Zero-Knowledge Proofs (ZK) Explained: A Complete 2026 Guide

TL;DR

• Zero-knowledge proofs (ZKPs) let one party (the prover) convince another (the verifier) that a statement is true without revealing why — formalised by Goldwasser, Micali and Rackoff in 1985 and now the cryptographic backbone of Ethereum scaling, on-chain privacy, decentralized identity and verifiable AI.
• The two dominant proof families are zk-SNARKs (Groth16 2016, PLONK 2019, Halo2) — small proofs, often a trusted setup, pairing-based — and zk-STARKs (Eli Ben-Sasson, StarkWare) — transparent, post-quantum, hash-based, larger proofs.
• ZK rollups scale Ethereum: ZKsync Era, Starknet, Scroll, Linea, Polygon zkEVM, Taiko. zkVMs generalise proving: Risc Zero, Succinct SP1, Polygon Miden, Cairo. ZK coprocessors (Axiom, Brevis, Lagrange) prove off-chain compute. zkML (EZKL, Modulus Labs) attests AI inference. Privacy layers (Aztec, Aleo, Mina, Zcash, Penumbra) plus identity (World ID, Polygon ID, Anima, Holonym).
• Hardware acceleration (Cysic, Ulvetanna, Ingonyama) and recursion/folding (Nova, Plonky2/3) drive the cost of proving down by orders of magnitude every year.

Table of contents

• What is a zero-knowledge proof?
• Common terms: prover, verifier, witness, soundness, completeness
• History of ZK: from 1985 to 2026
• zk-SNARKs vs zk-STARKs vs Bulletproofs
• Proving systems: Groth16, PLONK, Halo2, Plonky2/3, FRI
• Why ZK matters: privacy and scalability
• ZK rollups: ZKsync, Starknet, Scroll, Linea, Polygon zkEVM, Taiko
• zkVMs: Risc Zero, Succinct SP1, Lagrange, Polyhedra, Boundless, Nexus
• ZK coprocessors: Axiom, Brevis, Lagrange
• zkML: verifiable AI inference
• Privacy: Aztec, Penumbra, Aleo, Mina, Zcash, Tornado Cash
• Identity and proof-of-personhood: World ID, Polygon ID, Anima, Holonym
• ZK research labs and standards bodies
• Hardware acceleration: Cysic, Ulvetanna, Ingonyama
• Recursion and folding: Nova, Plonky2/3
• Cairo, Sumcheck, Halo2 and emerging proving stacks
• Real-world use cases
• Risks: trusted setup, prover centralization, audit complexity
• The future: ZK everywhere
• FAQ
• Glossary
• Related reading
• Sources and further reading

What is a zero-knowledge proof?

A zero-knowledge proof (ZKP) is a cryptographic protocol that lets a prover convince a verifier that a statement is true while revealing nothing else — not why it is true, not what data was used to prove it, only the fact of its truth. The classical analogy: imagine proving you know the password to a safe without saying what the password is. Or proving you are over 18 without revealing your date of birth. Or proving a rollup correctly executed a million transactions without making the verifier re-execute any of them.

Concretely, a ZKP system involves a prover who holds a witness (the secret data — e.g. the password, the transaction list, the model weights), a public statement (the claim — e.g. "I know the password to this hash", "this state root is the result of these transactions"), and a verifier who runs a short verification algorithm on the prover's output and accepts or rejects.

A valid ZKP system has three properties:

• Completeness — an honest prover with a valid witness convinces the verifier with overwhelming probability.
• Soundness — a cheating prover without a valid witness cannot convince the verifier except with negligible probability.
• Zero-knowledge — the verifier learns nothing about the witness beyond the truth of the statement.

In modern blockchain ZKPs we add two further desiderata: succinctness (the proof is much smaller than the witness — bytes or a few KB versus megabytes of computation) and non-interactivity (a single proof message, no back-and-forth — making proofs publishable on-chain).

