Cardano's New Language: Groth16, Intents, and the $63 Million Silence

Charles Hoskinson posted code. That is the news. Not a whitepaper, not a testnet, not a repo with a README and a contributing guide — a code reveal, the way this industry has learned to announce things: screenshot first, specification later, maybe never. The engineering roster attached to Cardano's next programming language is two names. One is Hoskinson, whose face is the brand. The other is Lucas Rosa, an IOG software engineer with a public footprint you could fit on a Post-it. That is the entire visible workforce behind a project that would need a compiler, a type system, a standard library, an LSP, a formatter, a package manager, formal verification hooks, and an audit pipeline before a single serious protocol would bet a dollar of TVL on it. Four facts are hard. The language is in development. It supports intent-based transactions. It uses Groth16 to implement proof-carrying data. And Cardano's total value locked sits at $63 million. That last number is not a footnote. It is the punchline, and it was sitting in the same headline as the technical vision — which is itself a tell, because no editor pairs a breakthrough with a small number unless the small number is the story. The chart screams, but the order book whispers. On Cardano right now, the whisper is a rounding error against a market cap that once traded in the top ten of all digital assets. I have watched this exact movie before. In 2017 I skipped a midterm to watch Gnosis blocks land, and I wrote three thousand words on Z-score manipulation in ICO whitelists four hours after a mainnet went live. Back then a GitHub commit could reprice an asset by forty percent because nobody had time to check anything. Speed was the whole edge. In 2026, speed is table stakes and verification is the edge, which means the first thing I do when Hoskinson posts code is not read the code. It is go look at what the chain has actually been doing for the last ninety days. What the chain has been doing is $63 million. Everything else in this article flows from the tension between that number and the ambition of the announcement. The Stack Nobody Asked For Cardano does not have a programming language problem. Cardano has six programming languages, and is about to have seven. Start with Plutus, the official Haskell-flavored stack, built on Plutus Core and the extended UTxO ledger model. Plutus is rigorous and unpleasant. It asks developers to think in on-chain validators that receive a datum, a redeemer, and a script context, and it asks them to assemble the rest of the transaction off-chain before anything touches a block. That architecture is beautiful if you like determinism and miserable if you like shipping on a Friday. Then the ecosystem got impatient and built around it. Marlowe, the financial DSL, aimed at contracts that look like term sheets rather than software. Plutarch, a Haskell-embedded alternative that trades ergonomics for tighter script budgets. OpShin, which lets people write Plutus validators in Python. Plu-ts, for the TypeScript crowd. And Aiken, a Rust-flavored language with a real type system, a real toolchain, and a developer experience that does not require a functional programming doctorate. Aiken won. By most counts it now dominates new smart contract deployments on Cardano, and it won the way community tools always win: it made the boring parts — testing, formatting, editor support, error messages that read like English — somebody's actual job. The official stack did not lose because it was wrong. It lost because it was slow to be pleasant. That history matters enormously here, because the new language is coming from IOG, the same organization whose previous official entry lost the developer base to a community fork of its own ideas. This is not a neutral observation. It is the single most under-priced risk in the announcement, and I will come back to it. Now the announcement fatigue. Cardano has shipped a very specific cultural pattern over eight years: Shelley, Alonzo, Vasil, Hydra, Midnight, Chang, Plomin. Each arrived with a substantial narrative payload, each was late by some margin, each eventually landed and moved the price less than the one before. That is what happens to narrative assets in decay — the same stimulus produces a smaller response, and the market demands a bigger stimulus to produce the same response. By the time you are announcing a seventh programming language, the reflex arc is fully trained. Announcement, anticipation, delay, amnesia. Reading the room before reading the candlestick is the whole job. And the room here is not hostile. It is worse. It is bored. Groth16 Is a Vow of Poverty The technical core of the announcement is a stack of three ideas: intents, proof-carrying data, and Groth16 as the proof system underneath. All three exist already. None is new. What is being proposed is a recombination, and recombination is fine — most engineering progress is recombination — but it should be labeled honestly as a combinatorial bet rather than a paradigm shift. Groth16 is the 2016 construction from Jens Groth that still holds the record for the smallest proofs and the cheapest verification in the zkSNARK family. On the BN254 curve, a proof is three