ZK Proof Costs Are Collapsing: Here's Who Wins and Who Gets Commoditized
Article3,109 words
Report on the ZK proving stack in three layers: hardware, proving networks and applications. Proof cost fell from $2.00 in 2023 to $0.05 on ASICs; compares GPU, FPGA and ASIC bets, then the Boundless and Succinct networks.
Key claims
ZK proof cost fell from $2.00 (2023) to $0.05 on specialized ASICs
Cysic ZK Air makes STARKs at $0.05 vs $0.80 on GPU clusters
Boundless had 179+ active provers and a $13.7M sale at a $290M valuation
ZK Proof Costs Are Collapsing: Here's Who Wins and Who Gets Commoditized
In 2023, generating a single zero-knowledge proof cost $2.00. Today, specialized ASICs produce the same proof for $0.05. By the time this market reaches its projected $7.6 billion by 2033, that number will be closer to $0.001. Every layer of crypto infrastructure built on ZK proofs, from $40 billion in rollup TVL to cross-chain bridges that replaced the multi-sigs behind $920 million in bridge exploits, is a bet on that cost curve continuing to drop.
This report breaks down who is building that curve, who is riding it, and where the margin ends up.
The zk-proof market has fragmented into three layers over the past years:
Hardware manufacturers compete to reduce proof generation costs. Proving networks aggregate this capacity into marketplaces. Applications consume proofs through these intermediaries or build direct integrations.
This separation wasn't inevitable. Early zk-rollups like zkSync and StarkNet built vertically integrated systems, meaning they controlled proving hardware, software, and the applications running on top. But as proof generation became a bottleneck (costing $0.50-$2.00 per transaction in 2023), specialized infrastructure emerged at each layer. The pattern is familiar: vertical integration works until cost pressure forces specialization. What's different this time is the speed. The proving stack unbundled in under three years.
Layer 1: Proving Hardware
Proof generation runs on three types of hardware: GPUs, FPGAs, and ASICs. You can optimize software forever, but the ceiling is set by hardware throughput and memory bandwidth. This is where the cost floor of every zk-application gets determined, and it's why hardware is the layer that matters most for long-term economics.
GPU Proving
NVIDIA GPUs dominate current proof generation. The H100 can generate a Groth16 proof in 0.2 seconds or a PLONK proof in 1.5 seconds. Most proving networks run on GPU clusters because the hardware is available, programmable, and well-understood.
But GPUs weren't designed for cryptographic operations. They waste energy on capabilities proof generation doesn't need - texture mapping, ray tracing, video encoding. This creates a market gap for specialized hardware. The question is whether that gap closes fast enough to justify the capital expenditure required to build custom silicon.
FPGA Solutions
Ingonyama (@Ingo_zk) built the first FPGA-based proving system in early 2024. Their ICICLE library runs on Xilinx FPGAs and delivers 3-5x better performance per watt than GPUs for specific proof systems (primarily Groth16 and PLONK).
FPGAs sit between GPUs and ASICs on the flexibility-efficiency spectrum. You can reprogram them for new proof systems (unlike ASICs), but they're 10-30x more power-efficient than GPUs for operations they're configured to handle.
Their docs describe ICICLE as "backend-agnostic" acceleration that can integrate with existing ZK frameworks (so teams don't have to rewrite circuits just to benefit from hardware speedups).
In May 2025, Ingonyama partnered with Cornami to accelerate ZKP cryptography.
Their ZPU™ combines ICICLE's software stack with Cornami's FracTLcore® hardware, delivering 10-100x improvements in throughput and energy efficiency over GPU systems. Brevis integrated this solution as the first design partner to validate ZPU capabilities for ZKVMs.
This partnership is worth watching closely. FPGAs have always suffered from a perception problem in crypto: too expensive to deploy at scale, too niche to attract developer ecosystems. The ZPU approach sidesteps this by wrapping the hardware acceleration behind a familiar software interface. If ICICLE's backend-agnostic model gains traction, it creates a switching layer between hardware and proving networks that could commoditize the hardware tier faster than any single ASIC vendor would like.
