset pool. This absence of individualized entitlement means, in a liquidation scenario, user BTC may be swept into the estate available for distribution to all creditors.
While the Agreement alludes to OKX’s intention to “endeavour” to segregate BTC used in connection with xBTC subscriptions, this aspiration is immediately tempered by the express allowance that such assets “may be pooled in non-segregated omnibus accounts.” There is, therefore, no binding contractual obligation on OKX to preserve strict segregation between the BTC held for xBTC users and other assets in its custody—including those belonging to the platform itself or to other users. In practical terms, this means client BTC may be freely commingled, used to satisfy the obligations of OKX, or exposed to setoff rights held by counterparties or creditors in the ordinary course of business.
In the absence of a robust framework mandating asset segregation or a clear declaration of trust in favor of xBTC users, the legal position of customers is precarious. Users’ BTC may be swept into OKX’s general pool of assets, exposed to commingling, and therefore potentially leveraged or appropriated to meet unrelated OKX liabilities.
4.1.4. Clarification Round
The legal deficiencies identified above have been communicated to OKX representatives, with an explicit request for clarification as to how the company intends to mitigate or resolve these concerns. In response, OKX has asserted that the BTC underpinning the xBTC program is maintained in a designated, locked address, which is solely controlled by Aux Cayes. This locked address, according to OKX representatives, is subject to strict segregation protocols, ensuring it remains entirely distinct from BTC held on the OKX exchange for other client purposes or from OKX’s proprietary funds. The company maintains that there is no commingling of user assets in these reserve accounts under any circumstances.
Furthermore, OKX states that BTC held within these designated reserve (locked) addresses is not subject to staking, lending, rehypothecation, or any form of use as liquidity, collateral, or for other third-party purposes.
OKX has provided a shareable legal memorandum regarding the xBTC programme, which discloses that both subscription to, and redemption from, xBTC are presently limited to users of OKX Seychelles and OKX Bahamas, the latter being restricted exclusively to institutional clientele. All users must complete a mandatory KYC process before gaining access to restricted services such as xBTC, ensuring that services are only provided in jurisdictions where they are legally permitted.
Addressing the permissibility of Aux Cayes Fintech Co. Ltd. (the operator of xBTC program) in delivering these services, it is relevant to note that Aux Cayes is a legal entity incorporated in the Seychelles, and is subject to oversight as a Virtual Asset Service Provider (“VASP”) governed by the Virtual Asset Service Providers Act, 2024 (“VASP Act”), under the regulatory authority of the Seychelles Financial Services Authority (“FSA”).
Aux Cayes has duly submitted its licence application pursuant to the transitional framework established for pre-existing VASPs that were in operation prior to the commencement of the Act, having filed by the statutory deadline of 31 December 2024. Until the issuance of a full licence, it continues to operate lawfully under the transitional provisions as set forth in the VASP Act.
The regulatory framework enshrined in the VASP Act and its accompanying Regulations empowers licensed VASPs to engage in a variety of regulated activities, including:
• Virtual asset exchange services – exchange between virtual assets or between virtual assets and fiat currency.
• Transfer services – conducting or arranging transfers of virtual assets between wallets or accounts.
• Safekeeping or administration of virtual assets or instruments enabling control over virtual assets (i.e., wallet provider services).
• Participation in or provision of financial services related to an issuer’s offer or sale of a virtual asset.
Verification of Aux Cayes’ registration as a VASP has been independently confirmed through the FSA’s publicly accessible online registry.
Source: FSA Licensed VASPs, Date: October 28th, 2025
OKX’s legal memorandum ultimately concludes that the xBTC program, as operated by Aux Cayes, is squarely within the remit of the VASP Act. Thus, under the laws of Seychelles, Aux Cayes holds the requisite legal authority to offer the xBTC product, encompassing both the minting and burning of xBTC as well as the custodianship of the underlying BTC wallet.
4.2 Access Control Risk
xBTC is deployed behind a Transparent Upgradeable Proxy, with the current implementation contract deployed on September 18, 2025.
4.2.1 Contract Modification Options
A Role-Based Access Control system is utilized. The roles and their associated capabilities are outlined below:
- MINTER_ROLE: Can mint and burn tokens, assigned to MPC 1.
- DENY_LISTER_ROLE: Can pause/unpause transfers and manage the deny list, assigned to MPC 2.
- DEFAULT_ADMIN_ROLE: Has admin privileges, assigned to MPC 2.
Sensitive functions accessible by each role include:
- DEFAULT_ADMIN_ROLE:
- All Deny List Role functions
- grantRole assigns roles to addresses
- revokeRole removes roles assigned to addresses
- MINTER_ROLE:
- mint & burn xBTC
- transferMinter relinquishes the role to a new account
- DENY_LISTER_ROLE:
- pause and unpause all token transfers
- setReceiver determines where newly minted are sent
- addToDenyList & removeFromDenyList controls a permissioned Deny list that blocks addresses from sending/receiving tokens
- transferDenyLister relinquishes the role to a new account
These roles highlight the highly centralized controls that roles have key contract functions, i.e,. minting, transferring, pausing, and determining where newly minted xBTC are sent (and indirectly, access to the underlying BTC redemption right).
4.2.2 Timelock Duration and Function
No timelock has been deployed on the xBTC contract, meaning sensitive actions such as upgrades, sensitive calls, or role changes can be executed without delay or public notice.
4.2.3 Multisig Threshold / Signer identity
MPCs are controlled internally by OKX; no external parties are involved in the management of control systems. Admin actions require internal review and senior management approval.
Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and available here.
Aave V3 Specific Parameters
Aave V3 specific risk parameters for xBTC will be presented jointly with Chaos Labs prior to instance deployment.
Price feed Recommendation
We recommend using the Chainlink BTC/USD price feed available on X Layer.
Disclaimer
This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.