BitFi Basis

BitFi Basis is BitFi’s native yield-bearing Bitcoin liquid staking / basis-trading DeFi protocol. Its official website is bitfi.one and the public docs are at docs.bitfi.one. The docs describe bfBTC and bfUSD; bfBTC is the yield-bearing Bitcoin product, while bfUSD is a fully collateralized USD stablecoin minted from USDT/USDC using Chainlink-secured pricing.

The protocol is described by third-party analytics as a basis trading protocol operating on 7 chains: Binance, Ethereum, Base, Pharos, Hemi, Bitlayer, CORE. The latest web evidence available to me does not let me verify an on-chain launch block/date, native-token design beyond bfBTC/bfUSD, or contract addresses to the required standard; those items are Not verifiable as of 2026-09-03. For contract addresses, the docs page does list deployed bfBTC addresses per chain, but I cannot cross-check them on-chain here, so explorer verification status is also Not verifiable as of 2026-09-03.

The most relevant docs citation available names bfBTC deployments on Binance Smart Chain, Bitlayer, Ethereum, and Base, but I cannot confirm whether these are the main production contracts or whether they are proxies/upgrades without explorer access. Fork lineage is also only partially verifiable from the gathered web data. The docs call BitFi a CeDeFi hybrid approach, but I do not have enough evidence to prove it is a fork of a specific upstream protocol or to detail code changes, audit scope, or malicious-modification history in comparable forks.

The docs do reference an audit report page for bfBTC and bfUSD, but the actual report contents were not available in the gathered evidence, so audited-change status is Not verifiable as of 2026-09-03.

BitFi Basis looks like a real live product portal, not just a static landing page: the main site advertises deposits for BTC and USD, and the docs site includes deployed-contract pages, a points program, FAQs, and a vault exit flow, which indicates an operating app and supporting documentation rather than a mockup. The docs also reference a specific token contract and price-oracle integration, which is consistent with an active protocol stack. That said, the web evidence is incomplete on actual live deposit/withdrawal execution from the current interface, and those functions are not verifiable as of 2026-09-03 from the available sources alone.

The only directly visible product claim on the homepage is a marketing-style line about deposits and multiple yields, while the docs show user journeys but do not themselves prove successful on-chain processing. There are some mild template/marketing signs: the homepage snippet is very sparse, and the docs headline repeats the brand name with a polished, generic SaaS-style structure. No broken links were verified from the available evidence, and no clear fake metrics were confirmed; the “over $480M in assets under management” figure appears in docs, but it is an unverified marketing claim unless cross-checked on-chain.

Open API: Not verifiable as of 2026-09-03. The available docs index shows developer-oriented pages and contract/oracle references, but no directly confirmed public API reference, endpoint list, or authentication scheme was visible in the retrieved evidence.

No verifiable active bug bounty program for BitFi Basis was found in the gathered sources. The only clearly documented bounty activity tied to BitFi was for the Bitfi wallet in 2018–2019: a $100,000 bounty was announced on July 24, 2018, later raised to $250,000, plus a separate $10,000 bounty for firmware/security issues. The program’s stated parameters required buying a wallet, could include attacks against servers/nodes/infrastructure, and sought either recovery of preloaded coins or disclosure of valid vulnerabilities.

Reported results: at least two claimed hacks/attempts were discussed publicly, and Bitfi later said the bounty programs were closed in August 2018 / January 2019. This is not verifiable as an active bug bounty for BitFi Basis as of 2026-09-03.

Дата проверки: 5 сентября 2026 г. Dune MCP недоступен; ончейн-балансы, фактические резервы, chain-by-chain TVL и доля экспозиции Not verifiable as of September 5, 2026. Оценка: высокий риск зависимости от централизованных контрагентов и управляющих полномочий.

