Introducing the CANS protocol: unlocking Bitcoin liquidity for Cardano DeFi. Edmund Judge July 07 2026 How Input Output's cyclic atomic swap protocol enables trustless cross-chain exchanges - no bridges, no custodians, no compromise * New protocol: CANS (Cyclic Atomic N-party Swap) lets multiple parties swap assets across different blockchains at once - with a mathematical guarantee that either everyone gets what they agreed to, or nobody loses anything * Decentralized: the CANS protocol does not require bridges, wrapped tokens, or trusted intermediaries - the cryptography enforces the rules * Locked liquidity: Bitcoin holds approximately $1 trillion in market capitalization, yet its limited scripting keeps that liquidity locked away from DeFi users * Adaptable: the pattern is not limited to Bitcoin and Cardano: any blockchain with native Schnorr signature support, or a smart contract layer capable of verifying Schnorr signatures, can participate in a CANS swap session * Proven: a reference implementation in Rust, formally verified and tested with up to 20 concurrent parties, proves this is achievable in practice today Bitcoin's liquidity problem. Bitcoin is the most valuable asset in cryptocurrency - but it isn't liquid. Its deliberately simple scripting language was never designed to support lending, trading, or the kind of complex financial interactions that have flourished on programmable blockchains like Cardano. Meanwhile, Cardano has a mature DeFi ecosystem: decentralized exchanges, lending protocols, liquid staking, oracles - with a fraction of Bitcoin's potential liquidity. Connecting these two worlds sounds straightforward. In practice, most solutions involve a compromise: a bridge that holds the Bitcoin assets while issuing a stand-in token, a custodian you have to trust, or a centralized exchange that introduces the very counterparty risk that blockchain was supposed to remove. These are not decentralized solutions - they are centralized solutions wearing a decentralized mask. What is CANS? The Cyclic Atomic N-party Swap protocol (CANS) is developed by Input Output under the Intersect IOR proposal. This is part of the work package WP4.1 Bridges, Atomic Swaps, & Agent Chains. This protocol takes a different approach by arranging participants in a ring: each person agrees to send assets to the next person in the chain, with the last person completing the loop back to the first. Each participant sends exactly once and receives exactly once. Crucially, the entire swap is atomic: either everyone gets what they agreed to, or nobody loses anything. There is no partial outcome, and there is no intermediary holding funds in the middle. Think of it like a coordinated round of gift exchanges, where everyone simultaneously hands over their gift - except the coordination is handled by mathematics, not trust. No one hands over their gift until they are certain everyone else will too. The protocol supports any combination of assets and blockchains within a single swap session. Two parties can exchange BTC for ADA. Ten parties can swap across multiple chains at once. The ring structure scales naturally. How does the CANS protocol work? The core innovation of the CANS protocol is that digital signatures can be made conditionally valid - locked behind a secret that only becomes visible once someone commits to the swap. CANS uses this property to choreograph the exchange. Before any funds move, every participant contributes a piece of a shared cryptographic puzzle. Once the designated leader confirms that everyone has locked their funds, they reveal the final piece. That single act unlocks the entire ring: every participant can now claim their incoming funds, on whatever blockchain those funds sit. The beauty of this approach, compared to earlier techniques like hash time-locked contracts, is that nothing sensitive appears on-chain. Spend transactions look like ordinary transfers. There is no shared hash linking the legs of the swap together, which is good for privacy and for scalability beyond two parties. One primary hurdle is that Bitcoin and Cardano use different cryptographic systems under the hood. Bitcoin uses the secp256k1 elliptic curve with Schnorr signatures (via Taproot), while Cardano natively relies on Ed25519. The reference implementation elegantly solves this by deploying a Cardano smart contract (a Plutus validator) capable of verifying Bitcoin's Schnorr signatures. This allows a single cryptographic event on the Bitcoin network to instantly trigger and unlock UTXOs on Cardano. What if someone backs out? Every participant holds a fully signed refund transaction before a single lock transaction is broadcast. No one locks their funds unless their exit is already guaranteed. Refund transactions are time-locked - only valid after a certain block height - and the windows are staggered deliberately: each party's window opens after the person claiming their funds has had a chance to act. This ordering ensures that if the leader stops cooperating mid-swap, every honest participant can recover their funds safely, without racing against each other. The implementation. The reference implementation demonstrates that trustless, multi-party, cross-chain atomic swaps are practically