The disclosure came in a technical post authored by Torben Poguntke, Pogun's CTO, published on the IOG blog on May 20, 2026. The timing is pointed: Cardano's governance delegates, approximately 1,000 elected representatives, have until May 24 to vote on IOG's 2026 treasury proposals, which include a ₳12.29 million (approximately $2.95 million) milestone-gated funding request for Pogun, with explicit refund provisions attached to each milestone.

IOG has asked for $46.8 million in total this year, roughly half of its 2025 ask of $97.5 million.

---

The Core Engineering Problem With BitVM3

BitVM3, published earlier this year, represented the latest iteration of the BitVM family of protocols that allow arbitrary computation to be verified on Bitcoin without requiring a protocol change. BitVM3 replaced zero-knowledge proof verification with garbled circuits, which reduced on-chain transaction costs significantly. One implementation brought individual challenge transaction fees to approximately $0.20, within a broader estimated on-chain cost of roughly $9 per challenge transaction.

A separate issue emerged on the research side: a security break was discovered in the BitVM3-RSA variant, leading to the retraction of that paper. Both the engineering constraints and the cryptographic vulnerability contributed to the case for abandoning the design.

The off-chain costs proved prohibitive in their own right. Under honest conditions, each garbled circuit instance requires roughly 40 GiB of storage per operator. Under adversarial conditions, that figure scales into the terabytes. Setup takes approximately 354 seconds and requires transmitting all setup material from the prover to every verifier for each new protocol instance.

Poguntke did not reach these conclusions from the sidelines. Pogun's team built Cardinal, IOG's open-source Bitcoin bridge specification on BitVMX, and ran a live cross-chain transfer at the Bitcoin 2025 conference in Las Vegas, wrapping a Bitcoin Ordinal onto Cardano in front of a public audience. IOG's own CTO, Roman Pellerin, described the outcome after the demonstration: "The protocol works but...we don't consider it production-ready yet. Some improvements are incoming."

That production experience became the basis for the pivot. "A 22 MiB requirement per operator is reachable for a wide range of participants, including SPOs," Poguntke wrote in the new post, referring to Cardano's approximately 3,000 stake pool operators. "A 40 GiB-into-terabytes requirement is not."

---

What BABE Actually Does

BABE, a witness encryption-based bridge, was published in January 2026 by researchers at UC Berkeley, Stanford, Babylon Labs, and Byzantine Research. The protocol builds on two academic foundations: "A Framework for Witness Encryption from Linearly Verifiable SNARKs" (CRYPTO 2025, Sanjam Garg et al., UC Berkeley) and Bitcoin PIPEs v2 (eprint.iacr.org/2026/186). Where garbled circuits require the prover to encrypt and transmit an entire SNARK verifier to each participant, witness encryption locks a private key directly under an NP statement (for example, a SNARK proof) on Bitcoin.

No large-scale data transmission is required. Storage per operator drops to 22 MiB, and setup time falls from 354 seconds to under 175 milliseconds.

The security model is structured so that a single honest verifier in the operator set is sufficient to block a fraudulent withdrawal claim. The Pogun architectural specification, as summarized in the IOG article, states: "A single honest Verifier suffices to block a fraudulent claim."

That 1-of-N guarantee matters in practice. It means that even if a majority of bridge operators were compromised or colluding, one independent participant could still protect user funds.

To confirm Cardano's chain state on the Bitcoin side without requiring a full node, Pogun relies on Mithril, Cardano's stake-based certificate protocol. The design uses recursive Halo2 proofs over the Mithril certificate chain, then wraps the result in Groth16, a proof format that Bitcoin scripts can already verify. IOG shipped a Halo2 verifier for Cardano's Plutus smart contract layer in August 2025.

---

A Critical Dependency and Its Deadline

Pogun's credit market is targeting a Q2 2026 launch, a window that closes June 30, roughly six weeks from the date of this article. That milestone runs concurrent with a separate technical dependency: the Mithril team is targeting completion of the recursive Halo2 circuit work by the end of June 2026, according to Cardano development updates. That circuit work is a direct prerequisite for the bridge, which is currently scheduled for deployment in Q4 2026. If the Mithril work slips, the bridge timeline slips with it.

Poguntke's post acknowledges the layered complexity: "The depth of the stack is what makes the trust model work. It is also what makes production reliability a fair thing to ask about."

---

Regional Stakes: Who Gets to Run a Node

The hardware threshold question has concrete geographic consequences. Bitcoin DeFi TVL across all chains sits at roughly $7 billion as of May 2026, down from a peak of $9.1 billion in October 2025. Cardano's total DeFi TVL was approximately $132 million as of early April 2026.

The gap reflects multiple factors, including Cardano's overall DeFi ecosystem size relative to dominant chains and the absence of a production-ready Bitcoin bridge on the network, among others.

For operators and users in Sub-Saharan Africa and South Asia, the operator storage gap between BitVM3 and BABE is not a minor technical footnote. Bitcoin accounts for 89% of retail transaction value in Nigeria and 74% in South Africa, according to Chainalysis data. Sub-Saharan Africa recorded 52% year-over-year on-chain value growth, placing it third globally behind the Asia-Pacific region and Latin America.

South Asia processed roughly $300 billion in crypto transaction volume in the twelve months through July 2025, making it the fastest-growing crypto adoption region globally over that period, with 80% year-over-year growth.

In both regions, BTC is widely held but effectively idle in DeFi terms. Dominant bridging options such as wBTC, custodied by BitGo, introduce intermediary trust, while earlier non-custodial bridge attempts either did not ship or preserved trust assumptions that negated the core value proposition. A 22 MiB storage requirement is reachable for an SPO running modest hardware in Nairobi or Lahore. A 40 GiB floor, before accounting for adversarial scenarios, is not.

Poguntke flagged the production engineering gaps in BitVM3 directly: "Network throughput, retry logic, partial failures, and version handling. None of that is addressed in the paper. None of it is optional in production."

---

What Comes Next

The immediate milestone is the governance vote on May 24. If the ₳12.29 million proposal passes, Pogun's development timeline calls for a credit market launch by the end of Q2 2026 and bridge deployment by Q4. The Mithril recursive Halo2 work, due at the end of June, is the most visible technical dependency between now and that bridge date.

The 1-of-N security guarantee at the core of BABE carries particular weight in markets like Nigeria and Pakistan, where institutional trust in financial intermediaries is low. A bridge architecture that requires only a single honest participant to protect user funds is not just a technical property; it is a meaningful structural commitment to users who cannot rely on regulatory backstops or custodial recourse. Whether the academic promise of BABE survives the transition to a production Bitcoin bridge will depend on whether those intermediate milestones hold.