Common terms: prover, verifier, witness, soundness, completeness

• Prover — the party that generates the proof, knowing the witness.
• Verifier — the party that checks the proof; in blockchains usually a smart contract.
• Witness — the secret input to the computation (private state, model weights, password).
• Public input — the data both prover and verifier see (state roots, transaction commitments).
• Circuit — the arithmetic representation of the computation being proved.
• Trusted setup — a one-time ceremony to generate proving/verifying keys; if compromised it allows fake proofs (Groth16); zk-STARKs eliminate this.
• Recursion — proving the validity of one proof inside another, enabling proof aggregation.
• Folding — a recursion variant (Nova, ProtoStar) that incrementally accumulates computation.
• MSM / NTT — multi-scalar multiplication and number-theoretic transform — the dominant compute kernels in proving.
• Cairo — the StarkWare Turing-complete language for STARK-friendly programs (used by Starknet).
• zkEVM — a virtual machine that proves Ethereum-compatible execution.

History of ZK: from 1985 to 2026

• 1985 — Goldwasser, Micali and Rackoff publish "The Knowledge Complexity of Interactive Proof Systems" — the foundational paper introducing the concept.
• 1988 — Blum, Feldman and Micali introduce non-interactive zero-knowledge (NIZK) in the common reference string model.
• 2010 — Groth presents the first practical pairing-based zk-SNARK.
• 2013 — Pinocchio (Microsoft Research) makes SNARKs deployable.
• 2014 — Zerocash paper by Ben-Sasson et al; Zcash launches in 2016 as the first privacy coin using zk-SNARKs.
• 2016 — Groth16 published, becomes the workhorse SNARK for Zcash, Tornado Cash and early ZK rollups.
• 2018 — Eli Ben-Sasson founds StarkWare and publishes the STARK paper, eliminating trusted setup.
• 2019 — Aztec PLONK paper (Ariel Gabizon, Zac Williamson) introduces universal trusted setup.
• 2019 — Aztec Network launches first ZK privacy rollup.
• 2020 — StarkEx launches on Ethereum (used by dYdX, Immutable, Sorare).
• 2020 — Halo paper (Bowe, Grigg, Hopwood) eliminates trusted setup for SNARKs via recursion.
• 2022 — Plonky2 (Polygon Zero) — fast STARK-style recursion.
• 2022 — Nova (Carnegie Mellon, Microsoft) — incremental folding scheme.
• 2023 — ZKsync Era, Polygon zkEVM, Linea, Scroll all launch mainnet zkEVMs.
• 2024 — Risc Zero, Succinct SP1 zkVMs go GA; zkML production-grade.
• 2024-2025 — ZK ASIC tape-outs (Cysic, Ingonyama).
• 2025-2026 — Recursive proof aggregation, prover decentralization, ZK coprocessors at scale.

zk-SNARKs vs zk-STARKs vs Bulletproofs

zk-SNARKs (Succinct Non-interactive ARguments of Knowledge) have tiny proofs and constant-time verification but rely on elliptic-curve pairings — making them vulnerable to a future quantum computer. Groth16 (2016) needs a per-circuit trusted setup; PLONK (2019) needs a universal trusted setup; Halo2 (2020) eliminates trusted setup via recursion at the cost of larger proofs.

zk-STARKs (Scalable Transparent ARguments of Knowledge), pioneered by Eli Ben-Sasson at StarkWare, use only collision-resistant hash functions (e.g. Rescue, Poseidon, Keccak) and FRI (Fast Reed-Solomon Interactive Oracle Proofs of Proximity) — making them transparent (no trusted setup) and post-quantum secure. Proofs are larger but proving scales better for huge computations.

Bulletproofs, designed by Stanford and UCL researchers in 2017, are non-interactive proofs without trusted setup, optimal for short range proofs (used by Monero) but not succinct enough for general computation.

Proving systems: Groth16, PLONK, Halo2, Plonky2/3, FRI

• Groth16 (Jens Groth, 2016) — fastest verifier among SNARKs (~3 pairings), per-circuit trusted setup. Used by Tornado Cash, Zcash Sapling, early ZK rollups.
• PLONK (Gabizon-Williamson-Ciobotaru, 2019) — universal-and-updatable trusted setup; one ceremony per circuit-size class. Used by Aztec, Mina, zkSync Lite, Snarky.
• Halo2 (Electric Coin Co, 2020) — KZG-based PLONKish system, no trusted setup via recursion; used by Zcash Orchard, Scroll, Polygon zkEVM and many rollups.
• Plonky2 / Plonky3 (Polygon Zero, 2022-2024) — STARK-style recursive system optimised for x86 proving speed.
• FRI — the polynomial commitment scheme inside STARKs, also adopted by zkVMs (Risc Zero, Succinct SP1) for transparent post-quantum proofs.
• Spartan, HyperPlonk, Jolt — newer generations exploring linear-time provers and lookup-friendly designs (the a16z Jolt paper introduced a new approach using sumcheck and lookup tables).

