Proving Without Revealing: zkVM Throughput and the Real Cost of On-Chain Identity

Every identity system has a moment where it asks you to hand over more than it needs. You want to prove you are over eighteen; you upload a photograph of a document that also contains your address, your date of birth, your document number, and a portrait that will sit in a database forever.

Zero-knowledge proofs have been the obvious fix for a decade. The reason they have not been adopted is not cryptography — it is arithmetic. Proving was too expensive, and the cost landed on the user.

That arithmetic changed.

The unit that matters: cost per million cycles

zkVMs execute a program and produce a proof that the execution was correct. The cost is measured in cycles — roughly, instructions executed — and the metric that decides whether a use case is viable is the all-in cost of proving a million of them.

Two curves, one crossing. The CPU prover improves steadily because the arithmetisation gets better and the field operations get cheaper. The GPU prover starts worse — GPU proving was, for a long time, a research curiosity with terrible memory behaviour — and then falls off a cliff as implementations learned to batch field operations and keep witness data resident.

The crossover in my model is around 2025, and by 2028 the GPU path is roughly an order of magnitude cheaper. That is not a small optimisation. It is the difference between "proving is a service you buy" and "proving is a step in your build".

Three engineering notes that the headline number hides:

• Recursion is where the cost hides. Proving a long computation requires recursively aggregating proofs, and the recursion overhead can dominate. A 10x improvement in leaf proving with no improvement in aggregation gives you maybe 3x end to end.
• Memory bandwidth is the real constraint on GPUs. Proving is not flop-bound, it is memory-bound, which is why the naive port to GPU underperformed for years. The implementations that win are the ones that restructured the witness layout, not the ones with the most cores.
• Verification cost matters as much as proving cost. On-chain verification has to fit in a block. A proof that takes 200k gas to verify is fine; one that takes 4M is a design failure regardless of how fast you proved it.

What a reusable attestation actually costs

Here is where the economics get interesting. A one-shot proof is a curiosity. The value appears when an attestation is reusable: prove once that you are a unique human with a verified jurisdiction, then present that proof to twelve different services without re-verifying anything.

The comparison is deliberately unfair to the ZK case: it assumes one issuance reused across twelve verifiers per year, a proof cost near ten cents, and no charge for the issuer's own compliance work. Even with those assumptions, ZK parity with centralised KYC lands around 2027-2028 — and after that the ZK line keeps falling while the centralised line is flat, because a database lookup does not get cheaper.

The reason the centralised line is flat is worth stating plainly: most of that $1.40 is not compute. It is manual review, fraud investigation, and the cost of storing documents that regulators require you to keep and attackers want to steal.

The everyday consequences

You stop re-verifying yourself every time you open an account. The current experience — upload ID, wait two days, get rejected because the glare on your passport photo was wrong — exists because each provider verifies independently. With reusable attestations, verification becomes a property you hold rather than an event you endure.

Breach severity drops sharply. A centralised KYC database is a target that contains millions of document images. A verifier holding attestations holds signatures, not documents. The attack that leaks a hundred million identity records becomes structurally less valuable, which changes the incentive to attempt it.

The unbanked get a cheaper on-ramp. Document-based KYC assumes documents. Attestation-based systems can be built on other signals — an employer, a community, a history of payments — with proofs that reveal only the claim being made. That is not a complete solution, but it is a materially lower barrier than "produce a utility bill".

A new intermediary appears, and it is not obviously better. Someone issues the attestation. That issuer decides who qualifies. If there are three issuers, you have rebuilt the same concentration of power with better cryptography. The interesting designs are the ones with many issuers and portable revocation, and they are much harder to build than the proofs.

Where the market lands

If the cost of proving a million cycles falls below ten cents and verification stays under 300k gas, the addressable use cases stop being "crypto things" and become ordinary compliance workflows: age assurance for social platforms, accredited-investor checks, employment verification, professional licences, and cross-border credential recognition.

My rough sizing puts the provenance-and-attestation infrastructure market — registries, proving services, revocation infrastructure, audit tooling — at low single-digit billions by 2026 growing to the mid-thirty-billions by the early 2030s. That number is soft; the growth rate is not. Compliance spending is remarkably resistant to recessions, and every new regulation adds a verification event.

The honest caveats

• Trusted setup and implementation bugs are still the failure mode. A perfect proof of a wrong statement is worthless, and the circuit is code.
• Privacy guarantees are only as good as the metadata. A proof reveals nothing about your document; your timing, IP, and payment pattern reveal quite a lot.
• Adoption is a chicken-and-egg problem. Verifiers accept what issuers provide; issuers build what verifiers accept. Standards bodies are doing this work slowly and unglamorously, which is exactly how it should be done.

The takeaway for builders

If you are building anything that touches identity, the cost curve has now crossed the point where "prove it" is cheaper than "check it". Design for attestations you do not store, verification you do not centralise, and revocation you can actually execute. The cryptography is ready. The institutional design is the part still under construction.

If this helped

Unpacking these cost curves — and throwing out the numbers that did not survive a second look — takes real effort. If it saved you some of that, a tip is much appreciated.

SOL: HCqPmPJM3NVtS6YrmVaTZYnuP8XZ2PFgQZKT94VK1LkS

Creating this takes real effort — thank you for the support.