• Стейблкоины: bfUSD заявлен как обеспеченный USDT/USDC. USDT учитывается по 1:1, а конвертация USDC использует Chainlink. Поэтому дефолт/заморозка эмитента, depeg, задержка redemption либо сбой/манипуляция oracle могут нарушить minting, расчёт долей и погашение. Это также создаёт концентрацию на двух централизованных эмитентах.
• CEX, MM и кастодиан: стратегия использует perpetuals/futures, funding rates, basis trades и профессиональные quantitative teams. Указанная инфраструктура связана с Ceffu MirrorX и Binance; риски включают insolvency/freeze Binance, ликвидации, отрицательные funding rates, ошибку модели, market-maker/exchange failure и операционный риск Ceffu.
• Юридическая структура MirrorX: условия Ceffu предусматривают, что при insolvency Binance либо длительной заморозке активов Ceffu рассчитывает доступный баланс преимущественно по данным Binance; возврат ограничен locked assets, а убыток/недостача выше этого уровня остаётся риском клиента. При acceleration Ceffu/Binance могут прекратить сервис, закрыть позиции и использовать locked assets для погашения обязательств.
• Bridge/cross-chain: bfUSD, hbfUSD и pbfUSD поддерживают LayerZero-перемещение между сетями; следовательно, добавляются риски LayerZero/endpoint, сообщений, ликвидности и chain-specific smart contracts. Экспозиция по Binance, Ethereum, Base, Pharos, Hemi, Bitlayer и CORE Not verifiable as of September 5, 2026.
• RWA, LST/restaking: независимого подтверждения RWA/SPV, LST или restaking-экспозиции не найдено — Not verifiable as of September 5, 2026.
• Админ-риск: SlowMist отмечает owner-права на upgrade, pause, oracle-delay, custody, mint/redeem limits и другие критические параметры; findings были acknowledged, а не устранены в самом отчёте. > Противоречия: BitFi заявляет свыше $480 млн AUM, тогда как DIA показывал $190.3 млн TVL на устаревшем снимке; разница не разрешима без Dune. DIA также указывал «No audits», хотя публичный SlowMist audit существует — вероятно, неполнота агрегатора. Сценарий потерь: USDT/USDC depeg + oracle error или Binance/Ceffu freeze может остановить mint/redeem; basis unwind и отрицательный funding могут вызвать drawdown в Pulsar и косвенно ударить по Horizon. Текущая активная авария не подтверждена независимо.

BitFi Basis appears to organize custody through a third-party institutional custodian rather than user self-custody: BTC deposits are described as held by Ceffu in cold storage, while BitFi uses MirrorX to run basis-trading and hedge execution without moving the underlying BTC. The practical flow is user deposit -> Ceffu custody/settlement -> MirrorX-linked execution on Binance infrastructure, with bfBTC issued 1:1 against the custodied BTC. This is a centralized custody model with counterparty risk at the custodian/exchange layer, not a fully self-custodial design.

On segregation, the available evidence says custody is described as segregated and institutional-grade, but a fully independent on-chain verification is not available here; so segregation is not verifiable as of 2026-09-05. Withdrawals: not verifiable as of 2026-09-05. The available sources indicate users can redeem/unstake, but there is no verified evidence in this run that withdrawals are currently paused.

Incidents since launch: I found no verifiable evidence of a protocol-level exploit, treasury drain, or depeg event for BitFi Basis in the gathered sources. The only incident-like security signal in the material is a SlowMist audit note that the owner role could change important contract variables and should be moved to a multisig to reduce single-point risk, which is a design risk rather than a confirmed loss event.

Important caveat: a returned search result for “BitFi” wallet bounties from 2018 refers to a different product/company and is not BitFi Basis; I excluded it as a namesake mismatch.

BitFi Basis appears to use a custodial / CeDeFi key model rather than pure self-custody. Independent analysis describes BTC deposits as being custodied by Ceffu, which implies users are not directly holding or managing the protocol’s operational keys themselves. For the broader Bitfi wallet design, the company says the device does not permanently store private keys; instead, users enter a salt and secret passphrase, and the device deterministically calculates the private key at transaction time, signs, and then wipes the key from memory.

That is a single-user-derived key model, not a multisig or shared-key scheme. For BitFi Basis specifically, however, the exact internal key-management architecture for each supported chain is Not verifiable as of 2026-09-03 from the available sources. What is verifiable is that the protocol is described as relying on an external custodian for BTC activity, so the operational key control is at least partly centralized.

In practical risk terms, this means key management is likely organized around:

• User-side access credentials for wallet interaction in the Bitfi product layer.
• Custodian-controlled keys for BTC treasury/deposit operations in Basis.
• No verifiable evidence in the available sources of multisig, MPC, or chain-by-chain key separation for the protocol’s seven listed chains.

