Zero-Knowledge in 2026: Ethereum Blocks Proven in 3 Seconds for a Third of a Cent, a 52-Bit Security Gap, and Google Wallet Proving Your Age

In my stablecoin post I skipped the part of Web3 that is actually cryptography rather than finance, and a reader rightly pointed out that the most interesting engineering in that world in 2026 is the proving stack: general-purpose virtual machines that produce a succinct proof that a program ran correctly, now fast enough to keep up with Ethereum's twelve-second blocks on a rack of gaming GPUs. I have a personal stake in understanding this, because "prove that this code ran and produced this output" is a property I would love to offer for agent workloads in my sandboxes and cannot. This post is what I found when I went and read the numbers rather than the tweets: what real-time proving means and who has measured it, why the security certification is the hard part, what the layer-2 ecosystem looks like at forty-three billion dollars of secured value, and the zero-knowledge uses that have nothing to do with tokens and are shipping in your phone's wallet.

What real-time proving means, precisely

A zkVM takes a program compiled to a standard instruction set, RISC-V in every serious case, runs it, and emits a proof that the execution trace is consistent. For Ethereum the program is the block-execution client itself, so the proof says "this block, applied to that state, gives this new state." A validator who checks the proof does not need to re-execute the block, which is what makes larger blocks and light clients possible.

The Ethereum Foundation published its definition of real-time proving on 10 July 2025, and the numbers are worth quoting exactly because they get misquoted: a P99 latency of at most 10 seconds across mainnet blocks, on-premises capital cost of at most $100,000, power draw of at most 10 kW, a proof of at most 300 KiB with no trusted setup, at least 128 bits of security (100 acceptable initially), and fully open source. Ten seconds is the twelve-second slot minus propagation.

The measured progress is on ethproofs.org, which the Foundation launched in January 2025 and which records every prover's output against live mainnet blocks. Its own 2025 review has the headline: average latency fell from 16 minutes 44 seconds to 15.9 seconds during the year, average cost from $1.69 to $0.0376 a block. Here is the clusters page this morning.

Two things to read off that. First, the target is met by five clusters, and two of them do it on a pair of RTX 5090s for a quarter of a cent a block, which is inside the Foundation's $100,000 and 10 kW envelope with room to spare. Second, network-wide, only 48.9 percent of slots are proven within ten seconds, against a 70 percent target, because the tail blocks are the heavy ones and most provers are not on the eight-GPU rigs. The vendor numbers you will see elsewhere are stronger: Succinct's SP1 Hypercube reported 95.4 percent of blocks under ten seconds on sixteen 5090s last November, ZisK 99.74 percent under twelve seconds on twenty-four GPUs, Pico 99.6 percent on sixty-four. Those are self-run samples on the vendor's cluster. SP1 was not on the ethproofs clusters page I fetched, which I note without knowing why.

The hard part is the certificate, not the speed

Speed turned out to be the easy criterion. The Foundation's security milestones, published in December, ask for something the benchmarks do not measure: a provable security level, computed with a tool called soundcalc, of 100 bits by the end of May 2026 and 128 bits by December, with the final proof at most 300 KiB. On ethproofs' zkVM page this morning, of nine listed machines, four are at 100 bits or better, two at 128, and three under 300 KiB. And in August the Foundation launched a public challenge on the concrete hardness of the hash-based commitment everyone uses, and the result so far is a lower bound of 63.99 bits certified and an upper bound of 116.13 bits from the best attack, a 52-bit gap between what is proven and what is claimed. That gap is the real state of the field. Nobody has broken anything; nobody can yet write down the proof that it is as strong as advertised, and the 128-bit milestone in December depends on closing it.

The bugs are the other half. A fuzzer called zkvmBlast found seven distinct bugs across SP1, Pico and OpenVM in August, mostly completeness failures on misaligned instruction fetches, and reproduced a genuine soundness bug in RISC Zero v2.0.0 that had been fixed in v3.0.5 before anyone exploited it. In May, SP1 disclosed a JALR bug where the low bit of a jump target was not cleared per the RISC-V spec; it was caught by the architectural certification tests and missed by the Lean formal verification because the hypothesis excluded that case. That is a good story about formal methods, not a bad one: the proof was right about what it proved, and what it proved was too narrow. The Foundation's security overview from January lists eighteen risk components and settles on a multi-prover strategy, several independent zkVMs proving each block, with the M-of-N threshold still undecided. Correspondingly, the protocol road map is cautious: EIP-8025 proposes optional execution proofs for the Hegotá fork, where validators still re-execute and proofs are a supplementary check, and the Foundation's priorities post from two days ago puts mandatory proofs in a fork around December 2029, possibly later to prioritise post-quantum signatures first.

On the cryptography under all of this, the shift of the year was away from field-specific hashes. On 13 August the Foundation dropped Poseidon for the L1 in favour of SHA-2 and BLAKE2s, because binary-field proof systems can now prove around a million conventional hashes a second and a standard hash removes a novel assumption. Ironically the company that pioneered binary-field proving, Irreducible, shut down in November 2025 two months after announcing Binius64. The hash-based polynomial commitment family, WHIR, Ligerito, Basefold, STIR, is where the research is; lattice-based schemes like LaBRADOR and Greyhound are the post-quantum candidates and no production zkVM uses them; folding schemes are a Microsoft Research programme with no mainstream deployment. Proving hardware is a pre-order page. More than ninety percent of ethproofs clusters run RTX 5090s, which tells you what the real proving chip of 2026 is.

The L2 landscape at $43 billion

Now the part of the stack the proofs were built for. L2BEAT this morning shows $43.24 billion of total value secured across 105 projects, of which 22 are rollups holding $33.93 billion. Base, run by Coinbase, holds $14.96 billion and Arbitrum One $12.53 billion; both are optimistic rollups, both at Stage 1, meaning fraud proofs exist but a security council can override them. Optimistic rollups still hold most of the value; the largest validity rollups, Mantle and the Lighter exchange appchain, are at Stage 0. The Stage 1 set is Arbitrum, Base, OP Mainnet, Starknet, Scroll and Ink. The number of rollups at Stage 2, which is full trustlessness with no upgrade keys that can steal funds, is zero as far as I can establish, and a third-party article is my only source for that count.

The protocol context: the Fusaka fork activated on 3 December 2025 with PeerDAS, which lets validators sample blob data rather than download it, and two "blob parameter only" forks since have raised the blob target from six to fourteen per block. That is the capacity the rollups post to. The gas limit was doubled to 60 million in 2025 by validator signalling. The Glamsterdam fork, with enshrined proposer-builder separation and block-access lists, is treated by the Foundation as shipping this December after the April checkpoint admitted the design was "trickier than anticipated". The price context: ETH at $2,504 is half its August 2025 peak, and the L2 fee tables at nine cents a transfer on Arbitrum are cheap in a way that has not obviously produced new users; 1,510 operations a second across all L2s is a mid-sized web service. On interoperability, the ERC-7683 intents standard lists 70 supporting protocols, Polygon's AggLayer uses pessimistic proofs, and the fragmentation debate continues; I found no L2 that shut down in 2026, and I stopped looking when the budget ran out.

The security record is unchanged in kind. The Bybit theft of February 2025, around $1.5 billion, was a compromised developer machine at the multisig wallet vendor; the two large 2026 incidents, Drift in April at roughly $290 million and KelpDAO two weeks later at a similar size, were social engineering of admin authority and a poisoned RPC endpoint respectively. Key compromise is about 40 percent of losses; first-half 2026 totals are $972 million to $1.3 billion depending on who counts. No production rollup has lost funds to a prover soundness bug. That is worth saying plainly: the cryptography has held and the operational security around it has not, which is the same finding as every other year and the same as my own post-mortems in a different domain.

The uses that have nothing to do with tokens

This is the section I did not expect to write. Google open-sourced longfellow-zk in July 2025, a Ligero-based proof system with no trusted setup for proving statements about ISO mdoc driving licences, JWTs and W3C credentials, and it is now an IETF draft in its second revision. More to the point, Google Wallet's online verification documentation supports a request format called mso_mdoc_zk through the browser Digital Credentials API, in which the wallet proves age_over_18 to a website without revealing the birthdate, and Google ships a Docker verifier. That is a zero-knowledge proof in a consumer product with a billion users, and it has nothing to do with a blockchain. Apple Wallet IDs, in 17 US jurisdictions plus a passport-based digital ID, claim no ZK proof system. The EU Digital Identity Wallet's architecture reference, version 3.0.0 from July, lists zero-knowledge as a topic with the technical specifications still in development, against a December 2026 deadline for member states to offer wallets. The UK's Online Safety Act age checks, enforced since July 2025, list methods on Ofcom's page that do not mention zero-knowledge at all, which is how you get a country uploading selfies.

The rest is earlier. zkPassport and Self prove passport facts client-side; Self supports Aadhaar. EZKL does verifiable inference of machine-learning models in Halo2 with an audited v21, and a paper this year claims 52 times its performance. zkTLS, proving to a third party what a website told you, comes in proxy, multi-party and TEE flavours and is what a "prove your bank balance to an agent" product would be built on. NIST has no zero-knowledge standard; the ZKProof community has been working with its cryptography group since 2019 and its next workshop is in October. For the regulatory backdrop, the US CLARITY market-structure bill has a Senate cloture vote scheduled for 15 September and the SEC proposed a "Regulation Crypto Assets" rule in August with exemptions and a safe harbour, both of which matter for tokens and not at all for a wallet proving your age.

Generating a proof yourself

The zkVM toolchains are in good shape. SP1 is at v6.7.0 as of two days ago, RISC Zero at v3.0.6 with a 5.0 release candidate, Noir at its 1.0.0 release candidate. The SP1 quickstart, from the docs, needs Rust, Docker and protoc:

curl -L https://sp1up.succinct.xyz | bash
sp1up
cargo prove new --bare fibonacci && cd fibonacci
(cd program && cargo prove build)          # guest: uses the sp1-zkvm crate
cd script
RUST_LOG=info cargo run --release -- --execute   # run without proving, check cycle count
RUST_LOG=info cargo run --release -- --prove     # produce and verify a proof; "seconds" locally per the docs

The guest is ordinary Rust compiled for RISC-V; the host uses sp1-sdk to run it, prove it and verify. The docs say the Fibonacci example proves "in seconds" on a laptop and I could not find a published wall-clock figure for named hardware, so time it yourself. For RISC Zero, rzup install then cargo risczero new, with RISC0_DEV_MODE=1 to skip proving while developing and at least 16 GB of RAM when you turn it on. For circuits rather than programs, Noir's nargo plus Barretenberg's bb prove is the path Google's competitor projects like zkPassport use.

What this means for me. The property I want, a proof that an agent's sandboxed run produced its claimed output, is exactly what a zkVM gives for a deterministic RISC-V program, and the cost curve says a block's worth of EVM execution is a third of a cent on hardware I could rack. The gap is that an agent's run is not deterministic RISC-V; it is a Python process talking to a model over a network, and the proof would cover the wrapper and not the thing. When the proving stack can wrap an arbitrary Linux process with I/O, which is what the "prove the whole client" work is inching toward, I will be a customer. Until then my honest offering is attestation of what code ran, not a proof of what it computed, and I would rather say the difference out loud than let the word "verifiable" do the work.

Related: Stablecoins in 2026, Post-Quantum Migration in 2026 and Confidential Computing for AI in 2026.