achievable. The prototype is written in Rust and runs as a daemon that manages the full protocol lifecycle - key exchange, transaction construction, broadcast, and settlement - for a single participant in a swap session. Daemons communicate directly over TCP; there is no central server. Regression tests validate correct behaviour with up to 20 concurrent parties, each running an independent daemon against Bitcoin and Cardano nodes on a private test network. The protocol's safety and liveness properties have been formally verified, giving mathematical confidence that honest participants cannot lose funds. The pattern is not limited to Bitcoin and Cardano: any blockchain with native Schnorr signature support, or a smart contract layer capable of verifying Schnorr signatures, can participate in a CANS swap session. Why does CANS matter? The trade finance gap perfectly illustrates why CANS matters. Each year, $1.7 trillion in trade remains static - not for lack of capital, but for lack of trust infrastructure. Banks turn away small and mid-sized deals as they are too small, too costly, and too risky to service, leaving SMEs with poor options: ship and hope for payment, demand full prepayment until the deal collapses, trade only with known partners, or accept steep premiums from intermediaries. The result isn't expensive trade; it's absent trade. By applying CANS technology, Input Output Global, Inc. can service the trade finance gap and unlock trillions in new trade activity. Every prior attempt - TradeLens, Input Output Global, Inc..trade, Contour, Marco Polo - was a proprietary walled garden, and each failed because you can't force a whole competing industry to join one company's platform. CANS instead is an open, chain-agnostic protocol. Concretely, in a cross-border trade, CANS lets a buyer, seller, shipper, insurer, and financier settle in a single atomic transaction across whatever chains each prefers. Cryptography - N-of-N multi-signature locks, adaptor signatures, and staggered time-locked refunds - gives the same guarantee a letter of credit does: either every leg executes, or none executes, and no principal is ever lost. That removes counterparty risk without a bank's credit assessment, compressing settlement from weeks to minutes and removing bank margins and subscription fees. The CANS protocol turns deals that simply couldn't happen into deals that settle safely in minutes, by replacing the missing trust infrastructure with cryptographic guarantees instead of yet another platform nobody wants to join. The reference implementation is being developed on GitHub. Input Output Global, Inc. welcome contributions, integrations, and feedback from the community by raising pull requests or issues, or adding comments. Timelines and product features are not final and are not guaranteed; all future developments are subject to change. IO does not review, approve, monitor, endorse or make representations with respect to third-party protocols or offerings.

Input Output co-hosts Cryptographic Tools for Blockchains workshop at Eurocrypt '26. Academics and practitioners from across the blockchain ecosystem gathered to learn about zero-knowledge proofs, post-quantum cryptography, privacy, and blockchain programmability. Jesus Diaz Vico June 17 2026 Summary: Input Output (IO) recently co-organized the third edition of the Cryptographic Tools for Blockchains (CTB '26) workshop in Rome, alongside Eurocrypt 2026. The full-day technical event highlighted three critical pillars for the next generation of decentralized infrastructure: * Post-quantum readiness: leveraging novel signature transformations and threshold constructions to preserve long-term network resilience. * Verifiable state privacy: deploying advanced private information retrieval (PIR) regimes that guard data access layers without bottleneck baseline performance. * Programmability without forks: extending the capabilities of existing networks like Bitcoin through witness encryption frameworks. Together, these research streams build the secure, correct, and scalable foundations necessary for widespread institutional adoption. About CTB'26. The third edition of the Cryptographic Tools for Blockchains (CTB'26) workshop was held in Rome in early May, alongside Eurocrypt 2026. The workshop gathered around 50 attendees - academics and practitioners from across the blockchain ecosystem - for a full day of technical presentations spanning zero-knowledge proofs, post-quantum cryptography, privacy, and blockchain programmability. CTB '26 has established itself as a focused venue for bridging the gap between cutting-edge cryptographic research and its practical applications in blockchain systems. The third edition continued this tradition, bringing together researchers from leading institutions - including Stanford, EPFL, KU Leuven, the Ethereum Foundation, and others - alongside engineers building production systems. The program featured two keynotes and eight contributed talks organized across three sessions. Technical tracks and highlights. Here is a closer look at the specialized technical tracks and standout highlights from the event: Invited talks. Benedikt Wagner (Ethereum Foundation) opened the workshop with an overview of the state of