Assessment: High admin/key risk; deployment state only partially verified. Addresses & verification

• Ethereum bfUSD: 0xa3eB7A9e57FCa4e40b79E394eD5eB37fEd205A24 — explorer identifies it as bfUSD and exposes an ERC-1967/UUPS-style proxy ABI with Upgraded; contract creation is shown on November 3, 2025.
• Ethereum instant redeemer: 0x0971cB672b4eF3E19284Aa64717aFb154A6fbeDF — independently published in the DefiLlama adapter documentation.
• BSC, Base, Pharos, Hemi, Bitlayer and CORE addresses: Not verifiable as of September 5, 2026.
• Proxy-admin address/type from decoded on-chain events, current implementation, owner, role holders, renounced roles, timelock delay, and latest block state: Not verifiable as of September 5, 2026. Admin powers / failure modes SlowMist’s December 1–5, 2025 audit describes UUPS upgradeability across the token, minter, manager, staking, redeemer, Merkle-stash and zap modules. Owners can change minters/limits, redeemers, custody wallets, fee receivers/fees, blacklist and whitelist state, settlement parameters, staking pools, and pause/unpause certain modules. The audit recorded two medium-risk findings—cross-chain supply-cap bypass and excessive privilege—both marked “Acknowledged,” plus five suggestions. No critical or high-severity findings were reported in that audit. Can users exit without admin? The code includes an instant-redeemer path, but whether it is enabled, solvent, unpaused, and usable on each chain is Not verifiable as of September 5, 2026. A compromised owner key could upgrade implementations, alter custody/fee/oracle-related parameters, authorize malicious minters/redeemers, blacklist users, or pause exits; a malicious upgrade could plausibly seize protocol-controlled collateral. Timelock protection is Not verifiable as of September 5, 2026. Architecture ``text User ├─ Mint → Minter → bfUSD proxy/token ├─ Redeem → Instant/Standard Redeemer → Custody └─ Stake → Staked bfUSD → Manager / pools └─ Merkle stash / Zap / cross-chain messaging Owner ── upgrades + parameters + pause/roles across modules `` Contradiction / limitation: DefiLlama reports roughly $239m TVL across seven chains, but contract-level ownership, collateral control and exitability are not independently verified here.

Corrected record: SlowMist audit of BitFi Bitcoin (bfBTC), a BitFi Basis product. The report’s audit-result date is December 6, 2024, not December 1, 2025. It reviewed the BitFi Bitcoin proxy/vault contracts, including Bfbtc and BfbtcBitlayer; final audit commit e79c83d2afb702bbfeaa39c05b8e7fde11f0cc1b.

The report explicitly states the audited code was not deployed to mainnet. Bytecode match against current BitFi Basis deployments: Not verifiable as of 2026-09-05.

Reconfirmed: SlowMist audit of BitFi USD (bfUSD), a BitFi Basis product. The report covers repository path contracts/bfusd and final audit commit 378ccff38edb462a3957b229fea56e597196914d. It explicitly states the audited code was not deployed to mainnet. Bytecode match against current BitFi Basis deployments: Not verifiable as of 2026-09-05.

BitFi’s docs state there is also a SlowMist audit report for BitFi Bitcoin (bfBTC). The search result confirms the report exists, but the underlying PDF content was not available in the retrieved snippet, so the exact findings and fix status are not verifiable here.

BitFi Basis appears to be part of the broader BitFi.one CeDeFi / BTCFi platform, not a standalone, separately branded team. ### Founders & team

• Public founder: Han (Liu) Liu, described as *Founder and CEO of BitFi.one* and *ex‑CTO / co‑founder of AscendEX exchange*.
• Multiple profiles and press releases consistently attribute BitFi’s creation to Han Liu, with prior roles at AscendEX and earlier at BlackRock (analyst).
• Other BitFi ecosystem founders (for the separate Bitfi hardware wallet brand) include Daniel Khesin and Michael Strong, but those sources relate to bitfi.com hardware wallet and CeDeFi expansion, not clearly to BitFi.one Basis trading. This is a potential name-collision and should not be assumed as the same corporate entity. Reality check: For BitFi Basis specifically, no dedicated team page, named portfolio managers, or protocol‑level leads were found. Not verifiable as of 2026‑09‑03. ### Public vs. anonymous; credibility
• Han Liu is fully public, with a LinkedIn profile listing BitFi founder role since 2024 and prior C‑suite exchange experience.
• AscendEX has faced market‑wide stress in past cycles, but no direct evidence of major security incidents personally attributed to Han Liu was located in the retrieved data. Not verifiable as of 2026‑09‑03.
• BitFi Basis has no published audits according to a DeFi analytics profile, which is a material negative for institutional credibility. ### Jurisdiction, office, onshore/offshore
• BitFi ONE marketing and press releases reference Singapore for product launch communications, and founder contact details include a US phone number and state presence in New York.
• Some corporate data for the separate Bitfi wallet lists Miami, United States as contact location. Reality check:
• There is no clear, on‑chain‑verifiable or registry‑verified corporate entity, license, or formal jurisdiction tie specifically for *BitFi Basis* surfaced in independent datasets. Not verifiable as of 2026‑09‑03.
• Office locations (New York, Singapore, Miami) appear in media and directory listings but are unverified marketing/third‑party claims rather than corporate registry records. ### Real business vs. web front
• BitFi.one reports hundreds of millions USD AUM and basis‑trading TVL on analytics platforms, indicating actual usage, but these are aggregator figures, not raw on‑chain verification.
• Absence of a public audit, limited governance disclosure, and unclear legal entity mapping mean BitFi Basis should be treated as operational but high‑opacity CeDeFi infrastructure, not a fully transparent institutional platform.

