A guy I trade with kept talking about the bitcoin he was holding on Ethereum, and it took a slightly awkward conversation to establish that no bitcoin of his had ever touched Ethereum. What he held was WBTC, a token that represents a claim on bitcoin sitting with a custodian. He is probably fine, WBTC has worked for years, but he could not tell me who the custodian was, whether he personally could redeem the token, or what would happen to its price if either answer changed. That is the default state of knowledge for most wrapped-token holders, and it bugs me, because nearly all of the risk in a wrapped asset lives inside those two questions.
The mental model I use is a coat check. You hand something valuable to someone, they hand you a ticket, and the ticket trades at the value of the coat only for as long as everyone believes the window is open and the coat is still on the rack. Every wrapped token is a ticket. The differences that matter are who runs the rack and what it takes to hand the ticket back.
Trustless wrapping and custodial wrapping are different products
WETH is the clean case. ETH itself predates the ERC-20 token standard, so a lot of DeFi contracts cannot handle it directly, and the fix was a simple contract. Send ETH in, get WETH out, one for one, and unwrap whenever you like. Nobody operates it. There is no company, no admin key, no redemption desk. The contract's ETH balance backs the WETH supply by construction, and anyone with a block explorer can confirm that in about thirty seconds. Your risk is essentially the risk of a bug in a very small, very old, very heavily used piece of code, which is not zero but is about as close to zero as this industry gets.
WBTC is the other kind. Bitcoin lives on its own chain, and no Ethereum contract can hold actual BTC, so a person has to. In the WBTC model a custodian holds the bitcoin keys, and a set of approved merchants handle minting and redeeming. A merchant sends BTC to the custodian and mints fresh WBTC, or burns WBTC and gets BTC back. The custody addresses are published, so anyone can compare bitcoin held against WBTC supply, which is honestly better transparency than most of traditional finance offers. But look at what you are actually trusting there. The custodian's keys, the custodian's jurisdiction, and a merchant layer you are probably not part of.
That last part is the piece most holders miss. If you bought WBTC on an exchange or a DEX, you almost certainly cannot redeem it yourself. Redemption runs through merchants with onboarding and KYC. Your practical exit is selling into the market, which works beautifully right up until the moment everyone wants the same exit at the same time.
Bridged assets are custodial wrapping with more moving parts
Most bridged tokens follow the same lock-and-mint pattern. Tokens get locked in a contract on the origin chain, and a wrapped version gets minted on the destination chain. The bridge contract is the custodian, and whoever controls that contract, a multisig, a validator set, sometimes a disturbingly small group of people, controls the backing. The useful distinction is canonical versus third party. A canonical bridge is run by the destination chain's own team and usually inherits that chain's security assumptions. A third-party bridge is an independent operator, and its wrapped tokens are claims on that operator specifically.
Bridge failures are where wrapped-token risk stops being theoretical. One of the biggest bridge hacks in the industry's history worked by tricking a bridge into minting wrapped ETH on another chain with nothing behind it, and the peg only survived because the firm backing the bridge replaced the missing funds out of its own pocket. When a large multichain bridge operator went dark a while back, the wrapped assets it had issued across several chains traded at deep discounts almost immediately, because there was no longer any redemption path at all. Holders were left with tickets to a coat check that no longer had staff.
There is a subtler version of this too. The same asset often exists on one chain in several wrapped forms, issued by different bridges with different backing. Two tokens with identical names sitting in your wallet can carry completely different risk, and the interface will not warn you.
What a depeg actually looks like
While redemption works, arbitrage does the pegging. If the wrapper trades below the underlying, someone buys the cheap wrapper, redeems it, sells the underlying, and pockets the gap. That loop needs participants who can actually redeem, at real size, quickly. So when you see a wrapped asset trading at a persistent discount, you are looking at the market's live estimate of the probability that redemption is impaired. A few basis points of chronic discount usually means friction or mild doubt. Several percent means the market suspects the window is closing. Tens of percent means the market has concluded the coat is gone.
The renBTC episode is the one I point people to. The protocol behind it depended on a company that failed, holders were told to bridge back to native bitcoin while they still could, and the token slid to a discount well before anything formally shut down. What stuck with me was the speed of it. Wrapper discounts tend to gap rather than drift, because every holder runs the same exit logic at the same moment, and the marginal buyer of a doubted receipt disappears fast.
The pain also reaches past the exit price. If you posted a wrapped asset as collateral in a lending market, a depeg can liquidate you even while the underlying asset is completely unharmed. Some protocols hard-code the wrapper's oracle price to the underlying instead, which hides the risk on the way in and quietly moves it onto the protocol's own solvency. Either way someone ends up carrying it, and it is usually whoever examined it least.
The check I run before holding size
None of this takes long, maybe twenty minutes for an asset you plan to hold in size, and most of it only needs doing once, plus a re-check whenever the custody arrangement changes hands.
- Name the redeemer. Work out exactly who can convert the wrapper back into the underlying, and whether that group includes you. If redemption requires merchant onboarding or KYC you do not have, your only real exit is the market.
- Verify the reserves yourself. Find the published custody addresses or the locking contract and compare the balance against the wrapped supply. Do it once by hand rather than trusting a dashboard screenshot someone posted.
- Read the mint permissions. Who can mint, is the contract upgradeable, and how many signers does the controlling multisig actually need. A wrapper is only as sound as the smallest group of people who can inflate it.
- Classify what you are holding. Trustless contract like WETH, single custodian like WBTC, or bridge operator. As a rough rule the risk rises in that order, with third-party bridges at the top.
- Pull the price history against the underlying. A wrapper that has traded flat through past stress has told you something useful. One that already sits at a small persistent discount has told you something too.
- Plan the exit before you enter. Know which pool you would sell into, what the depth looks like, and how much of your position it would absorb without moving the price against you.
My own rule of thumb is boring. Native asset for anything I intend to hold for a long time, wrappers as working capital that goes in, does its job, and comes back out. And when the custodian behind a wrapper changes, or a bridge announces new management, I treat that as an event worth re-running the whole checklist for, even if the peg has not moved a single basis point yet. The ticket is only ever as good as the person holding the coat.