group elements, roughly 128 bytes. Verification is a handful of pairings — one multi-pairing check, milliseconds on commodity hardware. In a world where proof size determines calldata cost and verification cost determines on-chain feasibility, that is not a small advantage. Groth16 is the reason early ZK rollups could afford to post proofs to Ethereum at all, and the reason EIP-1108 had to cut the BN254 pairing check from roughly 200,000 gas down to about 113,000 before those proofs were economically viable. But Groth16 is also a vow of poverty, and the vow is circuit-specific trusted setup. Every distinct circuit needs its own ceremony, its own toxic waste, its own multi-party computation transcript that somebody has to trust or verify. PLONK gave the industry a universal, updatable structured reference string — set up once, reuse forever, and let late participants contribute to the same ceremony. Halo2 removed the trusted setup entirely with inner product arguments. And the research frontier since 2021 has moved to folding schemes — Nova, SuperNova, HyperNova, ProtoStar — where the cost of recursion drops by orders of magnitude because you stop proving and start folding. Against that backdrop, choosing Groth16 in 2026 reads as academic conservatism. It optimizes for verification efficiency and formal provability, and it pays for that with setup complexity and no native recursion. Groth16 does not compose with itself. To get recursion you need a cycle of curves — two pairing-friendly elliptic curves whose orders divide each other's field sizes — or a wrapper circuit that re-proves a Groth16 proof inside a PLONK-ish system. Both are known techniques. Both are engineering-heavy. Neither is free. There is a Cardano-specific wrinkle that almost nobody has written about, and it is the kind of detail that decides whether a design is real. Cardano's Plutus added BLS12-381 builtins in the Vasil era: group operations, a pairing check, compression, hash-to-curve. That means an on-chain verifier is possible natively — no Ethereum-style precompile required. But it also means the curve is likely BLS12-381 rather than BN254, which changes the arithmetic of the economics. BLS12-381 proofs are larger: two G1 elements at 48 bytes plus a G2 element at 96 bytes puts you near 192 bytes, not 128. And every one of those pairing operations burns Plutus execution budget, which is priced and metered, and which is exactly the kind of cost that quietly determines whether a design is usable at scale or merely demonstrable. I have spent enough time in script-budget spreadsheets to be blunt about this. In 2020 I got a tip about Curve's early voting escrow design from a Discord voice chat — not from an audit, from a conversation — and I wrote about the time-decay trap before anyone had formalized it. The lesson I took was that the mechanical details buried in a design are where the alpha lives, and the mechanical detail here is that verification cost lands somewhere. Either you pay it on-chain in budget, or you pay it off-chain in trust. The announcement does not say which. That omission is the difference between a language and a demo. Proof-Carrying Data Is the Only Adult in the Room Of the three ingredients, proof-carrying data is the one with genuine long-term weight, and it is the one getting the least attention because it is the hardest to explain in a thread. The idea traces back to Chiesa and Tromer's work on proof-carrying data, layered on Valiant's incrementally verifiable computation. The claim is simple and enormous: every step of a computation carries a proof, and those proofs compose, so a verifier who checks only the final proof is convinced of the entire chain of computation — including all the intermediate steps it never saw. This is the machinery behind succinct blockchain verification, behind light clients that do not trust a header chain, behind cross-chain bridges that verify state rather than validators, behind anything that wants to say I did not witness this, but I can prove it was done correctly. If Cardano gets PCD working as a first-class language primitive, the value is not a nicer developer experience. The value is verifiable interoperability. A bridge that verifies proofs instead of trusting a multisig is a categorically different security object. A light client that verifies state transitions instead of polling RPC endpoints is a categorically different trust model. Those are the things institutions actually ask about, and they are the things Cardano's academic brand is genuinely good at. Here is the friction. PCD wants recursion, and Groth16 does not give you recursion for free. So the two headline technical choices are in tension, and the resolution — curve cycles, wrapper circuits, or a hybrid where the outer layer uses something folding-based — is exactly the part that requires an engineering team measured in dozens rather than units. The research is understood. The implementation is the moat. And the announcement gives us zero implementation surface: no benchmark, no proof generation time, no verification budget measurement, no repository, no specification document. No data is not a neutral state. In technical due diligence, absence of performance numbers is evidence about maturity, and it points