BitFi Basis currently has a mixed but not overtly toxic reputation: several independent risk/analytics platforms flag it as higher-risk CeDeFi with significant centralization and opacity, yet there are no public records of hacks, rugs, fraud charges, or sanctions as of 2026‑09‑03. Protocol & risk ratings

• BitFi Basis is a CeDeFi basis‑trading yield platform built around bfBTC/bfUSD and Ceffu MirrorX custody, operating on 6–7 chains including Binance, Ethereum, Base, Bitlayer, CORE, Hemi, Pharos.
• Hindenrank assigns BitFi Basis a C+ risk grade with score ~41–42/100, explicitly highlighting centralized custody (Ceffu) and CeDeFi architecture as risk factors.
• ZARQ gives BitFi Basis a Trust Score of 68/100 (grade B) and notes no known security incidents.
• DefiSentinel rates BitFi (platform level, including bfBTC/bfUSD) as C (rated risk), safety score 49/100, emphasizing dependence on Ceffu MirrorX, off‑chain trading strategies, and stablecoin design. Audits & security assurances
• The main BitFi site markets “Extensive Audits” and “verified safe by the world’s leading blockchain security auditors”, but does not clearly list Basis-specific audits on the landing page — this is an unverified marketing claim.
• Docs reference a SlowMist audit for bfBTC smart contracts, but this appears focused on the token/staking infrastructure rather than the full CeDeFi basis‑trading stack.
• DiaData explicitly states “BitFi Basis has not published audit reports” for the protocol. Founders, investors, and governance
• Independent profiles (Hindenrank, DefiSentinel, ZARQ, DiaData) focus on technical/structural risk; none provide detailed, verifiable founder or investor lists.
• No widely cited VC backer or public governance framework is visible in third‑party coverage; BitFi Basis appears operator‑driven and centralized, which is a key reputational concern. Incidents, allegations, regulatory/sanctions
• Independent risk dashboards and DeFi data platforms report no hacks, exploits, or protocol insolvency events for BitFi Basis.
• Web data reviewed shows no public fraud/rug‑pull or formal regulatory enforcement actions specifically naming BitFi Basis or bfBTC/bfUSD.
• However, reliance on a centralized custodian (Ceffu) and opaque off‑chain trading strategies is repeatedly flagged as a structural, unresolved concern for institutional allocators. Key unresolved reputational risks
• Centralized custody and strategy execution via Ceffu MirrorX; users depend on off‑chain solvency and operational integrity.
• Audit gap: third‑party analytics say Basis itself has no published audits despite marketing claims.
• Transparency: limited public detail on founders, risk committee, and governance, plus CeDeFi architecture, keeps BitFi Basis in a heightened‑risk bucket for institutions. Not verifiable as of 2026‑09‑03: any on‑chain facts, full list of auditors beyond SlowMist, detailed founder/investor identities, or regulatory filings.

As of September 5, 2026, BitFi Basis is a CeDeFi basis-trading product centered on bfUSD, minted against USDT/USDC. The stated strategy is delta-neutral: spot/long exposure is hedged with perpetuals/futures, with yield from positive funding rates, basis spreads, and, where applicable, staking. Exposure is operationally external through Ceffu/MirrorX and Binance-linked execution; therefore market neutrality is targeted, not guaranteed, and users retain exchange, custodian, counterparty, liquidation, oracle, and smart-contract risk.

