A brief history of Ethereum and ZK

Author: Donovan Choy, Blockworks; Translator: Wuzhu, Golden Finance

It all started with Ethereum. L1 was too slow. Every node needed to redundantly re-execute transactions in the block to ensure validity, which limited scalability.

By 2020, the Ethereum community coalesced around rollups as a scaling solution. Vitalik's landmark blog post on rollups in 2021 explained how optimistic and zk rollups scale Ethereum.

Zk rollups have technical advantages in terms of scaling, but the technology is still too expensive and far behind (more on that later).

So, optimistic rollups broke into the market first. Optimistic rollups assume that all transactions are valid until someone challenges them with a fraud proof within a seven-day challenge period.

Optimistic rollups work, but they have hidden costs. The challenge period means that users need longer transaction finality time before they can withdraw their funds. Locking up liquidity means capital efficiency and generally poorer user experience, especially when it comes to chain interoperability.

Meanwhile, zk is catching up. At ETHCC 2022, Polygon, zkSync, and Scroll all announced the zkEVM, which enables Solidity developers to write code and prove execution of the EVM — effectively letting Ethereum leverage zero-knowledge technology.

In 2023, zk rollups start to really gain traction.

Why are zk proofs better than optimistic fraud proofs? Namely, because zk proofs are much smaller (~1-10 KB) compared to the raw transaction data (megabytes in size).

By using zk cryptography to prove Ethereum transactions, these highly compressed proofs mean lower data availability costs and better scalability.

While zk is taking off, the cost of generating proofs remains high. According to zkstats.io, the average cost of generating a zk proof in December 2023 was $80.21.

Fast forward to 2025. Proof costs have dropped to $1.30 per proof, an improvement of about 98.4%.

What’s Changed?

Today, every core part of the zk rollup stack has been broken down.

First, zkVMs are available. These specialized virtual machines speed up the zk development experience and make validity proof generation more efficient. Before zkVM, developers needed to write complex mathematical "circuits" to prove the execution of the EVM.

Today, ZkVMs such as SP1, RISC Zero, Nexus, and OpenVM effectively democratize zk development to all developers (C++, Rust) who do not have zk crypto expertise. In the past, zkEVM only enabled Solidity development on zk rollups. Think of zkVM as a more general concept than zkEVM.

Second, the cost of generating proofs is going down due to market competition. Today, there are many competitive markets operated by Risc Zero, Cysic, Lagrange, and Succinct. Some are still in testnet, and some are in production.

Zk L2 is also moving to proof aggregation technology to amortize the verification cost. It roughly works by batching multiple proofs into one, making the final proof faster to verify.

These markets are also permissionless, meaning anyone with a GPU device can sign up, post a bond, and generate zk proofs. Previously, zk rollups used "centralized provers", meaning they rented GPU/FPGA hardware from Google or Amazon.

Better proof systems are also being introduced all the time. These proof systems (e.g.: Groth16, Halo2-KZG, STARK, Plonk, Expander) algorithmically define rules for how zk proofs are constructed and verified. They are getting better, which means zk proofs are getting smaller and faster to verify. This in turn means zkVM performance increases.

Finally, there are zk coprocessors built on top of the zkVM. These things essentially allow on-chain applications that do not exist in the zk execution environment to leverage the wonders of zk technology. The way it does this is by moving the computation off-chain, so it runs asynchronously to the blockchain's execution. This enables applications to compute complex statistics off-chain, prove it with zk, and then publish that proof on-chain.

Apps like Frax, Azuki, Etherfi, and Gearbox are using Lagrange’s zk coprocessor to circumvent Ethereum L1 limitations.

So you get the idea. This is why zk is the end goal.