Why ZK matters: privacy and scalability

ZK gives blockchains two superpowers nothing else does:

1. Scalability without honesty assumptions — the L1 verifier checks one short proof to gain certainty over millions of off-chain transactions. ZK rollups scale Ethereum effective throughput 50-1000x at fractional gas cost relative to L1.
2. Privacy with verifiability — a user can keep transaction amounts, balances and identities private while still proving they followed the rules (no double-spend, no insolvent withdrawal). This is the missing piece that public ledgers like Ethereum lack natively.

ZK also unlocks trust-minimised cross-chain communication (light clients), verifiable AI (zkML), on-chain credit and reputation (with private inputs), verifiable randomness (without VRFs), and regulator-friendly compliance (proving sanctioned-address absence without revealing graph data).

ZK rollups: ZKsync, Starknet, Scroll, Linea, Polygon zkEVM, Taiko

• ZKsync Era — built by Matter Labs (founder Alex Gluchowski), the most-used zkEVM by transaction count in 2025-2026. Custom VM (zkEVM with extensions). ZK Stack and the Elastic Network enable many sovereign hyperchains.
• Starknet — built by StarkWare using Cairo VM and STARKs. Highest peak throughput per zk rollup; Starknet Foundation governs the network. Starknet Stack and Madara power third-party Starknet appchains.
• Scroll — bytecode-equivalent zkEVM (Type 2 in Vitalik's taxonomy), built by Scroll Labs. Strong developer-experience focus.
• Linea — zkEVM rollup by Consensys, tightly integrated with MetaMask and Infura. Governed by the Linea Association.
• Polygon zkEVM — zk EVM equivalent rollup, part of Polygon's AggLayer interoperability stack.
• Taiko — based-rollup variant; Taiko Alethia, Taiko Hekla; "Type-1" full Ethereum equivalence.
• Cronos zkEVM, Immutable zkEVM, Sophon, Lens Network, Treasure, GRVT — sovereign ZK chains built on ZK Stack or Polygon CDK.

zkVMs: Risc Zero, Succinct SP1, Lagrange, Polyhedra, Boundless, Nexus

A zero-knowledge virtual machine generalises proving: instead of writing a circuit per application, developers compile any program (often Rust) to a target ISA (typically RISC-V) and the prover generates a ZK proof of correct execution.

• Risc Zero zkVM — the pioneering general-purpose zkVM, RISC-V over STARKs with a Bonsai proving service. Powers a growing share of zk-coprocessor and zkML workloads.
• Succinct SP1 — open-source RISC-V zkVM by Succinct Labs; 2024-2025 saw rapid speedups via Plonky3 and dedicated lookup arguments. Uses a decentralized prover network (Succinct Prover Network).
• Lagrange ZK Coprocessor — combines a zkVM with state-committee proofs of cross-chain storage.
• Polyhedra Network — Expander prover, ZK-bridge across 20+ chains, ZKJ as native token.
• Boundless — Risc Zero's network-of-provers product launched in 2025 for decentralized proof generation.
• Nexus zkVM — academic spin-out building a folding-based RISC-V zkVM.
• Polygon Miden — STARK-based VM with native asset model; in mainnet rollout 2026.
• Cairo VM — Starknet's first-mover Turing-complete language for STARK-friendly proving.

ZK coprocessors: Axiom, Brevis, Lagrange

A ZK coprocessor proves off-chain computation about on-chain data, returning a verifiable result that smart contracts can consume cheaply.