Products: Horizon (hbfUSD) is the conservative delta-neutral vault; Pulsar (pbfUSD) is higher-risk, can suffer epoch drawdowns, and receives boosts funded partly by Horizon insurance revenue. Stated target APYs are 9% Horizon and 17% Pulsar, but these are targets, not verified realized returns. BitFi explicitly separates “real yield” from BFI-token subsidies; BFI rewards are therefore subsidized, while real yield is strategy-generated.

APY history, realized volatility, and sustainability are Not verifiable as of September 5, 2026. Collateral is USDT/USDC for bfUSD. Standard staking, minting, and redemption are fee-free but require epoch processing/manual claim; instant redemption costs 0.5% and cross-chain transfers incur configurable LayerZero fees.

Exact lock-up/epoch duration, quotas, withdrawal limits, and current fee parameters are Not verifiable as of September 5, 2026. The audited-code summary reports an acknowledged medium-severity redeem/zero-amount loss scenario. DeFiLlama snapshot: total BitFi Basis TVL $236.45m, +23.6% over 30 days; BSC/Binance $99.15m (41.9%), Ethereum $69.71m (29.5%), Base $27.78m (11.7%), Pharos $26.12m (11.0%), Hemi $13.64m (5.8%), Bitlayer $51.4k, CORE $189.

TVL by product is not published separately. 30-day fees were $2,413.88 and protocol revenue $0. Contradiction/scope note: BitFi’s docs claim $480m+ AUM and 6%+ native APR, while DeFiLlama reports $236.45m for BitFi Basis and $319.22m for combined BitFi; the figures use different scopes and are not reconciled. Dune on-chain TVL, chain trend, leverage, and product splits are Not verifiable as of September 5, 2026.

As of September 5, 2026, reserves/treasury are not fully verifiable.

• liquid_reserves_usd: Not verifiable as of 2026-09-05.
• liabilities_usd: Not verifiable as of 2026-09-05.
• Dune/on-chain balances: Not verifiable as of 2026-09-05; Dune MCP was unavailable in this run, so no balances or block-height snapshot is asserted.
• Addresses: The Ethereum bfUSD proxy/token address identified in explorer data is 0xa3eB7A9e57FCa4e40b79E394eD5eB37fEd205A24. This is a token contract, not a verified reserve or custody wallet. A complete, independently verified custody-address map across Binance, Ethereum, Base, Pharos, Hemi, Bitlayer, and CORE was not found.
• Composition/policy: BitFi documentation states that bfUSD is minted from USDT and USDC and is “fully collateralized”; it also describes Ceffu custody for BTC strategies. These are protocol-side or marketing claims and do not establish reserve size, segregation, liquidity, or current backing.
• Custody/control: The SlowMist audit identifies configurable custody-wallet/custody fields and extensive owner privileges, including upgrades, parameter changes, minting limits, redeemers, fee receivers, and custody changes. The audit recommended transferring ownership to multisig and separating privileges; its finding does not verify that this was implemented.
• Attestations: Not verifiable as of 2026-09-05. The available SlowMist document is a smart-contract audit, not a reserve attestation or proof of solvency. Contradiction / data-quality callout: DeFiLlama reports approximately $319.6M for the combined BitFi parent protocol across nine chains, while Hindenrank reports approximately $239M–$274M for BitFi Basis. These are aggregator TVL figures, not reserves, and the scope differs; they must not be treated as treasury balances. BitFi’s website claims $480M+ AUM, an unverified marketing claim and inconsistent with the cited aggregator figures. Bottom line: reserve size, liabilities, custody balances, reserve composition, reserve policy, and effective control are Not verifiable as of 2026-09-05.

BitFi Basis is a DeFi protocol with a documented native asset bfBTC, not a clearly separate governance token in the sources reviewed. The available web evidence identifies bfBTC as BitFi’s native yield-bearing Bitcoin liquid staking token, minted when BTC is bridged on-chain, and used to earn BTC rewards; however, the specific tokenomics items you asked for — bfBTC/BFI contract address for the “native token” of BitFi Basis, total vs. circulating supply, market cap/FDV, full allocation table, insider wallets, top-holder concentration, mint/blacklist/fee-switch controls, and whether announced unlocks actually occurred on-chain — are Not verifiable as of 2026-09-03 from the gathered sources. What is verifiable from the web sources:

• BitFi Basis is the protocol name and it spans 7 chains in the indexing source: Base, Binance, Bitlayer, CORE, Ethereum, Hemi, and Pharos.
• DefiLlama lists BitFi Basis TVL at $213.83m, with chain breakdown: BSC $76.94m, Ethereum $72.81m, Hemi $42.62m, Base $21.46m, and CORE/Bitlayer at $0 in that snapshot.
• BitFi’s docs identify bfBTC as the protocol’s native yield-bearing token and show deployed bfBTC contracts across several chains, but the web snippets do not provide a complete, single canonical contract map for all requested chains or a separate governance token contract.
• A public-sale page for BFI states maximum supply 1,000,000,000 BFI, public-sale supply 10,000,000 BFI (1%), implied FDV $50,000,000, and day-1 float 145,000,000 BFI (14.5%); this is a protocol-published claim and not independently on-chain verified here.
• Secondary coverage reports the same BFI tokenomics and says the sale had all tokens fully unlocked at TGE, but that remains an off-chain claim in the gathered material. I could not verify, from the gathered sources alone, any revenue-share, buyback, burn, or staking-reward distribution mechanics for BFI beyond bfBTC’s yield-bearing function, nor any enforceable unlock schedule or insider wallet concentration.

A fall of Bitcoin below $10,000 would likely be a severe stress event for BitFi Basis because the strategy’s returns depend on basis/funding dynamics, and sustained bearish conditions can push funding negative and erode or eliminate yield. The available sources do not provide on-chain balance-sheet data or liquidation thresholds for BitFi Basis, so the exact loss severity is Not verifiable as of 2026-09-03. What can be said from the sources is that BitFi Basis is exposed to a basis-trading / delta-neutral structure, and a prolonged bear market with negative funding can reduce bfBTC yield to zero or below, force redemptions, and pressure bfUSD if both tokens are backed by the same positions.

Hindenrank’s scenario analysis says that in such a prolonged negative-funding squeeze, the protocol could face cascading redemptions and simultaneous stress across bfBTC and bfUSD, with potential losses for remaining holders. That means a BTC move under $10k is best treated as a high-severity tail-risk scenario for the protocol, especially if it coincides with sustained negative funding, thin liquidity, and redemption pressure. A separate point: the search results include general market commentary that BTC could reach $10,000 in extreme macro scenarios, but those are market-wide forecasts, not BitFi-specific data.

Not verifiable as of 2026-09-03. The provided results do not include on-chain position data for BitFi Basis across Binance, Ethereum, Base, Pharos, Hemi, Bitlayer, or CORE, so the effect of a 20% depeg in the largest collateral cannot be calculated from the available evidence. The BitFi docs only state that BitFi has over $480M in AUM, but they do not break down collateral composition, debt, LTV thresholds, liquidation rules, or chain-by-chain exposure for this specific protocol instance. What can be said from the search results is limited to general DeFi depeg mechanics: collateral depegs can trigger undercollateralization, liquidations, and contagion, especially when the depegged asset is widely used as collateral or when liquidation markets are thin.

However, without verified BitFi Basis vault balances and risk parameters, any estimate of liquidations, bad debt, or insolvency would be speculative. If you want a usable stress test, the missing inputs are:

• the largest collateral asset and its share of total collateral,
• the vault or market LTV / liquidation threshold,
• the amount of borrowed debt against that collateral,
• whether the collateral is concentrated on one chain or split across chains,
• and the liquidation mechanism / bonus. With those, the stress result could be computed precisely. For now, the correct institutional answer is: Not verifiable as of 2026-09-03.

BitFi Basis appears to use a tranched loss structure for bfUSD: the lower-risk Horizon vault is the user-facing yield sleeve, while the higher-yield Pulsar vault is described as the loss-absorbing buffer for Horizon. In a counterparty-insolvency stress, the expected loss path is therefore: first the off-chain basis-trading/custody layer suffers the impairment, then losses are passed into Pulsar, and only if losses exceed that buffer do they threaten Horizon principal and/or redemption value. Who absorbs the loss: Pulsar first, then potentially Horizon users if the shortfall is larger than the buffer.

The source explicitly says Pulsar acts as a loss-absorbing buffer for Horizon, which is the key contractual risk transfer point. Compensation: the available web evidence does not verify any formal insurance fund, backstop reserve, or guaranteed compensation mechanism beyond the tranche design. So the only supportable statement is that compensation, if any, would come from the buffer economics of Pulsar and whatever recovered value remains from the affected trading/custody stack. Not verifiable as of 2026-09-04.

