FluidTokens' Raul: Bifrost puts bridged Bitcoin under Cardano's stake pools

Raul, from the Cardano DeFi platform FluidTokens, explained on Learn Crypto Podcast's Can Bitcoin Fix Cardano DeFi? FluidTokens' Bifrost Explained, published 26 October 2026, how Bifrost secures the Bitcoin it locks without a central custodian. Bitcoin has no smart contracts, so Bifrost locks deposits behind a Bitcoin multisignature wallet whose signing power is split among Cardano's stake pool operators (SPOs), weighted by how much ADA is delegated to each one. Host Pete Bui set the design against bridges whose custody sat inside a single hackable contract, naming Wormhole and Nomad. The conversation was recorded in April 2026, and FluidTokens' technical specification has since changed the trust model Raul described.

The argument

Raul described the mechanism as inheriting Cardano's own security rather than adding a new one: "you could have a multi-signature given to stake pool operators where everyone has a signature power based on their stake delegation." (from 5:39) He drew the conclusion directly: "the only way that you could have to hack the system is to take over Cardano" (from 5:39), adding: "we know that Cardano is decentralized, so that's an optimistic approach, but it's a very good trust assumption over there." (from 6:33)

Bui then supplied the contrast himself, describing how EVM-style wrapped-asset bridges fail: "that's the thing that gets hacked. And we've seen that over and over again: Wormhole, Nomad, all these big names out there, hundreds of millions of dollars of assets hacked and liquidated." (from 7:32)

Raul also walked through the testnet deposit flow, in which Bitcoin is sent to a Taproot address rather than directly to the bridge's multisig: "Fluid Tokens has no control over it, so your funds, your BTC are always controlled by you and your keys." (from 20:47)

What it rests on

FluidTokens' own specification for Bifrost, ratified 15 July 2026, confirms the architecture Raul described: Bitcoin deposits go to a Taproot address, and the treasury is swept by a FROST group signature produced by Cardano's SPOs, weighted by delegated stake.

The threshold has changed since the episode was recorded. Raul gave it on the show as 67% of total stake (from 10:25). FluidTokens' current specification says that tier was removed and the protocol now runs on a single 51% threshold: an earlier design layered a 67% tier above a 51% one, but an adversary already holding 51% of stake could make the higher tier fail to sign and fall back to the 51% path, so the effective theft threshold was 51% either way. The document adds that 51% of delegated stake is already Cardano's own trust floor, so no signing threshold on the bridge can be safer than the layer-one it reads its state from.

The same specification gives Bifrost a second authority Raul did not describe. The bridge launches with a federation as the only signing entity, and after stake pool operators take over, that federation remains a standing co-authority that can rotate the treasury key at any time. Every deployment must publish a charter stating that the federation can rotate the key unilaterally and immediately, and the federation's own signing procedure is marked as not yet published. Until it is, taking over Cardano is not the only way to move the bridged Bitcoin.

The refund path is real but slower than Raul's walkthrough suggested, where he said the deposit address lets him "withdraw my transaction whenever I want" (from 19:50). The specification shows each Taproot deposit address carries three spending paths: the SPO sweep, a timelocked federation fallback, and a depositor refund leaf that opens only after roughly 4,320 Bitcoin blocks, about 30 days. A depositor can reclaim BTC the bridge never processed, but not on demand.

Bifrost has not launched. FluidTokens' most recent public deployment notes, dated 17 July 2026, show the bridge on Cardano's preprod test network and Bitcoin's testnet4. Raul described the project as in a testnet phase at the time of recording (from 9:04).

The Wormhole and Nomad comparisons hold, though the mechanisms differed. Wormhole's February 2022 loss, about $320 million, came from a bug in the verify_signatures function of its Solana-side bridge contract, which let an attacker bypass the check for a valid quorum of Guardian signatures. Nomad's August 2022 loss, about $190 million, came from a routine contract upgrade that marked a zero hash as a trusted message root, so messages could be treated as proven without a valid signature. Both losses came from a flaw inside a bridge-specific contract. Bifrost's bet is that substituting Cardano's stake-weighted validator set removes that failure mode specifically, not that it removes risk altogether.

Where it was discussed

• Learn Crypto Podcast: Can Bitcoin Fix Cardano DeFi? FluidTokens' Bifrost Explained, 26 October 2026, from 5:39