Last Tuesday, at 2:14 a.m. Stockholm time, I did something I hadn't done in months. I closed the price charts and opened a prover dashboard.
For forty-one minutes, a cluster of GPUs in a Frankfurt facility spun up a validity proof for a single batch. That batch contained 1,847 transactions. When the proof finally landed and the state root updated on Ethereum, I pulled the two numbers that matter: what the proof cost to make, and what those 1,847 transactions paid in L2 fees.
The proof cost more. Not by a rounding error. By a wide margin.
I've been auditing prover economics on and off for two years now, mostly for founders who wanted a second opinion before a token launch. In a bull market, nobody asks me the hard question. In this one, everybody does. And over the past ninety days, the pattern has been uncomfortably consistent: the median cost of producing a validity proof on a general-purpose zkEVM has stayed roughly flat, while the revenue those proofs unlock has fallen by more than half.
Flat costs. Falling revenue. A story everyone repeats because it sounded true in 2021.
That's the shape of a business in trouble.
What We're Actually Talking About
Let's establish terms, because "ZK rollup" has become one of those phrases that means six different things depending on who's saying it.
A ZK rollup executes transactions off Ethereum, then posts a cryptographic proof to the base layer that the resulting state is correct. The proof is the product. It's what lets you inherit Ethereum's security without asking anyone to trust a sequencer, a multisig, or a seven-day challenge window. Trust is no longer a promise; it's a protocol.
I believe that. I've believed it since 2017, when I was interviewing smart-contract founders on a podcast nobody listened to yet, arguing that the philosophical weight of decentralization mattered more than the next token sale. The math-over-trust argument is the strongest moral case crypto has ever made. It's also, right now, an expensive one to operate.
Every ZK rollup runs on three cost centers. The first is data availability — the bytes you post to Ethereum so anyone can reconstruct your state. The second is proving — the compute you burn to generate the proof itself. The third is settlement and finality — the L1 gas to verify the proof, plus the infrastructure cost of getting assets in and out.
For years, the conversation was dominated by the first and third. Data was expensive. Verification was expensive. Everyone built for a world where the base layer was the bottleneck.
Then two things happened, roughly a year apart.
EIP-4844 landed in March 2024 and handed rollups dedicated blob space. Blobs are cheaper than calldata by an order of magnitude or more, and they get discarded after roughly eighteen days. DA costs fell off a cliff. Rollups that had been paying six figures a month to post batches suddenly paid hundreds.
Then Pectra raised the blob target again, from three to six, with a max of nine. More cheap space. Good for rollups. Quietly catastrophic for rollup revenue, because when your input cost collapses and your competition is fierce, your output price collapses too. And then the market turned. Activity drained. Fees drained with it.
So here we are, in the cheapest data environment in Ethereum's history, watching Layer 2 teams discover that the expensive part was never the data.
The Cost Stack Nobody Itemizes
When I sit down with a ZK team and ask to see per-batch economics, the first thing I usually get is a spreadsheet missing half its lines. Proving cost is on there. DA is on there. What's missing is everything that doesn't scale down.
Here's what a batch actually costs. Proving compute — the GPU or FPGA time to generate the proof. Witness generation — the part that turns execution traces into something a prover can actually consume. Memory. Prover amortization — the hardware itself, which depreciates whether or not you're producing proofs. Power. The aggregation step, because nobody posts raw proofs anymore; you post one aggregated proof covering many batches. Sequencing infrastructure. L1 verification gas. The bridge, which is a standing liability with a security team attached. And the human cost of people who have to babysit all of it at 2 a.m.
Most of those lines are fixed. That's the entire problem. A prover farm doesn't get cheaper when throughput halves. The GPU you bought is still depreciating. The engineer you hired is still getting paid. Your cost curve is flat while your revenue curve is a cliff.
I've watched teams model proving as if it were a variable cost that scales with usage. It isn't. It's a factory. In a bull market, factories print. In a bear market, factories eat their owners.
Proving Is a Hardware Business Pretending to Be a Software Business
This is where the story gets interesting, and where most of the public commentary stops.
Proving is not a clever algorithm running on someone else's cloud. It's heavy math — multi-scalar multiplications and number-theoretic transforms — and it's bottlenecked by memory bandwidth and raw silicon. That means the cost of a proof is, at the margin, the cost of renting compute.
And right now, that compute is contested.
ZK provers are bidding for the same silicon as AI labs, and AI is winning. GPUs that used to sit in mining farms now sit in inference clusters. FPGA supply chains got reallocated. The cost of the hardware that makes a ZK rollup work is set by a market where the buyer on the other side has a much fatter wallet and a much shorter payback period.