ASIC Development
Cysic (@cysic_xyz) and Fabric Cryptography (@FabricCrypto) are both building ASICs for zk-proof generation. ASICs can't be reprogrammed, but they achieve 100-1000x better performance per watt than GPUs for their target proof systems.
Cysic frames itself as full-stack proving infrastructure - not only acceleration, but also a network that supplies proving and settlement services for zk-proofs.
Cysic focuses on STARK proofs used by StarkNet and other Cairo-based systems. Their ZK Air chip generates STARKs at $0.05 per proof compared to $0.80 on GPU clusters. The platform runs 1100-1300 tasks daily on average. The network generated 8M+ proofs by the end of 2025.
Their C1 chip processes 1.31 million Keccak functions per second. Verification costs drop 91% through batching techniques, with proving speeds 70% faster than competing implementations. In a collaboration with Succinct, Cysic completed 4M proofs with 99.7% success rate.
Fabric takes a different approach. Rather than optimizing for one proof system, they're building a custom instruction set called VPU (Verifiable Processing Unit) that handles the field arithmetic common across multiple proof systems. This provides ASIC-level efficiency with some flexibility to support future cryptographic schemes. The VPU 8060 went into production in Q4 2024 with tens of millions in pre-orders. The company employs 50+ engineers from NVIDIA, Google, Amazon, Groq, and Cerebras. Hardware cards cost $15,000-$25,000 versus $30,000-$40,000 for a H100, but the VPU only handles proof generation while the H100 runs other workloads.
The Cysic vs. Fabric contrast illustrates a fundamental strategic bet. Cysic is wagering that STARKs win the proof system war and that owning the entire vertical (hardware + network) creates defensible margins. Fabric is wagering that proof systems remain fragmented and that programmability at the instruction set level is the more durable position. Both bets can't be right simultaneously. If the market consolidates around one or two proof systems, Cysic's pure efficiency play wins. If fragmentation persists, or if post-quantum cryptographic transitions force new proof systems, Fabric's programmable approach avoids stranded hardware. For institutional allocators, this is the core hardware question: are you betting on standardization or entropy?
What determines which hardware wins? Cost per proof, but also geographic distribution and decentralization requirements. A proving network running entirely on one company's ASICs creates a single point of failure. Most networks will likely run heterogeneous hardware.
Layer 2: Proving Networks and Verification
Hardware alone doesn't solve the distribution problem. A data center full of VPUs or ZPU cards is worthless to a smart contract developer unless there's infrastructure connecting supply to demand. This is what the proving network layer does, and it's where the most interesting economic dynamics play out.
Proving networks solve a coordination problem: applications need proofs, hardware operators have capacity, but they can't efficiently find each other. These platforms create two-sided marketplaces.
Boundless
Boundless (@boundless_xyz) operates a permissionless proving network that launched mainnet beta on Base in July 2025, followed by full mainnet in September 2025. The network operates as a decentralized marketplace where GPU operators compete for proving work through a Proof of Verifiable Work mechanism.
As of Jan 2025, the network runs 179+ active provers and consistently generates revenue. The platform's parent company RISC Zero raised $40M Series A in July 2023 (led by Blockchain Capital). Boundless itself launched a $13.7M public sale in September 2025 at a $290M valuation. Applications submit proving jobs, provers claim tasks through auctions, and verification occurs through RISC Zero zkVM. The platform supports Steel (Solidity offloading for gas savings) and Kailua (fast finality) extensions. A single ZK proof for 4,000 transactions takes 2-5 minutes on A100 GPU, costing $0.04-$0.17 in cloud computing. Boundless doesn't verify every proof on-chain. Instead, they run optimistic verification with a challenge period. If a prover submits an invalid proof, anyone can challenge it within 6 hours. This reduces on-chain verification costs by 95% while maintaining security through economic incentives.