• Axiom — historical Ethereum state queries (e.g. "what was Vitalik's USDC balance at block 18m?") with succinct proofs.
• Brevis — programmable analytics across chains, with ZK proofs over event logs and cross-chain state.
• Lagrange Labs — state-committee proofs (light clients) plus a SQL-friendly zk-coprocessor for cross-chain data queries.

Use cases include governance vote-weighting based on long historical balances, MEV-aware DEX routing, on-chain credit scoring, and trust-minimised cross-chain messaging.

zkML: verifiable AI inference

zkML proves that a specific ML model produced a specific output for a specific input — without revealing the model weights, the input, or both.

• EZKL — open-source Rust toolkit that takes ONNX models and generates ZK circuits; the most-used zkML stack.
• Modulus Labs — verifiable on-chain ML inference for DeFi (oracle-resistant pricing, RockyBot, Worldcoin-orb proof-of-personhood ML).
• Giza, Inference Labs, Vanna Labs — competing zkML rollup and inference services.
• zkML on zkVMs — Risc Zero and SP1 increasingly used as general-purpose zkML stacks for transformer-scale models.

The biggest 2025-2026 advance is order-of-magnitude prover speedups making transformer inference verifiable, opening up regulator-grade AI provenance attestation.

Privacy: Aztec, Penumbra, Aleo, Mina, Zcash, Tornado Cash

• Aztec Network — privacy-first zkRollup with PLONK and a hybrid public/private VM (Aztec mainnet relaunch 2025). Built by Aztec Labs.
• Penumbra — Cosmos-IBC privacy chain with shielded staking, swaps and governance.
• Aleo — privacy L1 with Leo programming language and decRand mainnet (2024); built by Aleo Network Foundation.
• Mina Protocol — fixed 22 KB blockchain via recursive SNARKs (Mina Foundation); zkApps for verifiable web2 attestation.
• Zcash — original ZK privacy coin; shielded pools (Sapling, Orchard) and the ZSA framework for privacy-preserving assets.
• Tornado Cash — Ethereum mixer using Groth16; OFAC sanctioned August 2022; partial sanctions overturn November 2024; Roman Storm criminal trial ongoing.
• Railgun, Nocturne, Privacy Pools — newer 2024-2026 privacy primitives that combine ZK with selective disclosure to navigate regulatory pressure.

Identity and proof-of-personhood: World ID, Polygon ID, Anima, Holonym

• World ID — Worldcoin's proof-of-personhood credential, registered through the Orb iris scanner; ZK proofs (Semaphore-style) prove uniqueness without revealing identity. More than 12 million verified humans by 2026 despite bans in Brazil, Spain, Hong Kong, Portugal and Kenya. The project rebranded to World in October 2024 and launched World Chain L2.
• Polygon ID — self-sovereign identity using Iden3 ZK protocol on Polygon.
• Anima Protocol — modular ZK identity with KYC/POP credential adapters.
• Holonym — privacy-preserving SBT identity with Government-ID, phone and uniqueness proofs.
• zk-Email — proves DKIM-signed emails on-chain without revealing content; powers ZK proof of "I own gmail X" or "I received this OTP" credentials.
• zk-x509 — proves possession of a TLS certificate without revealing it.

ZK research labs and standards bodies

• Espresso Systems — shared sequencer with HotShot consensus + ZK fraud proofs; Espresso DA data availability.
• =nil; Foundation — research consortium building zkLLVM and Proof Market.
• Geometry — applied ZK research lab (rollups, FHE-ZK, recursive systems).
• Privacy & Scaling Explorations (PSE) — Ethereum Foundation team building Halo2, Semaphore, MACI.
• Electric Coin Co — original Zcash team, Halo2 and Orchard authors.
• L2BEAT — public-good research on ZK rollup security models.

Hardware acceleration: Cysic, Ulvetanna, Ingonyama

• Cysic — first ZK-ASIC company; CSC-1 and CSC-2 chips for MSM/NTT acceleration; FPGA proving boards in production.
• Ulvetanna — FPGA proving infrastructure for zk rollups, particularly STARK-heavy workloads.
• Ingonyama — ICICLE library on NVIDIA + AMD GPUs; the most-used GPU acceleration kernel in the ecosystem.
• Snarkify, Gevulot, Fabric Cryptography — emerging hardware-and-network providers.