Impact path through the smart contracts: user deposits mint bfUSD against BTC/USDT/USDC collateral, collateral is routed to Ceffu MirrorX for delta-neutral basis trading, and yield/loss is then allocated through the Horizon/Pulsar structure. If the counterparty becomes insolvent, the impairment would propagate from the custody/trading leg into the vault accounting and then into bfUSD redemption value and/or accrual mechanics. Callout: source conflict / verification gap

• DeFi Sentinel says BitFi is audited and names two SlowMist reports, while DIA says BitFi Basis has not published audit reports. That contradiction is unresolved here and affects confidence in any recovery/compensation claim.
• DeFiLlama reports BitFi Basis TVL and fees, but that is an aggregator view of locked value, not a guarantee of redeemability under insolvency stress.

For a committed fraud by the DAO or owners stress test, I found no verifiable evidence that BitFi Basis’s DAO, owners, or operators have been accused or found responsible for fraud in the sources reviewed. The only protocol-specific results are third-party risk/commentary pages that discuss custodial and market-structure risk, not proven fraud. What *is* verifiable is that BitFi Basis relies on a centralized custodian (Ceffu) for BTC deposits, so a malicious or conflicted custodian/owner scenario would mainly manifest as counterparty misappropriation, falsified reserve reporting, or wrongful withdrawal control, rather than a purely on-chain exploit.

Those pages also note that bfBTC and bfUSD share the same basis-trading backing, so a dishonest operator could potentially affect both products simultaneously. However, fraud by the DAO or owners is not verifiable as of 2026-09-03 from the available sources. The strongest independently sourced materials here are general regulatory and legal references showing that DAOs can be implicated in securities or fraud contexts in principle, but they do not link BitFi Basis to any specific fraudulent conduct. Stress-case implication: if owners or a DAO were found to have committed fraud, the likely outcomes would be loss of confidence, redemptions, peg dislocation, and possible insolvency or legal intervention.

But the triggering fact pattern itself—actual fraud by BitFi Basis insiders—remains Not verifiable as of 2026-09-03.

BitFi Basis’s primary yield source is basis/funding-rate arbitrage on BTC perpetual markets, so a 30-day negative yield stress means that source can fall to zero or below when funding stays negative. The protocol’s own materials and independent risk analyses both say funding spreads may turn negative and reduce returns, and that prolonged negative funding can erode yield or create losses. For a 30-day negative scenario, the most direct impact is that bfBTC yield compresses sharply because the strategy is paying funding instead of receiving it; if the negative regime persists, the protocol may need to unwind hedge positions to meet redemptions, which can realize losses.

In this stress case, the key risk is not just lower APY but potential principal impairment for remaining holders if forced unwinds occur under stressed market conditions. A practical reading for risk purposes is:

• Primary yield source negative 30d: yield likely ~0 or negative rather than positive carry.
• Secondary effect: redemption pressure may rise if users expect BTC-denominated yield and see it disappear.
• Tail risk: if exits accelerate, the protocol could be forced to close basis positions at unfavorable prices, worsening losses. I cannot verify on-chain balances, current exposures, or chain-by-chain TVL splits for Binance, Ethereum, Base, Pharos, Hemi, Bitlayer, and CORE in this run because on-chain tooling is unavailable here. Not verifiable as of 2026-09-03.

As of September 13, 2026, BitFi Basis does not demonstrate an autonomous, execution-capable DAO. BitFi’s current FAQ says only staked BFI/sBFI is “expected” to participate and describes possible governance scope, but provides no verified proposal portal, quorum, voting duration, execution module, timelock, or binding upgrade path. This is an unverified marketing claim; DAO governance is therefore assessed as false.

Top-holder concentration, voting power, and live owner/multisig state: Not verifiable as of September 13, 2026 (Dune unavailable). Contract control: the SlowMist bfUSD audit (dated December 1, 2025; stale relative to this review) documents UUPS upgrades and broad onlyOwner powers over minters, mint limits, redeemers, custody wallets, fee receivers, blacklists, staking pools, cross-chain fees, settlement delays, deposit caps, and pausing. It recommends transferring ownership to multisigs and separating community-controlled fund powers, indicating the audited design was team/admin-controlled rather than DAO-controlled.

Whether these permissions remain on every live deployment is Not verifiable as of September 13, 2026. Because direct live fund-drain authority and current owner implementation cannot be confirmed, admin_can_drain is left null rather than inferred. Frontend/development: operational presentation is BitFi-branded and company/team controlled in practice; no independent frontend governance or administrator disclosure was located.