Succinct
Succinct (@SuccinctLabs) takes a different approach. Rather than building a general proving marketplace, they provide specialized infrastructure for specific use cases - primarily cross-chain messaging and state verification.
Their main product, SP1 - a zkVM that can prove the execution of arbitrary Rust programs. Applications write normal Rust code, and SP1 compiles it into circuits that can be proven on Succinct's network.
This matters because circuit development is expensive. Writing custom circuits for each application requires cryptography expertise and months of engineering time. SP1 lets developers prove computations without understanding circuit design.
Succinct powers cross-chain bridges (Hyperlane uses it for message verification), oracle networks (Herodotus uses it to prove Ethereum state to StarkNet), and ZK rollups (several teams building on their stack, none launched yet). Currently the network generated 1.1M proofs.
On the costs side, Succinct charges per CPU cycle proved, currently around $0.0001 per million cycles. A typical cross-chain message verification requires 10-50M cycles, putting cost at $0.001-$0.005 per message.
The Boundless vs. Succinct dynamic mirrors the classic platform vs. vertical integration debate. Boundless is building a general-purpose marketplace, betting that proof generation will commoditize and that the most valuable position is the exchange layer. Succinct is building opinionated tooling, betting that developer experience and ecosystem lock-in matter more than marketplace liquidity. Both are viable strategies, but they have different failure modes. Boundless risks a cold-start problem if it can't attract enough provers and requesters simultaneously. Succinct risks irrelevance if SP1 falls behind competing zkVMs or if the market fragments beyond their supported use cases.
The Verification Sublayer
Between proving networks and applications sits a distinct layer that's easy to overlook but increasingly critical: verification infrastructure. Generating a proof is only half the problem. Verifying that proof on a destination chain is the other half, and on Ethereum mainnet, it's prohibitively expensive for most applications. This has created space for dedicated verification protocols.
zkVerify
zkVerify (@ZKVProtocol) operates as a dedicated blockchain for zk-proof verification. Instead of verifying proofs on expensive L1s like Ethereum, applications submit proofs to zkVerify where verification costs 90% less.
zkVerify runs a Substrate-based chain optimized specifically for cryptographic verification. It supports multiple proof systems (Groth16, UltraPlonk, Plonky2, RiscZero, Ultrahonk, Space and Time, SP1, and STARKs) and publishes attestations back to source chains. The platform became the first chain to natively verify SP1 Prover Network proofs in 2025. Runtime Upgrade 1.3.1 (November 2025) added EZKL support for machine learning model verification, allow list functionality for domain owners, and non-ZK Ultrahonk verifier support. Network security runs on Proof-of-Stake consensus with validators including Nansen, Everstake, Horizen Foundation, ISinfra, and SubWallet. Verifying on Ethereum inherits Ethereum's full security. Verifying on zkVerify requires trusting their consensus mechanism. For applications already making trust assumptions (most zk-rollups have centralized sequencers), this may be acceptable. For applications requiring maximally trustless verification, it's not.
Aligned Layer
Aligned's (@alignedlayer) Proof Verification Layer launched on mainnet in December 2024. The network raised $20M Series A in April 2024 led by Hack VC. The platform operates as an EigenLayer AVS secured by ~3M ETH restaked across 52 operators globally. This provides 100x cheaper verification than Ethereum mainnet with millisecond-level latency. The architecture supports two complementary approaches for proof verification. The Proof Verification Layer offers low-latency fast mode secured by restaking, while the Proof Aggregation Service (currently on testnet) provides full Ethereum cryptographic security with slight latency and cost tradeoffs. Supported verifiers: RISC0, SP1, Gnark (Groth16 and Plonk), Circom (Groth16), Mina, and proof systems like Kimchi or Binius that are prohibitively expensive in the EVM.
