Ethereum's ZK L2s in the age of quantum, privacy and AI
Post1,850 words
Starknet, zkSync and Aztec outperformed ETH since 1 Sep (STRK +173%, ZK +81%, AZTEC +50% vs ETH -1.4%) on quantum and privacy exposure. Compares proof, privacy and PQ plans; the best proof story has the weakest privacy story against harvest-now-decrypt-later.
Key claims
STRK +173%, ZK +81%, AZTEC +50% vs ETH -1.4% since 1 Sep
Aztec targets full PQ migration by end of 2030
Starknet L1 vote 99.95% in favour, non-binding
Ethereum's ZK L2s in the Age of Quantum, Privacy and AI
Since the 1st of September, $ETH is down 1.4%.
Over the same stretch, $STRK is up 173%, $ZK 81% and $AZTEC 50%.
For a sector that mostly makes headlines with shutdowns these days, that's quite the outlier. Blast and Abstract are shutting down. Polygon switched off its own zkEVM sequencer on the 1st of July, Zero Network wound down over the summer, and Mint closes withdrawals on the 20th of October.
So what do Starknet, zkSync and Aztec have that most other L2s don't?
Exposure to the two narratives gaining the most steam right now: privacy and quantum, with AI accelerating both.
What makes it interesting is that all three are ZK rollups from the same tech family, yet they're heading in very different directions:
- @Starknet is going all in on quantum resistance, to the point of asking its stakers whether it should leave Ethereum, while adding compliant privacy to a public chain.
- @zksync is focused on institutions, building private chains for banks, and stays fairly quiet on quantum dates so far.
- @aztecnetwork has the most ambitious privacy of the three and the most conservative published quantum plan, with a full migration targeted for the end of 2030.
Quick context if you missed the last two weeks:
On the 7th of October, @drakefjustin warned that AI-driven math might break the signatures securing our wallets before a quantum computer ever does, "in the worst case in months not years". While most cryptographers pushed back, the debate fueled the attention the AI & quantum threat vectors get, and accelerated the corresponding narratives.
Partly because the cost of a quantum attack keeps falling. In March, Google estimated a break of the curve behind Bitcoin and Ethereum keys at under 1,200 logical qubits. A public contest of AI coding agents (ECDSA(.)fail) halved that estimate within about two months. And on the 16th of October, @AnthropicAI showed Claude designing a circuit for the core step of that attack with 17x fewer gates, at the cost of only 12% more qubits.
No quantum hardware ran and nothing got broken yet tho.
However, the timelines everyone plans around just got significantly shorter.
For ZK L2s that boils down to two questions:
- Quantum: how much of your cryptography can you swap out, and who controls that swap?
- Privacy: who can see your data, today and in 2035?
And here's where it gets more nuanced and subtle: quantum risk is really three different risks:
- Proof forgery: a quantum computer fakes a validity proof. Only possible once that machine exists, and nothing that happened before is affected.
- Key theft: exposed public keys get cracked. Fixable with new signature schemes and a migration.
- Harvest now, decrypt later: someone stores encrypted data published today and decrypts it once the machine exists. This one works retroactively, so for anything private you put on chain, the clock is already running.
That third risk matters most here, because it’s the only one where today’s data is already exposed to a future quantum computer. And once you factor it in properly, the chain with the strongest quantum story isn’t automatically the one that best protects your data.
But let's dig into the deeper comparison:
1) @Starknet
- Proofs: hash-based end to end
- Privacy: STRK20, opt-in, live since June
- PQ Target: "first fully quantum-resistant network" by 2027
Starknet has the strongest proof story of the three. Its STARK proofs rely on nothing but hash functions, a Falcon-512 account already sent a mainnet tx for $0.027, and a phone signed a testnet tx with an ML-DSA key without needing a hard fork. Still, the team itself says Starknet isn't quantum-safe yet, since default accounts use elliptic-curve signatures and the chain depends on Ethereum's blobs for data. That dependency is what the current vote is about. It's non-binding and a yes only kicks off research, but 99.95% of votes so far are in favour. Where Starknet gets weaker is privacy. STRK20 stores encrypted notes on chain using elliptic curves, and every user's viewing key is encrypted to one master auditor key, held in an enclave by Financial Privacy Inc and backed by a 3 of 4 StarkWare/FPI multisig. For a regulator, that works as intended. For a future quantum computer, @l2beat rates it exposed: break the curve, derive the auditor key from its public key, and you're able to read everyone's onchain history. On top of that, Starknet's post-quantum signatures are lattice-based, the family @VitalikButerin flagged as the new risk area in the age of AI. Account abstraction means it can switch again if needed tho.
