Code does not lie, but it often omits the context.
On May 12, 2025, Jack Mallers stepped down as CEO of Twenty One Capital, the Tether-backed Bitcoin treasury firm he co-founded. Simultaneously, the planned merger between Twenty One Capital and his payment startup Strike was officially abandoned. The official narrative: Mallers intends to go all-in on Strike. The underlying context: The merger would have created a vertically integrated Bitcoin financial powerhouse—treasury management on one side, retail payments on the other. But vertical integration in crypto rarely delivers the promised synergies. Instead, it layers complexity on top of fragile protocols. Stripping it away is a rational engineering decision, even if it sounds like a retreat.
Context: The Two Sides of the Same Bitcoin
Twenty One Capital operates at the institutional layer: it manages Bitcoin treasuries, provides collateralized loans, and structures derivatives—all supported by Tether’s liquidity. Strike, founded in 2019, operates at the retail layer: it enables zero-fee Bitcoin payments leveraging the Lightning Network, and recently expanded into cross-border remittances. The original merger plan, announced in late 2024, was supposed to create a single entity that could offer end-to-end Bitcoin financial services: treasury → payment → settlement. But the technical reality is messier.
The integration would require bridging two fundamentally different trust models. Twenty One Capital’s treasury operations likely rely on multi-sig custody, cold wallets, and institutional-grade verification—slow, manual, and risk-averse. Strike’s Lightning hot wallets, by contrast, require constant uptime, rapid channel rebalancing, and automated failure handling. Merging these into a single stack introduces attack surfaces at every interface: the hot wallet’s private keys could be exposed through treasury governance logic; the treasury’s settlement delays could drain Lightning liquidity pools. Code does not lie: these two systems are architecturally incompatible without a huge overhead in security proofs.
Core: The Hidden Technical Trade-off
Let me unpack the actual protocol-level friction that makes this merger a bad idea—and why Mallers’ decision is the correct one for both projects.
I spent two months in 2022 auditing cross-chain bridge code, and the pattern repeats here: when two systems with different security assumptions touch, the weakest link becomes the shared interface. Twenty One Capital’s treasury presumably uses a Bitcoin multisig wallet, say 3-of-5. Strike’s Lightning node uses a single-signer hot key. To merge them, you’d need a protocol that allows the treasury’s 3-of-5 to sign off on Lightning channel operations—introducing latency that kills the whole point of instant payments. Alternatively, you could give the Lightning node access to treasury funds, but that defeats institutional custody.
The obvious workaround is to keep them separate but coordinated via a smart contract or a federated bridge. But that adds enormous complexity: now you need a Bitcoin Layer 2 (like RSK or Stacks) or a sidechain, plus oracle infrastructure to relay events between the two systems. Each new component multiplies the audit surface. Based on my 2017 experience auditing ICO smart contracts, I can tell you that every unbridged interface is a ticking bomb—the 2017 DAO hack was exactly this kind of composition failure.
Mallers is making a pragmatic optimization: instead of forcing a brittle integration, let each protocol optimize independently. Strike can keep its Lightning channels fast and lean; Twenty One Capital can keep its multisig cold and boring. The synergy they hoped for—treasury users automatically becoming Strike payment users—was always a narrative, not a technical reality. The code never supported it.
Contrarian: The Blind Spot of Vertical Integration
Here’s the contrarian angle most people miss: the merger cancellation actually exposes a weakness in Strike’s Lightning implementation, not a strength. If Strike were truly mature, its hot wallet security could match institutional standards. It can’t—Lightning’s architecture inherently favors speed over custody. The decision to keep them separate is an admission that Lightning is not yet secure enough for institutional-grade treasuries.
This is the same pattern we saw in 2020 with DeFi lending protocols that promised "institutional-grade security" while relying on flash-loan-vulnerable oracles. The gap between institutional trust models and blockchain-native trust models remains wide. Mergers paper over this gap with marketing. Mallers, by ripping the bandaid off, is doing the industry a service: he is forcing us to confront the reality that Bitcoin Treasury infrastructure and Lightning payments are not ready to be unified until Lightning itself adopts multi-sig channel oracles or discreet log contracts that satisfy institutional audit requirements.
And what about the new CEO, Raphael Zagury? His background is unknown. That uncertainty is a risk. If he pushes Twenty One Capital into riskier products—think margin lending or yield-bearing Bitcoin deposits—Tether’s support could become a regulatory magnet. The SEC’s 2023 enforcement actions against BlockFi and Celsius show that treasury-like services crossing into "investment contract" territory invite trouble.
Takeaway: The Vulnerability Forecast
Mallers’ focus play buys Strike time, but it doesn’t solve the fundamental problem: Lightning needs a security upgrade before it can be trusted by institutional capital. Over the next 6 to 12 months, expect to see either a breakout protocol that bridges the gap (like Taproot Assets or RGB) or more failed mergers as the industry realizes vertical integration in Bitcoin payments is a myth. Meanwhile, keep an eye on Twenty One Capital’s new leadership: a pivot toward conservative treasury management strengthens the ecosystem; a pivot toward yield products creates a ticking time bomb.
The bear market reveals the skeleton. Here, the skeleton is a missing protocol layer that separates retail speed from institutional safety. Until that layer exists, vertical integration is just code that omits context.