Current verification: 2,000-3,000 proofs daily as of Q4 2025, split between PLONK (60%), Groth16 (25%), and STARKs (15%). Average cost: $0.15 per verification versus $5-$15 on Ethereum mainnet.
The verification sublayer is where trust assumptions get made, and where institutional due diligence should focus. zkVerify asks you to trust a separate Proof-of-Stake chain. Aligned asks you to trust EigenLayer's restaking security model. Neither is wrong, but they carry fundamentally different risk profiles. Aligned inherits Ethereum's economic security through restaking, which means its security degrades if EigenLayer's broader mechanism does. zkVerify's security is self-contained but smaller. For portfolios evaluating zk-infrastructure exposure, the question isn't which verification layer is "better" but which trust model aligns with the applications you expect to win.
Layer 3: Applications
Three types of applications consume proving infrastructure: zk-rollups, co-processors, and interoperability protocols. This is the demand side of the stack, and ultimately the layer that determines whether the infrastructure below it is overbuilt or underbuilt.
zk-Rollups
Scroll (@Scroll_ZKP), Polygon zkEVM, Linea, Taiko, Mantle and zkSync (@zksync) all verify transaction batches through zk-proofs. Each batch contains 50,000-200,000 transactions, and the proof verifies state transition correctness without re-executing every transaction.
These systems initially built their own proving infrastructure, but they're gradually migrating to external proving networks. Why? Economics and specialization. Running GPU clusters costs a lot in hardware and electricity. Buying proofs from a marketplace costs less and lets rollup teams focus on protocol development rather than hardware operations.
Co-processors
Co-processors like Axiom (@axiom_xyz) and Brevis (@brevis_zk) let smart contracts access historical blockchain data through zk-proofs. A contract can't normally read Ethereum's state from 1 year ago - storage lookups only work for current state. Co-processors prove historical state and make it available on-chain.
Axiom
Axiom lets contracts query Ethereum's historical state. Example: A lending protocol wants to calculate a user's average transaction volume over the past 6 months. Without a co-processor, this data isn't accessible on-chain. The protocol would need to trust an oracle. With a co-processor, the protocol requests a proof of the user's historical transactions, the co-processor generates it (using Succinct or similar infrastructure), and the smart contract verifies the proof. Axiom runs on Aligned Layer for verification (saves 80% versus verifying on Ethereum mainnet) and uses their own proving infrastructure (mix of GPU and FPGA hardware). It processes 1,000-2,000 queries per day, primarily for DeFi applications checking user history or calculating time-weighted metrics. Average proof cost is $0.10-$1.50 depending on query complexity.
Brevis
Brevis focuses on cross-chain data access. Contracts on Ethereum can query Arbitrum state, or contracts on Polygon can verify Optimism storage. This enables applications that need multi-chain context for example, a lending protocol that considers a user's positions across 5 chains when calculating collateral. Brevis launched February 2025 as a modular zkVM. Outperforms RISC0, SP1, and OpenVM by 70-150% on CPU with flexible proving backends and customizable workflows. Focuses on cross-chain data access (Ethereum can query Arbitrum state, Polygon can verify Optimism storage).
Co-processors are arguably the most underpriced category in the stack. They solve a real, immediate pain point (smart contracts can't access their own chain's history without trusting an oracle), and they create demand for every other layer beneath them. Each Axiom query triggers proof generation at the hardware level, verification at the network level, and settlement at the application level. This makes co-processors the closest thing to organic, compounding demand drivers in the zk-proving economy.
The cumulative 305M+ proofs generated versus 18M proofs in the last 30 days shows that activity is not front-loaded; monthly output represents roughly 6% of lifetime volume, which implies continued utilization. Daily proof counts in the 0.4-0.7M range. The relationship between app requests (197k all-time) and proof count implies that each request results in multiple proofs on average, pointing to compound workloads such as multi-step computations, recursive aggregation, or data-intensive coprocessor queries rather than single-proof transactions.