in one direction. Intents Fit eUTxO Like a Glove, and That's the Problem Intent-based transactions are the most commercially interesting piece, and the most architecturally revealing. An intent is a declarative statement of a desired end state — I want to hold at least this much of asset X, subject to these constraints — rather than an imperative sequence of calls. Somebody else, a solver, competes to construct a transaction that satisfies it and captures the difference as profit. CoW Protocol built a business on this. UniswapX built a routing layer on it. Anoma and Essential have built entire architectures around it. ERC-7683 tried to standardize cross-chain intents so that the solver market would not fragment into a dozen incompatible dialects. Now look at eUTxO. Cardano's ledger is a declarative state-transition model by construction: you consume these UTxOs, you produce those UTxOs, and the validator checks the relationship. The transaction is assembled off-chain and validated on-chain. That is an intent pipeline that has been sitting in the protocol since 2020, waiting for someone to name it. On the axis of architectural consistency, intents and eUTxO are the same shape, and that is a real advantage — no impedance mismatch, no shim layer pretending the account model exists. But consistency is not the same as sufficiency, and the subtext here is uncomfortable for maximalists. Intents are a workaround for a composability problem. In an account-based chain, a smart contract can call another smart contract synchronously, mid-transaction, and read its state. In eUTxO, you cannot — the validator sees a bounded slice of the world, and multi-step composition has to be planned ahead of time by someone with a fuller view. Solvers are that someone. Adopting intents as a first-class primitive is Cardano acknowledging that the missing account model will be compensated for by an off-chain coordination market rather than replaced. That is a legitimate engineering answer. It is also a transfer of power. Once solvers construct transactions, solvers decide ordering within their bundles, solvers decide which intents are worth serving, and solvers decide which intents get dropped. Cardano's pitch has always been that its ledger is predictable and fair — no public mempool auction, no priority gas, no builder market extracting rents. Intents reintroduce a builder market through the side door, with a friendlier name. The MEV does not disappear. It relocates, and the relocation happens in a layer that is not the protocol, is not the treasury, and is not the thing ADA holders own. Which brings me to a structural point I keep making and keep being right about: value in this industry is captured above the protocol far more often than inside it. If Cardano's intent layer becomes real and liquid, the entities that capture the spread are solver operators and proof-generation services, not stakers. The protocol gets usage. The middle layer gets margin. That is not a conspiracy, it is just where the pricing power sits when you hand transaction construction to a competitive market and the protocol only validates the result. Two Engineers and a Compiler Let me put a number on the delivery question, because vague pessimism is worthless. A programming language is not a syntax. It is a compiler with a type checker and a code generator, a standard library that covers enough of the domain that nobody has to reimplement serialization, a package manager, a formatter, a language server so that editors can autocomplete and jump to definition, a testing framework, a debugging story, a migration path from the existing languages, and formal verification hooks if the whole selling point is provability. Then it needs adversarial review, because a compiler bug in a smart contract language is not a crash — it is a drained protocol. StarkWare's Cairo is the closest comparable. Dozens of engineers, roughly two years from zero to something a real team would deploy capital against, and that was with a company whose entire existence depended on it. Aiken's rise took a funded, focused team and multiple years of grinding through developer experience details. Two people, one of whom is the founder of the entire ecosystem and therefore has approximately nine other full-time jobs, is not a staffing plan. It is a research interest with a marketing wrapper. Speed kills, but hesitation bankrupts — and the inverse is also true. Announcing at two engineers is not speed. It is the appearance of speed purchased with future credibility. I want to be fair here, because the counterargument is real: a small team with an excellent design can produce a proof of concept in months, and proofs of concept are how languages get funded. Fair. But the announcement did not say proof of concept. It said new language, with three specific technical claims attached. When you attach Groth16 and proof-carrying data to a project, you are claiming a level of cryptographic engineering that requires a team, a ceremony, and an audit. The gap between what was claimed and what was staffed is the story. The Midnight Sunk-Cost Hypothesis Here is the part of the analysis I am least certain about and most interested in, so I will label it as such. IOG already has a ZK language. It is called