Trust-minimized Bitcoin DeFi is one of the harder engineering problems in crypto. Most attempts have not shipped, and the ones that have rely on trust assumptions that defeat the purpose. Pogun's approach is layered. Witness encryption verified on Bitcoin, recursive Halo2 proofs over Mithril for Cardano state attestation, an N-party operator transaction graph. The depth of the stack is what makes the trust model work. It is also what makes production reliability a fair thing to ask about.
The team has already built into this problem
Pogun's technical team built Cardinal, Input Output (IO)'s open-source Bitcoin bridge specification, on BitVMX. Cardinal demonstrated the core mechanism live on the Bitcoin mainnet at Bitcoin 2025. That experience surfaced where the BitVM family's production constraints sit and where each iteration can and cannot carry weight at scale.
When BitVM3 was published, the cost picture sharpened on-chain but ran into a wall off-chain. A single BitVM3 garbled circuit runs to around 40 GiB per instance under honest-setup assumptions. Defending against a dishonest setup means generating many copies and proving they were all built honestly, which pushes the per-instance cost into terabytes. The setup material has to move too. Garbled circuits transmitted from the prover to every verifier at setup, a fresh setup for every protocol instance. Network throughput, retry logic, partial failures, and version handling. None of that is addressed in the paper. None of it is optional in production.
These are the constraints the team identified through direct work on Cardinal. The transition to a custom BABE-based implementation followed from that.
What BABE makes possible
BABE was published in January 2026 by a research team across UC Berkeley, Stanford, Babylon Labs, and Byzantine Research. It uses witness encryption as the verification primitive rather than garbling the entire SNARK verifier. The on-chain side stays close to BitVM3. The off-chain side drops by roughly three orders of magnitude.
Setup time drops from around 354 seconds to under 175 milliseconds. A 22 MiB requirement per operator is reachable for a wide range of participants, including SPOs. A 40 GiB-into-terabytes requirement is not.
What Pogun's implementation adds
The BABE paper presents a 2-party protocol. Production bridges are not 2-party. Pogun extends the paper to an N-party transaction graph: one Prover, N−1 Verifiers per bridge instance, with security reducing to a single honest Verifier suffices to block a fraudulent claim. The cryptography underneath each Prover-Verifier pair is the paper's. The graph that ties them together is the engineering work on top.
The paper does not address operator churn, which any production system absorbs by necessity. Pogun's design adds an operator rotation mechanism that lets the operator set evolve over time without resetting the trust assumption on existing bridge instances and without interrupting flows in progress. This is the difference between a protocol that works in a paper and a protocol that runs across operational years.
Engineering optimizations and correctness fixes surfaced during implementation have been contributed back to the protocol formalization.
The Mithril foundation
Pogun's state attestation depends on recursive Halo2 proofs over the Mithril certificate chain, wrapped in Groth16 for verification on Bitcoin. The recursive Halo2 work is being completed by the Mithril team on a timeline targeting end of June. Pogun has tracked that work over the past year through direct collaboration. A fallback path is in place if the timeline slips, so the bridge schedule does not collapse on a single upstream dependency.
Mithril is the cryptographic source of truth for the Cardano state. External systems use it to reason about what happened on Cardano without running a full node. For interoperability, it plays the role the beacon chain plays for Ethereum. Mithril node coverage and operator participation matter not just for Pogun but for any system that bridges Cardano to anywhere else. Pogun is working with the Mithril team on the economics of running Mithril nodes so that participation grows alongside the protocols that depend on it.
People and current state
The Advisory Board includes Robin Linus, the creator of BitVM. Fallen Icarus (Rusty Shapiro), whose work on non-margin lending mechanics on Cardano shaped the credit market's design, contributes the economic foundations. The Product Committee includes Pi Lanningham (CTO, Sundae Labs), Philip DiSarro (CEO, Anastasia Labs), Lucas Do N. Rosa (creator of Aiken), and Santiago Carmuega (CEO, TxPipe).
The credit market completed a pre-audit by TxPipe in April 2026 and is in formal security audit, with completion expected at the end of May. Credit market launches Q2 2026.
What the milestone structure protects
The full treasury request is ₳12.29M ($2.95M USD), released across four tranches gated by independently verified milestones. The structure is designed to absorb the uncertainty the proposal carries.
Bridge funding and credit market funding are explicitly separable. Phase 1 (Q2 2026) funds the credit market, which is in audit now. Bridge funding is released in later tranches and only after the credit market has demonstrated live performance and milestone verification has passed.
The proposal contains explicit refund provisions:
- Milestone failure. If a defined deliverable is not met within 90 days of the phase deadline and no remediation plan is agreed with the administrator, the remaining undisbursed funds are returned.
- Team dissolution. If the core team cannot continue development, undisbursed funds are returned within 30 days.
- Fundamental technical infeasibility. If the BitVM implementation is determined to be infeasible by an independent technical review commissioned by the administrator, undisbursed bridge-specific funds are returned. Credit market and yield funds already spent on delivered work are not subject to refund.
The Treasury is not making a binary all-or-nothing bet. The downside is bound by the structure of the disbursement itself.
The competitive context
Teams on Ethereum, Solana, Starknet, and Bitcoin L2s are building Bitcoin DeFi infrastructure now. Liquidity and developer attention consolidate quickly in this category. Waiting does not make the technology simpler or less risky. It does make it more likely that the category is defined elsewhere.
The credit market launches Q2 2026 with the audit complete. The bridge follows in later phases under milestone-gated funding with explicit infeasibility clauses. Read the full Pogun treasury proposal.