Interoperability Protocols
Cross-chain messaging protocols like Polymer (@Polymer_Labs) and Hyperlane (@hyperlane) use zk-proofs to verify state across chains without trusted intermediaries.
Traditional bridges use multi-signature schemes - a set of operators validates cross-chain messages and signs them. If the operators collude or get compromised, the bridge fails. This happened with Ronin Bridge ($600M+ stolen in 2022) and Wormhole ($320M+ stolen in 2022).
zk-bridges replace the multi-signature with a proof. Instead of trusting operators, the destination chain verifies a cryptographic proof that the source chain committed to a specific state. This eliminates the trusted intermediary.
Polymer builds on Succinct's SP1 to prove IBC (Inter-Blockchain Communication) messages between Ethereum and Cosmos chains. Each message includes a proof of the source chain's consensus state, which the destination chain verifies before accepting the message.
What Determines Adoption?
The zk-proving infrastructure landscape now has clear structure: specialized hardware at the bottom, marketplaces in the middle, and applications on top. But structure doesn't guarantee adoption. Three factors will determine which layers accrue value and which get commoditized.
Cost trajectories
For proving infrastructure to scale, proof generation must drop below $0.01 per transaction (assuming 100,000 transactions per proof). Current costs range from $0.05 to $2.00, depending on proof system and circuit complexity. Hardware improvements can deliver 10-50x cost reduction through ASICs and better algorithms. The remaining gap requires either higher transaction density per proof, or cheaper verification on destination chains.
Hardware specialization versus flexibility
ASICs like Cysic's C1 chip deliver 100-1000x better performance per watt than GPUs for specific proof systems (STARKs in Cysic's case). But they can't adapt to new proof systems without new hardware. If the market standardizes on one or two proof systems, ASICs win. If the market remains fragmented across multiple proof systems, FPGAs and specialized instruction sets like Fabric's VPU maintain relevance. Proving networks will likely run heterogeneous hardware. A network running entirely on one company's ASICs creates a single point of failure for supply and maintenance.
Security model trade-offs
Applications making trust assumptions already (most zk-rollups have centralized sequencers) can use cheaper verification layers like zkVerify or Aligned without compromising their security model. Applications requiring maximally trustless verification must verify on Ethereum directly, accepting higher costs. The proving network layer adds another trust vector. Boundless uses optimistic verification with 6-hour challenge periods. If all provers collude, they could submit invalid proofs that aren't challenged. Succinct's approach of specialized infrastructure for specific use cases reduces attack surface but increases vendor lock-in.
Where Value Accrues
What's certain is that the vertically integrated model (one team building hardware, proving software, and applications) won't scale. The market has already split into specialized layers. The economics of proof generation favor dedicated hardware operators. The coordination problem of matching proof supply with demand favors marketplace platforms. And applications benefit from consuming proofs as a service rather than running proving infrastructure.
But unbundling doesn't mean every layer captures equal value. Historically in technology stacks, value concentrates at the layers with the strongest network effects or the highest switching costs. In the zk-proving stack, that points in two directions: hardware (where capital requirements and fabrication timelines create natural moats) and applications (where user relationships and protocol integrations create lock-in). The middle layer, proving networks, faces the toughest long-term economics. Marketplaces for commodity computation tend toward thin margins as more supply enters the system. The winners there will be the networks that lock in enough demand-side relationships before proof generation becomes truly fungible.
The infrastructure is built. The question is no longer whether zk-proofs work at scale, but which layers of the stack capture the margin as costs compress. For capital allocators, the answer lies in the speed of hardware cost curves relative to application adoption. If hardware costs drop faster than applications proliferate, value accrues to the demand side. If applications proliferate faster than hardware commoditizes, the hardware tier holds pricing power. Right now, the hardware cost curve is winning the race, which favors applications and co-processors over raw infrastructure plays.