That's a structural disadvantage nobody puts in the pitch deck.
What's made it tolerable is the prover marketplace — networks that aggregate demand and let rollups buy proving as a service instead of building farms. On paper, this is elegant. You get spot pricing, you get utilization, you get competition.
In practice, I've seen the same pattern play out three times now. A prover market launches with subsidized pricing. Rollups migrate. The subsidy ends. Prices float up to something closer to marginal cost, and everyone who built a business model on $0.001 proofs discovers that marginal cost is a moving target set by people who don't care about blockchains.
Prover marketplaces are genuinely useful. They are not a subsidy. Treating them as one is how you end up with a token that exists to pay for someone else's idle GPUs.
Blobs Saved the DA Line and Quietly Killed the Revenue Line
Here's the mechanism nobody wants to say out loud.
Blobs have their own fee market, separate from regular gas, with its own EIP-1559-style target. When demand sits at or below target, the blob base fee collapses toward the minimum. Which means that for most of the last eighteen months, posting data to Ethereum has been close to free.
That's a genuine engineering triumph. It's also a price signal that flowed straight through to users.
Think about what a rollup sells. It sells inclusion. It buys bytes and compute, wraps them in a sequencer, and charges users a fee. When the bytes become nearly free and there are six rollups competing for the same user, the inclusion fee races to the floor. That's not a bug in the market. That's the market working exactly as designed.
The uncomfortable part is who's paying for it. Near-zero blob fees mean Ethereum's own fee market is underwriting rollup economics. The security budget on L1 is carried by stakers and by an issuance schedule that assumes blockspace is scarce. Rollups are consuming that blockspace at the marginal cost of near zero. It's a transfer, not a creation. And these things have a way of getting repriced.
We've already seen the preview. During blockspace stress events, blob fees spike hard — the first congestion events after Dencun sent some rollups back to calldata because blobs got more expensive than the old path. If Ethereum ever becomes genuinely busy again, the DA line comes back. Every ZK rollup currently modeling DA as a rounding error is modeling a state of the world, not a law of physics.
The Unit Economics, Written Out
Let me put numbers on this, with the caveat that any specific figure depends on circuit design, batch size, prover hardware, and which week you're measuring. The shape is what matters.
Take a general-purpose zkEVM producing batches of a few thousand transactions. Proving costs scale superlinearly with gas consumed in a batch, not linearly — doubling the work in a batch more than doubles the proving time. So a busy batch is disproportionately expensive to prove, which is the opposite of what most people assume.
Now layer revenue on top. In a bear market, per-transaction fees on most L2s sit in fractions of a cent. Multiply by a few thousand transactions per batch. Subtract proving. Subtract aggregation. Subtract L1 verification. Subtract the amortized hardware. Subtract the team.
In the bull market version of these numbers, the whole thing worked. Gas on L1 was high, L2 fees were meaningfully positive, and activity was dense enough that fixed costs got amortized across a fat revenue base. The model wasn't wrong. It was fit to a regime.
In the current regime, the model doesn't just produce a thin margin. It produces a negative one, and it does so most sharply for the teams with the best technology. That's the cruel part. The teams with bigger batches and more sophisticated circuits have lower per-transaction proving costs, which means they can afford to run more capacity, which means their fixed cost base is larger when the music stops.
There's a latency trap on top of it. Bigger batches amortize proving better, but they also take longer to prove. Longer proofs mean slower finality, slower withdrawals, and a worse user experience. So you're trading unit economics against responsiveness. Cheap, fast, and trustless — pick two, and the third is a decade of research away.
I keep hearing people say ZK is "solved at the protocol level, and now it's an execution problem." It's not. The cost curve is still the research problem. It just got hidden behind a subsidy.
The Subsidy Layer
Which brings me to the thing that actually holds this together.
If you strip out token emissions, points programs, sequencer rebates, and foundation grants, a meaningful share of ZK rollup activity is not organic. It's purchased. That's not a moral failing; it's how every chain has bootstrapped since 2017. But it means the P&L you're looking at is a marketing document.
I've seen teams whose public growth dashboards look like hockey sticks and whose internal cash-flow model is a countdown clock tied to a vesting schedule. When emissions stop, the real economics surface. And when they surface, the first cost to get cut is not the team and not the marketing. It's proving capacity. Which means latency gets worse, which means users leave, which means revenue falls further.
That's the doom loop I worry about. Not a hack. Not a regulator. Just arithmetic, arriving on schedule.