Recursion and folding: Nova, Plonky2/3

Recursion (proving the validity of one proof inside another) and folding (incrementally accumulating computation into a running instance) are the two techniques that drive proving cost per transaction down. Halo2 and Plonky2 popularised recursion in production. Nova (CMU + Microsoft, 2022) introduced folding via incremental verifiable computation; HyperNova and ProtoStar are the 2024-2025 successors. Folding is particularly important for zkVMs because it lets you accumulate a long execution trace at near-linear prover cost.

Cairo, Sumcheck, Halo2 and emerging proving stacks

• Cairo — StarkWare's Turing-complete language for STARK-friendly programs. Used by Starknet, Paradigm Reth-on-Cairo experiments, and dYdX v3.
• Sumcheck — interactive proof technique used by Spartan, Lasso and Jolt for dramatically lower prover cost on lookup-heavy circuits.
• Halo2 — KZG-based PLONKish system, tooling-rich Rust ecosystem.
• Plonky2/3 — Polygon's recursive proving system, increasingly used as backend for zkVMs and rollups.

Real-world use cases

1. ZK rollup execution (the dominant ZK use case by gas burned) — every L2 transaction on ZKsync Era, Starknet, Scroll, Linea or Polygon zkEVM relies on ZK.
2. Worldcoin proof-of-personhood for human-vs-bot gating.
3. USDC proof-of-reserves via DECO (Circle + Chainlink) — proves USDC reserves match issuance using TLSNotary/DECO.
4. On-chain MEV-resistant execution — encrypted mempools (Shutter), fair-ordering rollups, ZK threshold encryption.
5. Private DeFi — Aztec's private DEX and lending; Penumbra's shielded Cosmos DEX.
6. Cross-chain light clients — Polyhedra, zkBridge, Succinct's bridge applications.
7. zkML-attested AI inference for regulator-friendly model provenance.
8. Email & web2 attestations via zk-Email (proof of "I own this email", "I received this OTP").

Risks: trusted setup, prover centralization, audit complexity

• Trusted setup (Groth16, classic PLONK) — if the toxic waste from the ceremony is not destroyed, an attacker can produce fake proofs. Multi-party computation ceremonies (e.g. Powers of Tau, Aztec Ignition) mitigate but do not eliminate the risk. Halo2 and STARKs avoid this entirely.
• Prover hardware centralization — high-end ZK proving requires GPUs/FPGAs that cost tens to hundreds of thousands of dollars per node. Decentralized prover markets (Succinct Network, Boundless, Gevulot, =nil; Proof Market) aim to mitigate.
• Circuit/proof-system audit complexity — ZK circuits are notoriously hard to audit. Several real-world bugs (most famously the Tornado Cash governance circuit bug 2023, the Aztec Plonk vulnerability disclosed mid-2024, ZKsync Era's airdrop vulnerability) underline the depth of the problem. Specialist auditors (Veridise, Zellic, Spearbit, ConsenSys Diligence ZK team) are scarce.
• Post-quantum migration risk — protocols that locked into pairing-based SNARKs face a multi-year migration to STARKs or lattice-based SNARKs.
• Prover liveness / DoS — if a single sequencer's prover goes down, the rollup cannot finalize even though the L1 light client is still safe.

The future: ZK everywhere

The 2026-2030 trajectory points to ZK being woven into nearly every layer of crypto and regulator-facing fintech:

• All major L2s are ZK or migrating ZK-ward (even optimistic rollups are adopting ZK fraud proofs).
• Decentralized prover networks monetize idle GPU/FPGA capacity.
• Verifiable AI inference (zkML) becomes a regulator-required artifact for high-stakes model deployment.
• Sovereign ZK appchains via ZK Stack, Starknet Stack, Polygon CDK, and Taiko's based-rollup framework.
• ZK + FHE + MPC convergence — combining zero-knowledge with fully-homomorphic encryption and secure multi-party computation for computation-on-encrypted-state.
• Mainnet-grade post-quantum cryptography is shipped well before quantum threats are practical (consistent with the a16z paper on quantum and blockchains).

FAQ

What is a zero-knowledge proof?

