Skip to content
PROTOCOL RESEARCH

Lombard risk

LBTC is Babylon-staked BTC held by a 14-member 2/3 consortium with HSM keys and an independent Bascule second-check layer; deeply and continuously audited with no direct incident, but custody trust plus upgradeable contracts behind a roughly one-hour timelock plus Babylon dependency plus youth keep it at caution.
CautionResearched Jul 4, 2026

Scorecard

watch: Audits & contractsHalborn, OpenZeppelin, Veridise, Sherlock (incl. a Bascule audit) and ABDK across many releases, plus Immunefi; but contracts are upgradeable proxies and the Nov 2024 OZ V2 audit logged 8 High findings (2 only partially resolved).
watch: Admin control2/3 of the 14-member consortium authorizes every mint, redeem, transfer, and contract upgrade on a CometBFT appchain; no single point, but it is a permissioned quorum over real BTC and the proxy-upgrade timelock is only about one hour.
strong: OracleNo lending-style liquidation oracle in the core; Chainlink + RedStone proof-of-reserves verifies BTC backing and Bascule confirms 6-confirmation deposits before mint.
watch: Liquidity & exitNative redemption takes up to ~10 days (Babylon 7-day unbond plus rebalancing); secondary-market LBTC can dislocate from BTC under stress.
watch: Yield (real vs emission)Underlying Babylon staking yield is real but thin; a large share of historical draw was points and BARD emissions (BARD TGE Sep 2025).
watch: Holder concentration~70% of the yield-bearing BTC market by Lombard's own figure; supply spread across 70+ protocols and 10+ chains, but per-wallet whale concentration is _refresh_.
watch: Track recordNo direct LBTC exploit or depeg to date, but young (LBTC mid-2024, BARD Sep 2025) and moved $1B+ of bridging off LayerZero to Chainlink CCIP in May 2026 after the April 2026 Kelp LayerZero exploit.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$592.4M
30d±0%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

LBTC is a liquid receipt for BTC staked through Babylon. The crux is custody: your Bitcoin sits in addresses controlled by a 14-member Security Consortium (OKX, Galaxy, DCG, Wintermute, Kraken, Figment, Kiln, Antpool, F2Pool and others), and it takes 2/3 signatures to move anything. Keys live in Cubist CubeSigner HSMs, and an independent layer (Bascule) re-checks every mint and redeem, so an attacker would have to break both the consortium and Bascule at once. Multiple top firms audited the code across many releases. There has been no direct LBTC exploit and no depeg. What keeps this at caution rather than solid: this is a custody-trust model, not trustless cryptography, the token contracts are upgradeable with only a roughly one-hour timelock, LBTC inherits Babylon slashing, and the protocol is young.

Checklist

Audits & contracts. Audited across many releases by Halborn, OpenZeppelin, Veridise, and Sherlock (plus ABDK on the StakeAndBake pieces), with an Immunefi bug bounty on top. That is an unusually deep and ongoing roster, including a dedicated Sherlock audit of the Bascule GMP layer (Dec 2025). Two caveats keep it yellow: the LBTC and consortium contracts are upgradeable proxies (not immutable like Pendle's AMM core), and the OpenZeppelin V2 audit (Nov 4 to Dec 6 2024) reported 8 High-severity findings, 6 resolved and 2 only partially resolved. Read that as a live, evolving codebase, not a frozen one.

Admin control. This is the dimension that defines the verdict. Every mint, redemption, cross-chain transfer, and contract upgrade requires signatures from two-thirds of the 14 consortium members, coordinated on a Cosmos-based CometBFT appchain (the Lombard Ledger). No single party can move funds, and more than one-third of members would have to be compromised to break safety. That is a serious bar. But it is still a permissioned quorum holding real BTC, and the proxy-upgrade timelock is only about one hour (confirmed on Etherscan), which gives users no practical window to exit ahead of a malicious or coerced upgrade. Distributed trust, not no trust.

Freeze / seizure. No named party can freeze or blacklist an individual LBTC balance: the deployed token on Ethereum, Base and BNB has no blacklist, denylist or per-address transfer gate, and the only holder-facing switch is a global ERC-20 pause (pauseTransfers, PAUSER_ROLE) that halts everyone at once, leaves balances untouched, and is currently inactive; the one address-specific power is burn(address,uint256), restricted to MINTER_ROLE - held today only by two Lombard protocol contracts, neither of which exposes an arbitrary-holder path - so pointing it at a user would first require the consortium-controlled 24-hour timelock (0x055E84e7…E77e59) to grant MINTER_ROLE to a new address, and the 14-member Security Consortium itself only verifies mint and redeem proofs, with no power over tokens already held.

Oracle. There is no lending-style price oracle in the core mint/redeem path, so the classic oracle-manipulation liquidation risk does not apply here. Lombard runs a Chainlink plus RedStone proof-of-reserves feed that verifies the BTC backing on-chain, and Bascule independently confirms each Bitcoin deposit has 6 confirmations before a mint is authorized. That supports the peg rather than gating liquidations. Green.

Liquidity & exit. Two exits, two speeds. Native redemption returns real BTC but takes up to roughly 10 days (Babylon's 7-day unbonding plus rebalancing). The fast exit is selling LBTC on secondary markets, where the price can drift below redemption value during stress or thin liquidity. LBTC has held its peg since launch per Lombard, but the exit is not instant-at-par, so size and timing matter.

