Federated Peg

A federated peg is the trust model that lets bitcoin move between the main chain and a sidechain without changing Bitcoin's consensus rules. Rather than a fully trustless mechanism — which Bitcoin cannot natively verify for an external chain — a defined group of members, the federation, holds the deposited bitcoin in a threshold multisig wallet and collectively signs both the creation of sidechain coins and their eventual redemption. Liquid popularized this design, sometimes branded a "Strong Federation," and it remains the workhorse trust model for Bitcoin sidechains a decade on.

How the Peg Operates

The lifecycle is symmetrical. On peg-in, a user sends BTC to an address controlled by the federation's multisig; after a deliberately deep confirmation window — 102 blocks on Liquid, chosen to make a mainchain reorganization that unwinds a deposit practically unthinkable — an equivalent amount of the sidechain asset is issued to the user. On peg-out, sidechain coins are destroyed and the federation's signers release the corresponding BTC from the multisig. The members operating this machinery are the functionaries: known institutions running hardened, tamper-resistant signing modules that enforce the rules mechanically — the hardware will only sign peg-outs that match verified sidechain burns, so even a coerced operator cannot easily sign theft.

Honest-Majority Security

The peg remains secure as long as more than a threshold of the federation behaves honestly; on Liquid that is an 11-of-15 multisig, equivalent to needing roughly two-thirds of members. Because membership is known, geographically distributed, and equipped with attested hardware, the system achieves Byzantine fault tolerance against a minority of compromised, coerced, or offline signers, while accepting that custody is permissioned rather than self-sovereign. Designs of this class also incorporate timelocked recovery paths so that funds are not permanently stranded if too many signers go dark. The failure modes worth naming plainly: a colluding supermajority could steal the locked bitcoin outright, and a smaller blocking minority could freeze peg-outs — censorship without theft. Neither has occurred on the major deployments, but the security argument rests on incentives and accountability, not on mathematics alone, and that distinction is the whole point of the term.

What the Trade Buys

The federated model purchases properties the base chain does not offer natively: one-minute deterministic blocks, fast two-confirmation finality, confidential amounts and asset types, and permissionless token issuance. For traders shuttling funds between venues or issuers of digital assets, those are genuinely useful. The costs are the custody assumption, the deep peg-in delay, and — in practice — peg-out paths that route through federation members or whitelisted participants, adding a permissioned step to exit. This is a fundamentally different trust posture from holding UTXOs under your own keys, and the distinction matters to anyone designing a sovereign holding strategy: coins on a federated sidechain are a claim on the federation's honesty, not base-layer bitcoin.

Context in the Design Space

The federated peg is one point on a spectrum of two-way-peg designs. Drivechains would replace the known federation with miner voting; emerging optimistic schemes aim to reduce the honesty assumption to one-of-n; and a general treatment of the trust structure itself lives in our federation entry. The honest summary: federated pegs are the proven, shipping compromise — dramatically better than a single custodian, deliberately weaker than self-custody, and valuable precisely because they are explicit about which is which. Use them for what they are good at, size the exposure to the trust extended, and keep your long-term stack on the layer where no quorum's honesty is required.

A final habit worth keeping: verify, don't assume. Federated systems publish their member lists, thresholds, and peg mechanics precisely so users can audit the arrangement — read them before pegging in, and revisit them occasionally, because federations amend hardware, membership, and procedures over time. The model's whole virtue is that its trust assumptions are written down; the virtue is wasted on users who never read them.