On November 2 at 00:00 Beijing time, 27,958,000 ZAMA tokens will leave their vesting contracts and become liquid. A secondary data aggregator called RootData has valued the event at approximately $19,150,000. Divide one number by the other and you get $0.685 per token. The arithmetic is clean. Everything stacked on top of it is not.
Here is the anomaly worth your attention. The announcement gives you quantity, dollar value, and a timestamp. It does not give you circulating supply. It does not give you total supply. It does not tell you whether those 27.9 million tokens belong to the team, to early investors, to a market maker, or to an ecosystem grant fund. Those are the only variables that determine whether this is a rounding error or a liquidation event. The math doesn't lie. But the math here has been handed to you with a hole in the middle, and almost everyone who reads the headline will fill that hole with a guess and call it analysis.
A supply shock you cannot size is not a signal. It is a calendar reminder wearing a trading signal's clothes. The market will treat it as the latter anyway.
Context: What Actually Happens on November 2
Let me set the mechanics before the opinion.
Zama is a cryptography infrastructure project. Its core primitive is fully homomorphic encryption, or FHE — computation performed directly on ciphertext, producing an encrypted result that decrypts to the correct answer without anyone ever seeing the plaintext along the way. This is a different technical lineage from zero-knowledge proofs, and the distinction matters. ZK proves a statement without revealing the witness. FHE computes on data without revealing the data. One is a verification technology. The other is a computation technology. Conflating them is the single most common error I see in privacy-sector research notes.
Zama's engineering bet is fhEVM: an EVM-compatible execution environment in which Solidity contracts can operate on encrypted state. If it works, a developer ports a contract to a privacy-preserving execution layer without rewriting the logic. That composability is the whole pitch. It is also the whole risk.
The project has crossed its token generation event. We know this for a simple reason: tokens exist and they unlock. A token that vesting-releases is a token that was generated. There is no research-phase project with a November cliff. The protocol has a live network or at minimum a running incentive testnet, and the token economy has begun to distribute.
The unlock is scheduled. That tells you the tokenomics timeline is public and programmable — almost certainly an on-chain vesting contract rather than a discretionary manual disbursement. This is a detail, and it will matter more than anything else in this article, so hold onto it.
The source is RootData. RootData is an aggregator, not a first-party announcement. It scrapes, normalizes, and republishes. That introduces two specific failure modes. First, transcription risk: the quantity and the timestamp can drift from the project's own schedule if the aggregator is slow to update. Second, valuation risk: the dollar figure is stamped at the time of data entry. If ZAMA trades down 30 percent between publication and the unlock, the realized value of the event is closer to $13.4 million than $19.15 million. Treat the dollar number as nominal, not realized. Every downstream calculation inherits that caveat.
Now the part the announcement refuses to address. What does FHE cost? In plain terms: three to six orders of magnitude over plaintext computation. Not a rounding error — a categorical one. A smart contract that runs an encrypted addition is not 10 percent slower than a plaintext addition. It is a thousand, a hundred thousand, sometimes a million times slower depending on the operation and the accumulator batching. That number is the entire business model of every FHE project, and none of the unlock calendars will ever mention it.
The setup is complete. Here is what the unlock actually means, measured against what the market thinks it means.
Core: The Implied Price Is a Mirror, Not a Metric
Start with the number everyone fixated on: $0.685 per token.
That is not a market price. It is a backward derivation from an aggregator's dollar figure divided by a token count. It tells you roughly where ZAMA was trading when RootData last refreshed its database. It tells you nothing about where ZAMA will trade on November 2, and it tells you nothing about what the token is worth. It is a mirror held up to the data-entry timestamp.
The more interesting question is what an implied price of $0.685 reveals about the project's own mental model. If the total supply is in the billions of tokens — and privacy infrastructure projects typically mint in the billions to accommodate decade-long emission curves — then a $0.685 unit price implies a fully diluted valuation in the tens of billions. For a network with no demonstrated commercial load, that is aggressive. It is the kind of FDV you can only justify with a narrative, not a balance sheet.
I have watched this exact pattern before. In 2021 I analyzed the ERC-721A implementation for a minting platform carrying a two-million-dollar budget, and I found a signature replay vulnerability in the public mint function that let a single attacker drain fifteen percent of capacity. The team patched it in forty-eight hours. The token still traded at a valuation that had no relationship to the security posture of the contract underneath it. Pricing and engineering were two separate universes, and the market spent months pricing the story instead of the code.
ZAMA is the same shape. The implied $0.685 is a story written by a data entry, not a discovery by the market. If you are trading the unlock, you are trading a valuation that was set by whoever filled the spreadsheet. That is not a foundation. That is a placeholder.
Core: The Denominator Problem
Now the hole in the middle.
Twenty-seven million, nine hundred fifty-eight thousand tokens. Is that a lot? The question is meaningless without a denominator. This is not a rhetorical flourish. It is the mechanical core of the entire event, and I want to walk through it slowly because the market keeps skipping this step.
Suppose total supply is ten billion. Then 27.9 million is 0.28 percent of supply. If ten percent of supply is circulating, the unlock is 2.8 percent of float. You can absorb that with a single large buyer. It is noise.
Suppose total supply is one billion. Then 27.9 million is 2.8 percent of supply. If twenty percent of supply is circulating, the unlock is fourteen percent of float. That is a real supply shock. If only ten percent is circulating, the unlock is twenty-eight percent of float. That is a liquidation disguised as a calendar entry.
Same tokens. Same dollar value. Three completely different market outcomes, spanning from irrelevant to catastrophic. The announcement distinguishes none of them, because it does not carry the divisor.
I want to be precise about what this means for anyone reading a headline. Every sell-pressure estimate you will see on social media is built on an assumed denominator. Some are honest and state it. Most are not, and they inherit whatever supply figure the author saw in a screenshot. The confidence interval on that estimate is not wide. It is unbounded, because the input is unknown.
This is where the discipline of a security audit transfers directly to token research. When I led the bridge audit during the 2022 deleveraging cascade, I found that the optimistic proof verification lacked a sufficient challenge period. Four critical high-severity issues, one of them a gas-limit exhaustion vector. The protocol shipped anyway. It lost five hundred thousand dollars. The investors who cited my report afterward did not cite a narrative. They cited a specific number — the challenge window in blocks — that mapped directly to an exploitability window. The lesson was not that the bridge was bad. The lesson was that the number that mattered was missing from the marketing and present in the code.
ZAMA's tokenomics has the same structure. The number that matters — circulating supply at the moment of unlock — is almost certainly calculable from public data or an on-chain read. It is just not in the announcement. Until you have it, you are not analyzing. You are guessing with extra steps.
Core: What an On-Chain Vesting Contract Actually Looks Like
The fact that the unlock is schedulable is a genuine signal, and it cuts both ways.
If the tokenomics timeline is enforced by an on-chain vesting contract, then the schedule is deterministic. The contract holds a balance. It releases by formula: linear vesting after a cliff, or a step function of tranches, or a time-weighted curve. An aggregator can read the contract state and predict the next release without asking anyone. That transparency is why RootData knew the number a week ahead. It is also why the schedule is already priced.
Let me be concrete about the mechanics, because this is where original research separates from rumor. A typical linear vesting contract exposes a released accumulator and a vested function of the form (totalAllocation * (now - startTime)) / (endTime - startTime), capped at the cliff. A cliff is just a discontinuous jump: before cliffTime, vested equals zero; after, vested jumps to the cliff tranche. The November 2 release of 27.9 million tokens is almost certainly a cliff boundary. The jump is discrete, not a slope.
That matters because a discrete jump is a category signal. Linear emissions drip out and hide their source. Cliffs release in blocks, and blocks belong to named beneficiaries. The receiving address is a label. If the 27.9 million lands in a wallet that is tagged as an investor vehicle, the sell pressure is investor-driven and historically aggressive. If it lands in an ecosystem treasury under a multisig, the pressure is softer and partly recoverable into grants. If it lands in a market-maker address, presume the tokens are already pledged to provide liquidity, which means they will hit the order book as a matter of function, not sentiment.
The vulnerable surface here is not the token. It is the vesting contract itself. Trust the code, verify the trust. I have seen vesting contracts with admin pause functions, with beneficiary-reassignment rights, with upgradeable proxies that let the deployer rewrite the release curve after the community has priced it in. A vesting contract that can be paused is not a commitment. It is a suggestion with a timestamp. Before you trade the unlock, read the beneficiary list and check whether the contract is upgradeable. If it is, the schedule you are pricing is not the schedule that will execute.
There is a second-order attack here that almost nobody prices. During the DeFi Summer of 2020, I ran custom Solidity simulations against yield aggregators looking for re-entrancy in the reward accounting, and I found a logic flaw in a farming contract that allowed effectively infinite token minting. The bug was not in the yield math. It was in the ordering of state updates relative to external calls. Vesting contracts are external-call surfaces with exactly the same class of bug. A release function that transfers before it updates its accumulator can be re-entered. A beneficiary who can call release() recursively against a stale released value can drain the cliff in a single transaction. Nobody will discuss this on unlock day. It is the kind of thing that gets noticed after the fact, in a post-mortem, when the token has already repriced thirty percent.
Core: FHE Performance — The Overhead Nobody Prices
Here is the part of the ZAMA story that the unlock calendar will never touch, and the part that actually determines whether the token has a future beyond the release schedule.
FHE is expensive. The overhead is not incremental. It is orders of magnitude. An encrypted multiplication runs through bootstrapping operations that cost seconds of compute in the worst case. Whole classes of operations — comparisons, branching, anything that needs a lookup table — are punitive under homomorphic evaluation. This is not an implementation detail that a better library fixes next quarter. It is the mathematics of the primitive.
I spent two months in 2025 reverse-engineering the core circuit of a decentralized AI training protocol that claimed to verify model updates with zero-knowledge proofs. The pitch was elegant. The benchmark was not. The proof generation time for a single training step was computationally infeasible for any real-time workload, and the protocol's own testnet numbers, once you subtracted the marketing, confirmed it. When I published the execution-time comparison against actual L2 throughput, the token dropped eighty percent. The lesson was not that ZK is bad. The lesson was that a cryptographic primitive with a three-order-of-magnitude overhead cannot be sold as a drop-in replacement for plaintext compute, and no amount of narrative closes that gap.
FHE occupies the same trapdoor. fhEVM lets you write Solidity that operates on ciphertext. That is a genuine engineering achievement. It is also a promise that every encrypted operation costs a thousand times what the plaintext operation costs, and a DeFi protocol that runs an AMM on encrypted reserves will discover that the constant-product invariant requires comparisons and divisions that FHE handles badly. The math doesn't lie. When the math is encrypted, it lies even less — and it tells you what the protocol cannot do.
This is where my Layer 2 skepticism becomes relevant, and I will state it as a technical observation rather than a prediction. Post-Dencun blob space is a finite resource priced by a market that is currently undersubscribed and will not stay that way. Zama's fhEVM runs on an execution environment that ultimately settles to an L2 or to Ethereum itself. That means every FHE operation is paid for twice: once in the homomorphic compute overhead, and once in the calldata and blob cost of proving the state transition. When blob demand saturates — and it will, because rollup proliferation outpaces blob supply — the second cost doubles. An FHE protocol already paying a thousand-fold compute premium then pays a doubled data-availability premium on top. The margin for error in the unit economics is not thin. It is negative.
I am not saying FHE cannot work. I am saying the unlock prices a token whose protocol has not yet demonstrated it can run a real workload at a real cost, and the same unlock event that releases 27.9 million tokens releases them into a market that has no way to verify that cost. The performance question and the denominator question are the same question: what is the thing actually worth, once you subtract the story?
Core: The Threshold Decryption Committee Is a Multisig With Better Branding
Now the security blind spot that the technical narrative quietly buries.
FHE is often described as fully homomorphic encryption that lets a network compute on encrypted data without ever decrypting it. That description is true and incomplete. At some point the result must be decrypted for someone. In practice, FHE networks use a threshold decryption committee — a set of nodes that jointly hold the decryption key, each holding a share, reconstructing the plaintext only when a quorum agrees. This is multiparty computation layered on top of the homomorphic primitive.
That committee is the real trust boundary. The cryptography is not the weak point. The governance of the key shares is. Ask the questions a security auditor asks about any multisig, because that is what it is: How many nodes hold shares? What is the threshold? Who admits new nodes? What is the collusion cost? Is the share set geographically and organizationally diverse, or is it five servers in one cloud region run by people who all know each other?
I have watched this exact pattern fail before. In 2022 I audited a Layer 2 bridge that relied on an optimistic verification scheme with an insufficient challenge window. The cryptography of the bridge was fine. The assumption that honest verifiers would be present, funded, and fast enough during a contagion event was not. It failed. Five hundred thousand dollars gone.
The threshold decryption committee is that same assumption in a different costume. A network that advertises fully homomorphic encryption as trustless privacy is advertising a decryption ceremony as magic. If the committee can be coerced, bribed, or subpoenaed, the ciphertext is only as private as the smallest coalition that can reconstruct the key. Complexity hides the truth; simplicity reveals it. The simple truth is that FHE does not eliminate trust. It relocates trust from the math to the committee, and committees are made of people and organizations with legal exposure.
This connects to something I have argued for years about stablecoins, and it applies here with uncomfortable precision. USDC's compliance-first design means Circle can freeze a specific address within twenty-four hours. That is not decentralization. It is a kill switch with a customer support team. A threshold decryption committee with a quorum that answers to a legal entity is the same architecture: a privacy system with a freeze button, wrapped in a cryptographic guarantee that only holds if the committee never acts. FHE's compliance-friendly positioning — selective disclosure, auditor keys, regulatory views — is precisely the feature set that makes the freeze button a selling point rather than a bug. For a regulated counterparty, that is fine. For anyone who believed the word trustless, it is a redefinition, not a guarantee.
Core: fhEVM Composability and the Moat That Eats Its Own Tail
Zama's strongest argument is composability. If fhEVM is standards-compatible with the EVM, a Solidity developer ports existing logic onto encrypted state with minimal refactoring. That creates a network effect that a non-EVM privacy chain cannot match, because the developer's migration cost is the moat.
I have a specific reason to take that claim seriously. In 2017, while the ICO market was busy pricing narratives, I spent six months isolating and auditing the Uniswap V2 automated market maker contracts on testnet. I manually traced the swap function four hundred times to verify invariant preservation under edge cases, and I found a rounding error in the sqrtPriceX96 calculation that could open a minor arbitrage. I submitted three pull requests, two of which merged after extended argument with the core contributors. The point of that story is not the bug. The point is that the invariant — the constant product — is the entire security model of an AMM, and it is expressed in plaintext arithmetic that anyone can verify.
Now put that AMM under FHE. The reserves are encrypted. The swap executes on ciphertext. The invariant still holds mathematically, but nobody — not the developer, not the auditor, not the user — can see it hold. You have taken the one thing that made the AMM auditable and you have hidden it behind the primitive. Composability is real. Auditability is gone. The two are in direct tension, and Zama's pitch leans hard on the first while staying quiet about the second.
This is also why the RWA narrative that FHE projects love to invoke does not survive contact with reality. The pitch is that institutional assets need privacy, so they will settle on a private execution layer like fhEVM. I have watched RWA on-chain for three years and it remains a storytelling exercise, and the reason is exactly this: traditional institutions do not need your public chain. They have settlement infrastructure that works, with privacy guarantees that have been stress-tested by regulators, and they are not going to migrate their books onto an encrypted EVM to obtain a privacy property they already have. The encrypted AMM is a beautiful primitive in search of a customer who is forbidden from using it.
So the moat is real but narrow. fhEVM can make Zama the privacy middleware standard. It cannot make Zama the place where institutional money actually settles, because institutional money does not want the encryption. It wants the compliance. And the compliance is the kill switch. The standard-setter position is durable. The revenue position is speculative. Those are two very different things to price into a $0.685 token.
Core: The Mechanics of an Unlock — Priced In, or Priced Wrong?
The reflex is to say the unlock is bearish. The reflex is usually wrong about the timing and right about nothing else.
Scheduled unlocks are the most pre-signaled events in crypto. The schedule is public for months. Market makers and quantitative funds have already positioned. The typical pattern is that price pressure front-runs the unlock by one to two weeks and then reverses on the day itself as the trader who sold the expectation buys back the fact. Linear 'unlock equals dump' reasoning fails because it ignores who already sold.
But there is a second-order condition that the pattern hides. Front-running only works if liquidity is present to absorb the early selling, and it only reverses if demand-side catalysts materialize afterward. A mainnet upgrade, a major exchange listing, an ecosystem grant program — any of these can offset the supply shock. The announcement provides none of them. Without a demand-side catalyst, the supply curve shifts right and the price mechanism has only one direction to express that.
So the honest structure is this: the unlock is a known, deterministic, low-surprise risk whose magnitude is unknown because the divisor is missing. In any risk assessment where the event is certain and the magnitude is unquantified, the correct posture is conservative by default. You do not price a certain supply increase as zero because it is anticipated. You price it as a range and you size positions against the worst end of the range until you can narrow it.
The realized-versus-nominal gap is the tool that closes the loop. If the $19.15 million nominal value is materially smaller on unlock day, that shrinkage is evidence the market already digested the event. Not proof — evidence. It is one of the few ex-post indicators that is cheap to observe and hard to fake, and almost nobody bothers to log it.
Contrarian: The Unlock Is the Least Interesting Part
Here is the counter-intuitive read, and it is the one I would stake my name on.
The risk in ZAMA is not the 27.9 million tokens. The risk is the reasoning that surrounds them.
The unlock is a certain, schedulable, on-chain event with a public timeline. It is, in risk terms, a solved problem — its probability is one and its timing is exact. The variables that actually reprice the token are the ones nobody can see: whether fhEVM can carry a real DeFi workload at a real cost, whether the threshold decryption committee is a governance committee or a cloud tenant, whether the privacy narrative is in expansion or fatigue, and whether the divisor that the announcement withheld turns out to make the supply shock trivial or catastrophic. The market is trading the one thing it can see and ignoring the four it cannot.
This is the same mistake I documented in the bridge audit and the ZK benchmarking report. The investors who died in the bridge did not die from the cryptography. They died from a challenge-window assumption that everyone knew was thin and nobody wanted to price. The tokenholders who lost eighty percent on the AI proof-of-training protocol did not lose it to an exploit. They lost it to a performance number that was printed in fine type and ignored in the pitch deck. Certain, visible risks get absorbed. Invisible, structural risks eat portfolios.
The unlock is the visible risk. The divisor is the invisible one. The performance envelope is the invisible one. The committee is the invisible one. Trade the visible one and you are trading noise. Trade against the invisible one and you are, for once, trading the thing that decides the outcome.
And there is one more contrarian note that cuts against the pessimists. An unlock that executes exactly on schedule is a promise kept. It is a weak positive signal — the vesting contract is doing what the tokenomics said it would, on-chain, in public, without administrative override. In a cycle where I have watched protocols quietly delay, reslice, and renege on their emission schedules, adherence is a data point. It is not bullish. It is simply not bearish in the way the timeline implies. Security is not a feature; it is the foundation, and a foundation that holds under a scheduled stress is worth more than a narrative that has never been tested.
Takeaway
When ZAMA unlocks on November 2, watch three things and ignore everything else. First, the beneficiary addresses on the vesting contract — investor, ecosystem, or market maker, because that is the category that decides intent. Second, the circulating supply you compute yourself, because the announcement will never hand it to you and every sell-pressure number without it is fiction. Third, the realized dollar value on the day, because the gap between nominal and realized is the market telling you what it already knew.
A bug fixed today saves a fortune tomorrow. But a denominator you never found is a bug you cannot fix, because you never knew the contract had one. The most dangerous number in this unlock is not 27,958,000. It is the one that was left out of the announcement, and it is the only number worth calculating before you size a position against a supply shock that the headline priced and never measured.