Funds: custody and redemption-related parameters are admin-configurable in the audited design; current signers, threshold, independence, and treasury control are Not verifiable as of September 13, 2026. Company linkage: Companies House records BITFI LIMITED, company no. 11423300, incorporated in England on June 19, 2018 but dissolved November 26, 2019.

Its listed officers were Daniel Khesin and BitFi Inc.; BitFi Inc. is recorded as a North Carolina corporation. This establishes historical corporate linkage, not the current operating entity. Current Terms of Service, jurisdiction, registration, and directors for the active protocol entity: Not verifiable as of September 13, 2026. Contradiction/finding: BFI is advertised as supporting decentralized governance, while the documented contract architecture retains extensive owner powers and no verified binding DAO execution framework.

As of September 4, 2026, BitFi Basis is presented as the bfUSD/basis-trading product of the broader BitFi CeDeFi platform, combining smart contracts with centralized yield strategies and custody. Its legal classification is therefore not simply “decentralized finance”: the structure creates potential investment-contract/securities, stablecoin, money-transmission, custody, derivatives, and investment-management exposure depending on the applicable jurisdiction. This is risk analysis, not a legal determination.

Entity/jurisdiction: The reviewed official materials identify “BitFi” and contact emails, but do not disclose a legal entity name, incorporation number, registered office, governing law, or regulator/license. LinkedIn describes a New York headquarters, but that is not proof of the operating entity or domicile. Not verifiable as of September 4, 2026. ToS/restrictions/KYC-AML: No general protocol Terms of Service or privacy policy was located in the reviewed official materials. The 2026 BFI public sale requires KYC/KYB, identity/residency and eligibility checks, sanctions screening, and wallet-risk screening through Sonar.

The sale excludes the United States, United Kingdom, China and numerous sanctioned/high-risk jurisdictions. These controls are expressly documented for the public sale; they do not establish that all bfUSD/bfBTC users or underlying counterparties are subject to equivalent AML controls. Classification/warnings: BitFi describes bfUSD as a fully collateralized yield-bearing stablecoin and advertises pooled yield strategies.

Its disclosures acknowledge smart-contract, counterparty, operational, regulatory, liquidity and total-loss risks. “Institutional-grade,” “audited,” and custody claims are protocol statements, not evidence of licensing or depositor protection. Enforcement/cases/sanctions/data protection: No regulator enforcement action, court case, sanctions designation, or protocol-specific data-protection notice was identified in the searches performed. Not verifiable as of September 4, 2026. The key practical risk is opacity: unidentified legal operator and unclear recourse, combined with centralized custody/strategy/counterparty dependence despite a DeFi interface.

No exact GLEIF LEI record for 'BitFi Basis'. OFAC SDN screening of 'BitFi Basis': no match. SEC litigation and administrative release feeds: no mention.

BitFi Basis issues its own stablecoin, bfUSD, so own_stablecoin = true. A historical depeg is not verifiable as of 2026-09-05 from the available sources; the docs and independent reports describe bfUSD as USD-pegged/collateralized and the web evidence reviewed does not confirm any depeg event, so stable = null, depeg_count = null, max_depeg_pct = null, last_depeg_date = null. stablecoin_ids = ["bfUSD"].

BitFi Basis combines upgradeable smart contracts, cross-chain bfUSD transfers, centralized custody, and yield strategies, creating correlated technical, operational, and counterparty exposures. The latest public SlowMist review identified two medium-severity issues and one acknowledged design-logic issue; remediation was not independently verified. On-chain balances, contract ownership, reserves, and remediation status are Not verifiable as of September 5, 2026 because Dune checks were unavailable.

BitFi Basis’s top strengths are: 1) CeDeFi hybrid design, combining centralized execution/custody with DeFi access to target yield opportunities; 2) BTC-focused yield product, with bfBTC and related BTC yield positioning that addresses a large, native Bitcoin holder use case; 3) Multi-chain deployment, with the protocol presented across several chains rather than a single-chain footprint; 4) Institutional-style infrastructure and custody, including references to Ceffu/MirrorX and risk-management language that suggests a more operationally mature setup; and 5) Product breadth and traction, including bfUSD plus reported AUM/user counts that indicate the protocol is not just a single-strategy vault. These strengths are supported primarily by the project’s documentation and by third-party protocol profiles that describe BitFi Basis as a CeDeFi basis-trading platform with multi-chain presence and meaningful TVL.