Compact, it lives in the Midnight ecosystem, and it descends from Kachina — the private smart contract foundations work by Kerber, Kiayias, and Kohlweiss — which is genuinely good research on how to keep state private while still proving correctness. Midnight is IOG's privacy sidechain play, and it has consumed real engineering resources for years. So why would the same organization build a second ZK language for the main chain? Two explanations. The generous one: Cardano's eUTxO mainnet has different constraints than Midnight's private-state model, and a language tuned for intent-based, proof-carrying computation on the L1 is a genuinely different artifact from a privacy DSL. The cynical one: the proof system and ceremony infrastructure already exist inside Midnight, the marginal cost of a second language that reuses them is lower than it looks, and the announcement is partly a way to make that sunk investment legible to a market that has stopped paying for Midnight's narrative. I lean toward a blend. When a team has already built a Groth16-shaped machine, every new problem starts looking Groth16-shaped. That is not corruption, it is just how organizations think. But it does mean the technical choice may be constrained by infrastructure rather than optimized for the problem, and constraints that come from sunk cost are the hardest kind to argue against internally, because the person arguing against them is arguing against their own past decisions. There is a lower-confidence version of this that I will flag and not defend: the language could be positioned as the intent batching layer for Leios, the throughput upgrade built around input endorsers. If Leios raises block capacity substantially, the bottleneck moves from execution to transaction construction, and a language whose native abstraction is a declarative intent starts to look like infrastructure rather than indulgence. I would not bet on this. I would bet that nobody has written it down. The Announcement Is Not For Developers Now the contrarian read, and it is the one I would stake my reputation on. This announcement is not addressed to developers. It is addressed to holders. Consider the function it performs. A chain with $63 million in TVL, sitting on a war chest measured in the hundreds of millions of dollars, needs to give the people who bought at the top a reason not to sell. A programming language does that better than almost anything else, because it is unfalsifiable on a short horizon. You cannot prove a language will fail in a week. You can only wait, and while you wait you hold. Vision announcements are, functionally, patience manufacturing. I have watched the market's reaction function to Cardano technical news long enough to model it. The marginal pricing power of a technical announcement on this asset has decayed monotonically across at least five major events. My expectation here is under ten percent of the news being priced, a three to eight percent impulse in either direction depending on the broader tape, and full retracement inside forty-eight to seventy-two hours. That is the signature of narrative fatigue, not of a catalyst. The deeper problem is a category error in the announcement itself. A new programming language is supply-side reform. It lowers the cost of building. But $63 million in TVL is not a supply problem — it is a demand problem. Developers do not come to a chain because the language is nice. They come because there is capital to deploy against, users to serve, and yield to chase. The root cause of a thin DeFi ecosystem is the absence of attractive assets and returns, not the absence of a compiler. And notice what is not in the announcement: no fee burn, no revenue buyback, no staking mechanism change, no treasury allocation. Nothing that touches value capture. A new language, if it works, increases the surface area of the chain. It does not increase the amount of value that accrues to ADA. Those are different questions and the announcement answers neither. There is an editor's tell buried in the coverage itself. When an outlet puts a visionary technical claim in the headline and the TVL number in the same breath, that pairing is an editorial judgment. It says: we no longer take the technology narrative at face value. Two years ago the headline would have been the language. Now the number is in the room. The Liquidity Trap Wearing a Speedo $63 million is not a small number in absolute terms. It is a catastrophic number relative to the asset's history, and more importantly it is a number with a shape. Liquidity is just patience wearing a speedo. It looks brave until the water gets cold. Below a certain depth, a DeFi ecosystem enters a self-reinforcing trap: thin liquidity means high slippage, high slippage means any position above a modest size is uneconomic to open, which means large capital does not arrive, which means liquidity stays thin. The trap does not require anyone to be wrong. It requires only that the cost of entry exceed the expected edge, and at $63 million across an entire chain, that condition is satisfied for most professional capital. The fragility compounds it. At this scale, a single protocol listing or delisting can move chain-wide TVL by twenty percent or more. That is not an ecosystem, it is a