This is where the ideology gets tested. Trustless systems require trusting relationships — with validators, with prover operators, with the communities who agree to keep subsidizing a service until it stands on its own. The cryptography removes the need to trust the counterparty. It doesn't remove the need to trust each other enough to keep the lights on.
I learned to stop preaching and start listening about this in 2022, when I burned out and spent three months in European galleries and community meetups instead of reading charts. What I heard from builders during that stretch wasn't ideology. It was exhaustion. They were running infrastructure nobody was paying for and calling it adoption.
What the Sequencer Actually Earns
A quick note here, because the sequencer is where most people assume the money is.
It isn't. A sequencer's revenue is priority fees, some MEV capture, and the spread between what it charges users and what it pays for DA and settlement. Most rollups pass base fees through or burn them. Priority fees in a low-activity environment are thin. MEV on a chain with a few million in daily volume is not a business.
The sequencer is also the most centralized part of most "decentralized" rollups — a single operator with the ability to reorder and delay. Code is law, but empathy is the interface, and right now the interface is a hot wallet with an AWS dependency. Every ZK team I've audited has a sequencer decentralization roadmap. None of them has a sequencer revenue line that pays for it.
Where the Compression Argument Breaks
The standard case for ZK over optimistic rollups is data efficiency. ZK rollups post state diffs plus a proof. Optimistic rollups post transaction data and hope nobody challenges. On bytes, ZK wins. Sometimes by a lot.
That argument was decisive when bytes were expensive. It is much less decisive now.
When DA costs are near zero, the DA advantage of ZK compresses toward zero as well — but the proving cost doesn't compress at all. That's the inversion almost nobody is pricing. ZK rollups traded a data cost for a compute cost, and then the data cost went away.
For a general-purpose zkEVM under low activity, the DA savings no longer cover the proving bill. For a specialized circuit — a payments rollup, a privacy rollup, a gaming chain with a narrow instruction set — the math is completely different. Specialization cuts proving cost by an order of magnitude or more, because you're not proving the entire EVM, you're proving the six things your application actually does.
The pivot wasn't toward general-purpose ZK versus optimistic. It was toward specialized ZK versus everything. That's the read I keep coming back to when I look at where the actually-profitable deployments sit.
Who Is Actually Bleeding
Let me be specific, because "ZK rollups are struggling" is too blunt to be useful in a bear market.
The category under real pressure is the general-purpose zkEVM running its own prover infrastructure against thin retail activity. High fixed costs, undifferentiated product, direct competition with cheaper optimistic rollups on the same user. These are the teams quietly cutting proving capacity and telling their communities it's a "throughput optimization."
The category that is fine, and quietly growing, is application-specific ZK. Payment rails, privacy-preserving settlement, compliant institutional transfers, gaming state. Narrow circuits, low proving cost, and — critically — a customer who is paying for a specific property the proof provides, not just for cheap blockspace.
The third category, and the most interesting to me, is teams that sell proofs instead of consuming them. Prover networks, aggregation layers, verifiable compute for AI inference. In that model, someone else's proving bill is your revenue. That flips the entire equation, and it's where I'd be building if I were twenty-six and starting over.
The Contrarian Read
The consensus framing right now is that ZK is inevitable because math is cheaper than trust. I think that framing is backwards, and it's the same mistake the market makes about liquidity fragmentation — a narrative manufactured to sell the next product, repeated until it sounds like physics.
Math is not cheap. Math is extraordinarily expensive to produce and nearly free to verify. That asymmetry is the actual property of ZK, and it's about verification, not computation. For fifteen years we've been staring at the wrong half of the sentence.
Optimistic rollups are, at the margin, running on trust. Trust is expensive to exit, but free to operate. ZK systems are free to exit, but expensive to run. We built a decade of valuation models on the assumption that exit cost dominates operating cost. In a low-fee, low-activity regime, the opposite is true. Operating cost is the whole game.
The blind spot is that we keep benchmarking ZK against a bull-market baseline and calling the gap temporary. It isn't temporary if the base layer's own fee market doesn't bail it out. And the one thing I'd bet on is that Ethereum's fee market will stay cheap for a long time, because that's what a scaling roadmap is designed to do.
The Takeaway
The question was never whether ZK scales. It scales. The question is who pays for the proving, and whether the thing being proved is worth more than the proof costs.
For general-purpose rollups in this market, the answer is no, and I don't think another round of emissions changes that. For narrow, specialized, high-value verification — payments, privacy, compliance, and increasingly AI — the answer is already yes, and it's being quietly built by teams that never bothered to announce a token.
Trustless systems require trusting relationships. Right now, the most trusting relationship in ZK is between a prover and its electric bill. Watch that line.
