In this paper, our main goal is to design a solution that adds expressive smart contract execution support as a subsystem to existing legacy blockchain systems. The primary usage of our solution is to enhance systems like Bitcoin that have no built-in smart contract capabilities. The secondary usage is to extend the contract execution capabilities of platforms like Ethereum that support contracts but have severe limitations on the complexity of allowed computations. Previous work. Recent research has explored different ways to add contract execution capabilities to blockchains. For instance, Arbitrum [25] and ACE [50] use off-chain execution models, where contract issuers appoint a set of managers who are responsible for executing the contract and communicating the results back to the chain. Hyperledger Fabric [5] uses a similar model in a permissioned setting with an execute-order-validate architecture in which transactions are executed before ordering. The main drawback of such solutions is that they are newly purpose-built systems, and therefore such systems cannot be deployed on legacy systems without modifying the underlying blockchain. Another proposal, FastKitten [16], relies on enclaved execution and collaterals, but only supports short-lived contracts that are restricted to known participants. In addition, such a system cannot tolerate enclave compromise. Recently discovered attacks [11], [45], [29], [13], [44] have shown that TEE compromise is a relevant threat. We discuss the limitations of previous solutions in more detail in Section II-B. Our solution. In this paper, we propose a novel system called Bitcontracts that adds expressive smart contract execution capabilities to legacy cryptocurrencies without requiring protocol changes to the legacy system, and overcomes the main limitations of previous solutions.