collection of independent bets sharing a logo. And the revenue picture is worse than the TVL picture. A Cardano transaction costs roughly 0.17 ADA. Multiply that by the throughput of a chain with $63 million of economic activity and you get a protocol revenue line that is, for practical purposes, a rounding error against the staking rewards being paid out. Which is the part people do not want to hear. Staking yield on Cardano runs in the low single digits and it is funded from the reserve pool — inflation, not revenue. There is nothing structurally fraudulent about that; it is a subsidy, openly disclosed. But it means the yield is a claim on future dilution rather than a claim on present cash flow, and in a bear market the difference between those two things becomes the only thing that matters. I will make a related point about the lending side, because it is where I think Cardano's DeFi problem is most visible and least discussed. Rate curves on-chain are governance dials, not price discovery. When I look at lending markets — on Cardano, on Ethereum, anywhere — what I see is a parameter set chosen by a team and adjusted by a vote, loosely tethered to utilization and almost entirely untethered from the actual term structure of credit demand. The borrow rate is not discovered, it is administered. That is fine in a bull market when everyone is paying anything for leverage. In a $63 million market it means the yield you see is a number somebody picked, and the risk you take is the risk that they picked wrong. Arbitrary parameters look like engineering when the tape is green. They look like what they are when it is not. Breaking a liquidity trap requires external subsidy, and Cardano has the treasury to do it. But treasury-funded liquidity mining is buying TVL with inflation, and it works exactly as long as the emissions last. Every chain that has tried to bootstrap depth this way has learned the same lesson: mercenary liquidity leaves on the same bus it arrived on, and it takes the TVL chart with it. The Developer Paradox Here is the statistic that should make everyone uncomfortable, and it is the one Cardano's defenders reach for first. By the standard developer-count metrics, Cardano consistently ranks among the top handful of L1 ecosystems for monthly active developers. Hundreds of people. Year after year. And yet $63 million in TVL. Developers up, capital down, products thin. That combination is diagnostic. It tells you the developer base is weighted toward education, hackathons, academic experiments, and grant-funded exploration rather than toward teams deploying products that hold other people's money. Which makes sense, because Cardano's genuine differentiator is intellectual: formal methods, peer-reviewed protocol papers, a culture that treats a proof as more persuasive than a demo. That attracts a certain kind of builder — the kind who will spend six months on a specification and three weeks on a launch. That is a real asset. It is also a business model with a very long payback period, and it does not generate on-chain revenue while you wait. The commercial path where Cardano's rigor actually converts into money is regulated settlement, real-world assets, institutional infrastructure — places where auditability and formal verification are procurement requirements rather than marketing bullet points. That path is slow, it is unglamorous, and it will never trend on crypto Twitter. It is also, in my read, the only version of Cardano that has a defensible future. Which is why the new language announcement frustrates me. Not because it is bad. Because it is the wrong shiny object. Cardano spent 2024 and 2025 completing the most genuinely differentiated thing any L1 has done in years: on-chain governance with a constitution, delegated representatives, a constitutional committee, and staked pool operators in a three-way check. That is a real institutional innovation, and it is a nightmare to market because it involves committee procedure. So it got buried under hard forks and now under a programming language. Media incentives punish the boring true thing and reward the shiny unprovable thing. That is not Cardano's fault. It is Cardano's problem. The Fragmentation Tax Back to the official-language-versus-community-language collision, because I think it is the most under-priced negative externality in the whole announcement. Aiken owns the developer mindshare. It is not the official language, but it is the one people use, and it got there by being pleasant. Now IOG proposes a seventh entry into an already crowded stack, positioned as the official frontier. The historical precedent is not encouraging. Ethereum's early alternative languages — Serpent, Viper — were interesting and lost to Solidity, which was worse in several respects and won because it was there and people built on it. Official blessing has never been sufficient to beat installed base. The costs of adding a seventh language are concrete and unglamorous. Tooling splits: every editor plugin, every fuzzer, every static analyzer now has one more target and a fraction of the attention. Audit standards fragment: an auditor who has reviewed two thousand lines of Aiken has a mental model of its failure modes, and that model does not transfer to a new