Yield: real vs emission. The base yield is genuine Babylon staking yield, which is real but currently thin. Much of what drew capital historically was points and then BARD token emissions (BARD launched Sep 18 2025, 1B supply, 22.5% unlocked at TGE, roughly four-year vest with a one-year cliff for investors and contributors). Treat the headline APR as part real BTC yield, part incentives, and check the current split at refresh.

Holder concentration. Lombard is the dominant BTC LST, around 70% of the yield-bearing BTC market by Lombard's own figure, so the protocol itself is concentrated within its niche. On the token side, a large share of LBTC supply is deployed across 70-plus DeFi protocols and 10-plus chains, which spreads it rather than parking it in a few wallets. Per-wallet whale concentration and BARD unlock cliffs are refresh.

Track record. No direct LBTC exploit and no depeg event since launch. The February 2025 Ionic incident was a fake-LBTC impersonation and social-engineering attack on a third-party lending market (roughly $8.6M lost by Ionic), not a Lombard exploit. In May 2026 Lombard migrated over $1B of bridging from LayerZero to Chainlink CCIP and is fully deprecating LayerZero. That move followed the April 2026 KelpDAO rsETH exploit (about $292M) on LayerZero-based infrastructure, so it was industry-driven de-risking rather than a response to a Lombard-specific hack, but it underlines that cross-chain surface is a live risk area. The honest read is a clean but short history: LBTC dates to mid-2024, the token to Sep 2025.

Worst case

A coordinated compromise of 10 of the 14 consortium members (or the systems signing for them) could authorize moving the underlying BTC, and Bascule is the backstop that would also have to fail for that to reach users. Short of that, a malicious contract upgrade could be pushed with only a roughly one-hour timelock, faster than most holders could react. A softer bad day: a Babylon slashing event or a stress-driven secondary-market discount leaves you unable to exit at par for up to 10 days. There is no insurance fund covering a custody or upgrade failure, so position sizing is the mitigation.

Bottom line

Caution. This is one of the better-engineered BTC LSTs: distributed HSM-backed custody, an independent verification layer, a deep and ongoing audit program, and no incident. But it is still a custody-trust model over real Bitcoin, the contracts are upgradeable behind a token-thin timelock, LBTC carries Babylon slashing and a multi-day native exit, and the whole stack is young. Usable with sizing discipline; not a set-and-forget.

Data appendix

  • TVL: ~$769M (DeFiLlama, "lombard", 2026-07-04, verified). 90d / ATH: refresh. Note third-party sources cite higher figures in "Bitcoin backed" across all chains; the DeFiLlama protocol figure is the reference here.
  • Custody / admin: 14-member Security Consortium on the Lombard Ledger (Cosmos/CometBFT BFT appchain); 2/3 signatures required for every mint, redeem, transfer, and upgrade; keys in Cubist CubeSigner HSMs; Bascule Drawbridge independent second-check (6-confirmation deposit verification, Reverse Bascule on withdrawals). Source: Lombard docs (lombard-ledger-consortium). Some secondary sources cite 15 members; docs say 14.
  • Contract upgradeability: upgradeable proxy pattern, two-step upgrades, ~1-hour proxy-upgrade timelock; upgrade authority gated by consortium consensus. Source: Lombard docs + Etherscan (Proxy Upgrade Timelock, 0x055E84e7...E77e59).
  • Audits: Halborn (V1 Aug 2024, V1.5 Oct 2024, V2 Dec 2024), OpenZeppelin (V2 Nov 4 to Dec 6 2024: 0 Critical, 8 High with 2 partially resolved, 5 Medium, 13 Low; plus Yield-Bearing Jul 2025, BTC.b/BridgeV2 Oct 2025, later 2026 reviews), Veridise (V1 Aug 2024, V2 Dec 2024, Strategies 2026), Sherlock (Yield-Bearing Jul 2025, GMP/Bascule Dec 2025), ABDK (StakeAndBake); Immunefi bug bounty. Source: lombard-finance/evm-smart-contracts/docs/audit, openzeppelin.com/news/lombard-audit. (Cantina appears in one secondary source but not in the primary audit repo.)
  • Oracle: Chainlink + RedStone proof-of-reserves for BTC backing; no core liquidation oracle. Source: Lombard PoR page, Chainlink PoR announcement.
  • Babylon slashing: stated exposure ~0.1% of staked BTC, delegations spread across four finality providers (Figment, Galaxy, Kiln, P2P). Source: Lombard docs, Kiln staking page.
  • Redemption: native redeem up to ~10 days (Babylon 7-day unbond + rebalancing); secondary-market exit immediate but price can dislocate. Source: Lombard redeem docs.
  • Token: BARD, launched Sep 18 2025, 1B supply, 22.5% at TGE, ~4-year vest (investors/contributors one-year cliff then linear); governs fees, validator/consortium set, grants. Source: Lombard BARD tokenomics blog, tokenomist.ai.
  • Holder concentration: ~70% yield-bearing BTC market share (Lombard self-reported); LBTC supply spread across 70+ protocols and 10+ chains; per-wallet whale distribution: refresh.
  • Recent news scan (2026-07-04): no LBTC exploit or depeg found; Feb 2025 Ionic loss (~$8.6M) was a fake-LBTC impersonation on Ionic, not Lombard; May 2026 bridge migration LayerZero -> Chainlink CCIP followed the April 2026 KelpDAO rsETH exploit (industry-driven, not a Lombard hack). Source: halborn.com/blog (Ionic), cryptobriefing, Lombard docs. Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols