On the morning of the last batch I pulled, a mid-tier ZK rollup settled 41,000 transactions into a single validity proof. The sequencer collected 0.31 ETH in user fees. The prover — the machine cluster generating the cryptographic proof required to anchor that batch to Ethereum — consumed 0.94 ETH in compute and amortized hardware. The operator ran that batch at a 67% loss, and did so deliberately, because the alternative was to halt block production and watch its bridge liquidity drain within seven days.
I have documented negative-margin batches before. During the 2022 credit collapse, I traced the exact block at which a lending protocol's withdrawal queue became mathematically unrecoverable, and I published the forensic timeline because the community deserved the mechanism rather than the moral. The pattern here is familiar: a system that is solvent on the whiteboard and insolvent in operation. What is different in this cycle is not the mechanism. It is the scale. This is no longer one distressed protocol. It is an entire category of infrastructure, priced by token narratives that assume a gas environment that no longer exists.
A 30-day window is enough to see the structural problem, if you know where to look.
I assembled 30 days of proving cost data across three ZK rollups of comparable throughput — I will call them Rollup A, B, and C, since two of the operators shared figures on condition of anonymity — and mapped them against L1 settlement gas, sequencer fee revenue, and spot ETH. The result is not a story about one bad quarter. It is a story about unit economics that invert every time Ethereum becomes cheap.
Context: how a rollup actually pays its bills
ZK rollups bundle thousands of off-chain transactions, prove their validity with a cryptographic proof, and post that proof to Ethereum. The proof is the product. Generating it — proving — is the cost. Three cost centers fund one revenue line: the sequencer collects user fees, the prover pays for compute, and Ethereum charges verification gas and calldata.
For four years the pitch was that proof costs would fall as proving hardware matured and proof systems — Groth16, PLONK, and the newer recursive schemes — became more efficient. That has partly happened. Per-circuit proving time has dropped meaningfully, and the migration from GPU proving toward FPGA and ASIC-adjacent accelerators has compressed wall-clock time further. But per-batch absolute cost has not fallen as fast as the market assumed, because batch sizes and state depth grew at the same time. You cannot claim a win on proving throughput while the witness is getting bigger underneath you.
Meanwhile, the fee side collapsed. Under EIP-1559, when L1 base fees sit near 1–3 gwei in a low-activity market, the rollup's main competitor — the expensive Layer 1 it is supposed to undercut — becomes cheap. Users pay less. Sequencer revenue falls. Proving cost does not. That asymmetry is the whole story.
It is worth being exact about why 2 gwei is the specific number that breaks the model rather than, say, 8. At 2 gwei, the average ERC-20 transfer costs a user a few cents on L1. A rollup offering the same transfer for a fraction of a cent is competing on a difference that no longer changes behavior. The entire premise of the rollup premium was that L1 was unusable for ordinary activity. When L1 becomes usable, the premium becomes a rounding error, and the prover's cost becomes the only number that matters.
I pulled the data because a client in Nairobi asked a simple question: "If rollups are the future, why are the operators complaining about margin?" The honest answer required 30 days of numbers and a willingness to ignore the marketing.
I should note the macro backdrop, because it explains why the losses are being tolerated rather than fixed. Through the 2024 ETF cycle, I tracked more than $5 billion in spot Bitcoin inflows and outflows and correlated them against volatility indices and miner selling pressure. One finding repeated itself: institutional accumulation was passive. It bought, it held, it did not rotate into high-beta infrastructure. That passivity means there is no marginal institutional buyer stepping in to rescue an unprofitable L2 through revenue growth. The two trends — passive capital on one side, negative-margin rollups on the other — compound into a problem that cannot be waited out.
Core: the evidence chain
The methodology was intentionally conservative. For each batch I recorded transaction count, calldata bytes, L1 base fee at settlement, verifier gas, and the operator's reported proving wall-clock and hardware amortization. I excluded batches above 50,000 transactions as unrepresentative of the median load, and I excluded the two batches that used aggregated proofs, because the sample was too small to generalize. What remained was 212 batches.
| Metric (30-day median) | Rollup A | Rollup B | Rollup C | |---|---|---|---| | Avg transactions per batch | 38,400 | 41,200 | 33,900 | | Avg proving cost per batch | 0.81 ETH | 0.94 ETH | 0.76 ETH | | Avg fee revenue per batch | 0.29 ETH | 0.31 ETH | 0.26 ETH | | Net margin per batch | −0.52 ETH | −0.63 ETH | −0.50 ETH | | Median L1 base fee | 2.1 gwei | 2.4 gwei | 1.9 gwei | | Expressed margin | −64% | −67% | −66% |
Three independent operators. Three independent cost bases. One identical conclusion. The proving layer is not a cost center this cycle. It is the cost center, and it is being subsidized by token treasuries rather than by protocol revenue.
The critical variable is gas. When L1 base fees ran at 30–60 gwei in 2023 and early 2024, the same proof that cost 0.94 ETH to generate anchored a batch whose fee revenue cleared 0.9–1.4 ETH. Margin was thin, sometimes negative, but survivable. The prover's fixed cost was diluted by user demand willing to pay a rollup premium because L1 was prohibitively expensive. Rollups were a discount product. Discount products price well.
At 2 gwei, that logic collapses. L1 is cheap. The premium disappears. Sequencer revenue falls to a floor set by users who can now transact on the base layer for cents. The prover, however, does not care what gas is doing. Its compute cost is a function of circuit complexity and state depth, not of Ethereum's fee market. Correlation is not causation, but here the causality runs one way: cheap L1 fees cause revenue to fall, and nothing causes proving cost to fall with them.
I want to be precise about where the money actually goes, because "proving is expensive" is the kind of claim that hides in vague language. In the batches I inspected, the cost split was roughly: 58% raw compute (GPU/FPGA time), 19% hardware amortization and depreciation, 14% verification gas on L1, and 9% operational overhead covering orchestration, retries, and failed proofs.
Failed proofs matter more than operators admit. In the Rollup B window, 6% of proving attempts were discarded and re-run due to witness-generation errors — pure waste, invisible to users, invisible to token price, fully visible to the operator's cloud bill. Efficiency hides in the edge cases nobody audits, and failed proofs are the edge case that never appears in a quarterly deck.
This is where my 2017 audit experience is relevant. When I reviewed ERC-20 distribution logic line by line in Nairobi, the fatal flaws were never in the happy path. They were at the boundary — the overflow, the underflow, the state the developer never imagined would occur. Proving economics work the same way. The median batch looks fine on a dashboard. The distribution — the tail of expensive proofs, the retries, the state bloat — is where the margin dies. And no treasury model I have seen prices the tail.
There is a second, quieter cost the sector does not talk about: the coordination cost of running a prover network under competitive pressure. Sequencers want low latency to preserve UX. Provers want to batch aggressively to amortize cost. These two objectives pull in opposite directions, and operators resolve the conflict by over-provisioning compute — paying for capacity they use 40% of the time, so the median user sees a fast block. That idle capacity is real money, and it never shows up in a "cost per transaction" headline.
EIP-4844 changed the calculus in a way that cuts both ways. Blob space gave rollups cheap data availability, which lowered their L1 settlement cost and briefly improved margins. But it also lowered the cost for every other rollup, which intensified the fee competition that drives sequencer revenue toward zero. The subsidy from cheaper data availability was competed away within weeks. That is the cruelest feature of this market: any cost reduction available to everyone is, on a long enough timeline, captured by no one.
Compare this to optimistic rollups, which avoid proving cost entirely and instead pay a one-time bond with a seven-day challenge window. Their economics are boring: cheap to run, slow to finalize, and structurally exposed to fraud that almost never occurs. The ZK sector chose the expensive path in exchange for fast finality and cryptographic certainty. That was a defensible engineering trade in a 30-gwei world. In a 2-gwei world, the trade is priced wrong, and the market has not repriced it because the token absorbs the loss.
The implication for anyone holding these tokens is straightforward and uncomfortable. A rollup treasury is a runway, and runway is consumed by the delta between proving cost and fee revenue. At the observed margin of roughly −0.55 ETH per batch across a median of several hundred batches per day industry-wide — a figure I derived from public block explorers and cross-checked against two operators' internal logs — the aggregate daily subsidy runs into the low thousands of ETH. That is not a rounding error. It is a burn rate a treasury can sustain for months, not years, and only if the market does not force a redemption wave first.
Now, the honest counterpoint inside the numbers themselves. Proving cost is not static. Recursive proof composition, proof aggregation, and the shift toward cheaper proving stacks have all reduced per-batch cost materially over 24 months. Rollup A's median proving cost fell from 1.4 ETH to 0.81 ETH across the period I sampled — a 42% decline that is genuinely impressive engineering. If that curve continues at the same slope, the sector reaches break-even at roughly 4–6 gwei, not at 18.
But two things erode that optimism. First, the decline is partly a function of batching more transactions per proof, which increases witness size and pushes verification gas up. The savings are being borrowed from L1 calldata, and that borrowing has a ceiling. Second, the operators are not cutting cost in a vacuum. They are cutting cost while their treasuries fund the subsidy, and treasury runway is a finite quantity measured in months, not cycles.
I have watched this exact dynamic before. In 2020, I built the yield-farming scraper that tracked 1,000 daily liquidity pool entries and calculated real-time impermanent loss on portfolios north of $2 million in simulated value. I published the spreadsheet that predicted the correction in inflated yields weeks before it arrived. The mechanism was not mysterious. The market rewarded APYs that were not backed by protocol revenue, and the correction was not a matter of if but of which week. The rollup subsidy is the same structure wearing better engineering. Emissions look like revenue until they stop, and then the unit economics are exactly what the spreadsheet said they always were.
Contrarian: the narrative is backwards
The consensus framing is that rollups are "subsidizing growth" and the fix is more scale — more transactions, more TVL, more chains. That framing is convenient for the venture capital that funded the proving hardware and the token that prices the treasury. It is also, on the evidence, backwards. The problem is not that rollups have too few users. The problem is that the cost of settling a batch is structurally disconnected from the revenue of settling that batch, and adding users makes the loss larger if the marginal user pays less than the marginal proving cost. Scale does not fix a negative unit margin. Scale multiplies it.
This is the same manufactured narrative I have criticized for years in the liquidity-fragmentation debate. Fragmentation was never the disease. It was the symptom the industry monetized — a technical reality dressed as a strategic crisis to justify new products, new chains, and new token allocations. Rollup losses are the same move: a unit-economics problem repackaged as a scaling problem, so the next treasury raise can be reframed as momentum.
I documented a version of this in 2021, when I analyzed on-chain volume against unique buyer addresses across 10,000 Bored Ape tokens and found a $5 million gap between reported volume and genuine participation. The market called it liquidity. The data called it concentration. The same gap exists today between "TVL" and "profitable TVL." A rollup can carry billions in bridge TVL while losing money on every batch, and the two facts are not in tension — they are the same fact viewed from two angles.
Efficiency hides in the edge cases nobody audits — and the edge case here is that the operators are honest about the losses in private and optimistic about them in public. That gap, more than any proving benchmark, is the signal worth tracking.
Takeaway: the ratio to watch
The next-week signal I care about is not price. It is the ratio of proving cost to sequencer revenue at the median batch across the three rollups I am tracking. If that ratio falls below 2.0 without a gas recovery, real engineering is winning and the subsidy can end. If it stays above 2.5 while gas stays flat, the sector is not scaling. It is burning, and it is doing so in the one place nobody looks — the proof itself.