language with a novel proof-carrying primitive. Worst of all, developer attention dilutes, and attention is the scarcest resource in a $63 million ecosystem. Every hour a Cardano builder spends deciding which of seven languages to learn is an hour not spent shipping. There is a smarter version of this strategy that the announcement does not articulate but that would make sense: position the new language as a domain-specific language for regulated financial contracts and RWA settlement, deliberately narrow, deliberately not competing with Aiken for general-purpose DApps. A DSL with proof-carrying data and intent primitives, aimed at a customer segment that cares about verifiability and nothing about developer ergonomics, would be coherent. It would also be a much smaller claim than the one being made. Founder Risk Is the Whole Risk The dependency graph of this ecosystem is a single node with a name on it. IOG simultaneously runs core protocol research, the Midnight sidechain, governance tooling, ecosystem funding, and now a programming language. Hoskinson is the connective tissue across all of it: the fundraiser, the chief communicator, the technical direction-setter, the political operator. That is a single point of failure in the most literal sense, and it is compounded by a structural fact that rarely gets discussed — Cardano has no Tier-1 venture investor with a board seat and an incentive to intervene. The absence of VC overhang is genuinely good for holders. No unlock cliff, no fund dumping on retail. But it also means nobody with leverage can tell the founder to pick one thing. There is no adult in the room with a fiduciary duty to say the language can wait and the stablecoin float cannot. Governance does not fix this either, because the governance structure was designed to allocate a treasury, not to manage a company's product roadmap. Then there is the persona risk, which is real and unhedged. A founder who operates at the center of American political cycles imports political volatility into the asset. That cuts both ways, and in a bad tape it cuts badly. It also creates a regulatory surface that has nothing to do with the technology. A programming language is about as regulation-neutral as an artifact gets — it is open-source software, closer to protected expression than to a security. The risk does not live in the language. It lives in the person announcing it. One more compliance detail worth flagging for the people who care about trusted setups. Groth16's circuit-specific ceremonies produce toxic waste, and history says disclosure quality matters enormously. Zcash's early ceremonies were theatrical precisely because the trust story had to be legible to non-cryptographers — the laptops, the air gaps, the destroyed hardware. If Cardano ships a production ceremony with a thin transcript, the reputational damage will exceed the technical one. If it ships a well-documented multi-party ceremony with independent participants, that is a genuine credibility asset in exactly the institutional market Cardano claims to want. The announcement says nothing about which it will be. What the Market Actually Prices A language is a promise about the future. TVL is a receipt for the past. The market prices receipts and discounts promises, and that asymmetry is the whole game in a bear market. So here is what I will actually watch, in order, over the next four quarters. A repository with a specification, not a screenshot. A testnet with a named set of contracts on it. A ceremony transcript with independent participants listed by name. A verification budget measurement published in Plutus execution units, because that single number determines whether proof-carrying data on Cardano is infrastructure or a demo. A stated migration path from Aiken, or an explicit statement that there isn't one. A named solver operator for the intent layer, and whether that operator is permissioned, because a permissioned solver set is a centralized exchange with extra steps. And the boring number that actually matters: stablecoin float and TVL on Cardano, quarter over quarter, because that is the only line that reflects demand rather than supply. If three of those appear inside twelve months, I will revise upward and say so publicly. If the language remains a code snippet and a narrative through the next hard fork cycle, then what we watched was not an engineering announcement. It was a liquidity operation aimed at holders, executed with technical vocabulary. I have been doing this for fourteen years, and the pattern I trust most is the one where the technical ambition is real, the team is real, the research is genuinely good, and the product still does not arrive because the organization cannot say no to a shiny thing. Cardano is not a scam. Cardano is a brilliant research lab with a distribution problem and a founder who cannot stop announcing. Panic is just uncalculated opportunity in a hurry. This is not panic. This is the slower, sadder version — an ecosystem that keeps producing announcements faster than it produces users, and a market that has finally learned to wait for the receipt. The next thing to watch is not the language. It is whether anyone with authority inside that ecosystem says out loud that the language can wait.