2) @zksync
- Proofs: hash-based inside, BN254 wrapper on Ethereum
- Privacy: Prividium, permissioned
- PQ Target: no specific date
zkSync hasn't put a date on going post-quantum. Its focus right now is institutions. Prividium gives each one its own private chain, where the data stays in the bank's own infrastructure and only proofs get posted to Ethereum. As it happens, that design lines up well with the checklist Vitalik laid out on the 7th of October, and @gluk64 was quick to point it out two days later. Since nothing encrypted ever gets published, there is nothing to harvest, which makes it the cleanest answer to harvest now, decrypt later of the three. The tradeoff is who you're private from: the public, yes, the operator, no. It's basically a private database with public proofs of correctness, which is exactly what a bank wants. The other gap is the wrapper. zkSync's big hash-based proof gets compressed into a small one so Ethereum can verify it cheaply, and that small proof relies on BN254 elliptic-curve pairings, the part a quantum computer breaks. That's where Airbender Prime comes in. Launched on the 13th of October, zkSync's new prover proved 99% of 7,200 consecutive mainnet blocks in under 10 seconds on a single RTX PRO 6000 GPU, a.k.a. real-time proving of Ethereum on hardware that fits under a desk (zkSync's own benchmark tho, not independently replicated yet). Vitalik congratulated the team two days later and called the battle for speed "definitively won". Prime also comes with a Keccak path for verifying proofs on Ethereum, which would remove the BN254 wrapper, but that part is announced rather than shipped, with no specific date attached yet.
3) @aztecnetwork
- Proofs: pairing-based, generated on your device
- Privacy: private by default, programmable
- PQ Target: full post-quantum migration by end of 2030
Aztec is the only one of the three running private smart contracts on a public network, with proofs generated on your own laptop or phone (2.5 seconds for a private transfer on a laptop on V5). That same design is why it's the slowest on quantum. Its prover has to run on a phone, recurse quickly and keep proofs small, and according to Aztec no post-quantum proof system manages all three today, with the fast ones producing proofs of around 300KB. So the plan is to pick first and migrate later: a signature scheme by March 2027, encryption by July 2027, the proving system by November 2027, and a full migration by the end of 2030. On harvest now, decrypt later, it comes down to the app. Keys are hashed and notes can be delivered offchain, but an app that posts EC-encrypted notes on chain is still exposed (L2BEAT flags zk(.)money for exactly that). @Zac_Aztec argues that rushed cryptography and implementation bugs are the bigger risk right now, and Aztec has a case in point: its own AI audit harness caught a critical soundness bug in V5 that months of human audits had missed.
Put side by side, the chain with the best proofs right now has the weakest privacy story against a quantum adversary. The institutional chain has the cleanest one. And for Aztec, it depends on what each app decides to publish.
Where does AI come in?
So far, mostly on the attack side, and mainly in three ways:
- It makes quantum attacks cheaper: ECDSA(.)fail matched Google's estimate within 8 hours and beat it in about 3 days, and Claude's 17x gate reduction came out of a single 53-hour run.
- It finds cracks in structured math: Claude cut the cost of recovering a key for HAWK, a lattice-based signature scheme, from 2^64 to 2^38 operations, and NIST withdrew it.
- It finds the bugs humans miss, as Aztec's V5 showed.
To keep it in perspective tho: no AI-assisted break of ECDSA has been published, and Drake's "months not years" was a worst case scenario voiced as a personal opinion.
The defences all three are converging on look similar: hash-based cryptography wherever possible, formal verification, and crypto agility, a.k.a. being able to swap your signature scheme without forking the chain or changing anyone's address.
It's also where Vitalik says the focus has to go on the zkEVM front now that speed is solved: formally verifying that a zkEVM actually matches the Ethereum spec, a hard cap on prover cost relative to the gas in a block, and the security of the proof system itself. With AI getting this good at finding bugs, that list matters more than yet another speed benchmark.
The market's reaction to the recent moves/announcements by these three players and their above-outlined approaches was remarkably positive:
At its peak on the 12th of October, STRK was trading at more than 4.7x its price from the 1st of September, on $741M of daily volume. ZK added another 23% and AZTEC 20% since Drake's warning on the 7th of October, while ETH lost 10% over the same days.
Since then, STRK has given back 42% from that peak tho, and part of the pressure sits in the supply schedule. Around 127M STRK unlocked on the 15th, roughly 1.7% of circulating supply, landing on the same day the L1 vote opened. ZK's monthly unlock of roughly 173M, about 1.6% of circulating supply, lands today as well. And for AZTEC, the genesis sequencer unlock follows on the 13th of November, with team and investor cliffs in February 2027.
So the narrative got priced on attention and hype within weeks, while the actual migrations run on timelines measured in years and supply dynamics at play that you should always keep in mind too.
My take:
None of the three is quantum-safe today, and all three admit to that. Narrative-wise, with a potential move to a fully quantum-resistant L1, or generally if you care about proofs, Starknet is clearly ahead.
If you care about privacy that still holds up in 2035 tho, the institutionally-focused approach of publishing nothing (zkSync) or keeping notes offchain (an option on Aztec) beats encrypting the data fully onchain.
But in conclusion, it's definitely worth keeping all three on your radar for now imo.
What I'm watching next here (aside from the charts kek)?
@gluk64's Money20/20 keynote on the 21st of October (teased as "Who's in control?"), the Starknet vote result on the 22nd re L1 migration, the Aztec V6 vote, and zkSync's Airbender Prime Keccak verifier actually going live.
NFA tho. DYOR.
3 more images on X
What came next · since 17 Oct 2026
Show how the 4 covered assets moved
This breakdown analyzes the project without making a call on the token, so price moves since publication are shown as market context.
Covered, no call
Mentioned for context
Since then
Zero has written 1 more piece on zkSync and Starknet and Aztec and $AZTEC and $STRK and $ZK since this one.
Daily closes in USD from DefiLlama and Yahoo Finance. Only a bullish or bearish call in a thesis or market take is tracked; explainers, lists, maps and mentions are neutral context. Not financial advice.