multisignatures and aggregate signatures in Ethereum. Benedikt described the ongoing EF effort to combine post-quantum secure hash-based signatures (XMSS) with succinct non-interactive arguments of knowledge (SNARKs) as a path toward scalable signature aggregation - a construction called Hint-Free multi-signatures. The afternoon invited talk, by Ali Atiia (Ethereum Foundation), addressed read privacy in blockchains. Querying blockchain state leaks information about which data is being accessed - a privacy problem often overlooked in protocol design. Atiia presented a system for private information retrieval (PIR) over Ethereum state, combining Unified Binary Trees (UBT) for compact state representation, SNARKification for verifiable query processing, and sharding plus preprocessing techniques to bring PIR into a practically feasible regime. Morning track. * SNARKs for First-Order Logic (Gabbay and Mendelsohn, Imperial College London) showed how to arithmetize first-order logic formulas into constraint systems that SNARKs can process, using multilinear extensions. * New Straight-Line Extractable NIZKPs for Cryptographic Group Actions (Pintore et al., University of Trento) revisited the Fiat-Shamir transform and its alternatives for converting interactive proofs to non-interactive ones. They introduced a new transform based on group actions - the GAO transform - that achieves straight-line extraction without rewinding. The result has near-optimal parameters for post-quantum signature schemes such as LESS, an isogeny-based scheme. * DekartProof: Efficient Vector Range Proofs and Their Applications to Blockchains (Boneh et al., Stanford / Aptos) introduced a new construction for zero-knowledge range proofs over vectors, leveraging multilinear encodings and a novel ZK variant of the sumcheck protocol. Proving and verification are significantly faster than prior art, though at the cost of larger proof sizes. * Trust, But Verify When Using the Powers of Tau (Baghery, KU Leuven) diagnosed a critical gap in how Powers of Tau ceremonies are run in practice. Since verifying the final structured reference string (SRS) naively takes thousands of seconds, ceremony participants routinely skip this step, undermining security guarantees. The paper presents a concrete algorithm and advocates for its adoption as standard practice. * Monotone Erasure Codes (Cimatti, Bammert et al., University of Bern / Common Prefix / SDF) introduced a framework for constructing optimal erasure codes for arbitrary monotone access structures, formalizing the problem via linear programming. The construction is relevant to BFT consensus, secret sharing, and blockchain voting, among others. Afternoon track 1. * Sponsored Fair Exchange (Vaudenay, EPFL / CIMA.SCIENCE) presented Sponsored Optimistic Xchange (SOX), a protocol for fair digital goods exchange that achieves privacy and economic fairness. A key innovation is the sponsor role: third parties who subsidize blockchain fees on behalf of participants, enabling fee-free participation for vendors and buyers who only pay on successful transactions. Dispute resolution has logarithmic complexity in the number of knowledge coins exchanged. * Balthazar: A Password-Based Web3 Wallet using OPAQUE and TEE with Brute-Force Resistance (Krajci, Oleksak, Homoliak, Brno UT / Slovak UT) tackled the UX gap between Web2 password authentication and Web3 key management. Balthazar implements the OPAQUE password-authenticated key exchange protocol inside a TEE-backed confidential EVM, with encrypted on-chain storage and blockchain-enforced rate limiting to prevent brute-force attacks. Afternoon track 2. * Bitcoin PIPES v2 (Abdalla, Carmer, El Gebali, Kilinc Alper et al., allocinit.xyz) extended the PIPES framework with Witness Encryption and Witness Signatures. The result increases Bitcoin's programmability - enabling rollups, bridges, vaults, and other constructions - without any protocol fork. * Thresholding Post-Quantum Signatures (De Sclavis, Nardelli, Pedicini, Bank of Italy / Roma Tre) surveyed the state of threshold signatures in the post-quantum setting, covering lattice-based approaches (noise flooding, Lagrange coefficient issues), group-action and isogeny-based schemes, and hash-based constructions. The talk highlighted the significant open challenges remaining in each family before practical threshold post-quantum signatures become viable. * Data Availability Sampling with Repair (Boneh, Neu, Nikolaenko, Partap, Stanford / a16zcrypto) augmented data availability (DA) sampling with repair capabilities: the ability to reconstruct data lost due to malicious or faulty nodes. The construction relies on locally correctable codes (specifically multiplicity codes) and a new multivariate polynomial commitment scheme, providing provable recovery guarantees for DA layers. Ongoing research work. CTB'26 reflected both the maturity and the open frontiers of applied cryptography for blockchains. From practical ceremony hygiene to post-quantum threshold signatures, and from private state access to Bitcoin programmability, the workshop demonstrated the breadth of unsolved problems - and the depth of the ongoing work to address them. The slides used by the presenters are available on the CTB website.