A cryptographic protocol that lets a prover convince a verifier of a statement's truth without revealing why. It satisfies completeness, soundness and zero-knowledge — formalised by Goldwasser, Micali and Rackoff in 1985.

What is the difference between zk-SNARKs and zk-STARKs?

SNARKs produce tiny pairing-based proofs but often need a trusted setup. STARKs are transparent, hash-based and post-quantum, with larger proofs.

What is a ZK rollup?

A Layer 2 chain that batches transactions and posts a ZK proof of correct execution to L1. Examples: ZKsync Era, Starknet, Scroll, Linea, Polygon zkEVM, Taiko.

What is zkML?

Zero-knowledge proofs of ML inference. Leading projects: EZKL, Modulus Labs, plus zkVM-based stacks on Risc Zero and SP1.

What are ZK coprocessors?

Services that prove arbitrary off-chain computation about on-chain data. Major projects: Axiom, Brevis, Lagrange.

What is Worldcoin and how does it use ZK?

Proof-of-personhood project using iris scans and a ZK-backed World ID. Rebranded to "World" in October 2024.

Was Tornado Cash a ZK protocol?

Yes — a Groth16-powered Ethereum mixer; OFAC sanctioned August 2022 (sanctions partly overturned November 2024).

What is Risc Zero zkVM?

A general-purpose RISC-V zkVM that proves correct execution of arbitrary programs.

What is the post-quantum risk for ZK?

Pairing-based SNARKs are vulnerable; STARKs and lattice-based ZK are believed safe. The industry is migrating to hash-based proving systems.

What hardware accelerates ZK proving?

GPUs (Ingonyama ICICLE), FPGAs (Cysic, Ulvetanna), and emerging ZK ASICs.

Glossary

• ZKP — zero-knowledge proof.
• SNARK — Succinct Non-interactive ARgument of Knowledge.
• STARK — Scalable Transparent ARgument of Knowledge.
• zkEVM — virtual machine that proves Ethereum-compatible execution.
• zkVM — generic zero-knowledge virtual machine (Risc Zero, SP1).
• MSM — multi-scalar multiplication, the dominant SNARK-prover kernel.
• NTT/FFT — number-theoretic transform / fast Fourier transform.
• FRI — Fast Reed-Solomon Interactive Oracle Proof of Proximity (STARK ingredient).
• Trusted setup — one-time ceremony for proving/verifying keys.
• Recursion — proving a proof inside another proof.
• Folding — incremental accumulation of proofs (Nova).
• Bulletproofs — non-interactive ZK proofs without trusted setup, used by Monero.

Related reading

• Ethereum Layer 2 Networks 2026 Guide
• What is Ethereum? 2026 Guide
• AI + Crypto: Decentralized AI 2026 Guide
• Smart Contract Audits Explained 2026 Guide
• Blockchain Consensus PoW vs PoS 2026
• What is DeFi? 2026 Guide
• Stablecoins Explained 2026 Guide

Sources and further reading

• ZKsync — https://zksync.io
• StarkWare — https://starkware.co
• Scroll — https://scroll.io
• Linea — https://linea.build
• Polygon zkEVM — https://polygon.technology/polygon-zkevm
• Taiko — https://taiko.xyz
• Aztec — https://aztec.network
• Aleo — https://aleo.org
• Mina — https://minaprotocol.com
• Zcash — https://z.cash
• Risc Zero — https://risczero.com
• Succinct — https://succinct.xyz
• Axiom — https://www.axiom.xyz
• Brevis — https://www.brevis.network
• Lagrange — https://lagrange.dev
• EZKL — https://ezkl.xyz
• Modulus Labs — https://www.modulus.xyz
• Worldcoin — https://worldcoin.org
• zk-Email — https://prove.email
• PLONK paper (eprint 2019/953) — https://eprint.iacr.org/2019/953
• Groth16 — https://eprint.iacr.org/2016/260

About the author

DeFi Intel Research is the in-house research team at DeFi Intel, focused on on-chain capital markets, MEV, ZK infrastructure, and verifiable AI. We track the entire ZK proving stack — proof systems, zkVMs, zkML, ZK coprocessors and hardware acceleration — across mainnet deployments.

Last updated: 2026-04-26