What Is a Zero-Knowledge Proof?

On 1 March 2018, at the Financial Cryptography conference, a Zcash Company cryptographer named Ariel Gabizon spotted a flaw that would have let somebody mint Zcash out of nothing. Nobody watching the blockchain would easily have noticed. The fake coins would have carried proofs that every node on the network would check and accept.

The company kept it quiet. The fix shipped inside the Sapling network upgrade, which activated on 28 October 2018, and the flaw was only made public on 5 February 2019 as CVE-2019-7167, with a note that no evidence of counterfeiting had been found. Horizen and Komodo, two projects running similar code, had been warned privately in November 2018.

What went wrong was small. Some extra values had been left in the setup parameters by mistake, and their presence let a cheat slip past one consistency check. That episode is a fair summary of the whole subject: a proof system is only as sound as the maths and the setup underneath it, however clever the idea. This is an educational explainer, not financial advice.

What a zero-knowledge proof actually proves

A zero-knowledge proof lets one party, the prover, convince another, the verifier, that a statement is true without handing over the information that makes it true. The statement might be "I know the password to this account" or "every transaction in this batch follows the rules". The verifier ends up convinced of that one fact, with the odds of being fooled pushed close to zero, and learns nothing else.

The best-known picture of this comes from a 1989 paper by Jean-Jacques Quisquater, Louis Guillou and their families, cheerfully titled "How to Explain Zero-Knowledge Protocols to Your Children". It retells Ali Baba. A cave's entrance forks into two dead-end passages, secretly joined at the back by a wall that opens to the magic words. A character called Mick Ali knows the words. He walks into one passage out of sight, then a television reporter comes to the fork, flips a coin and calls out which side Mick must come back from. Knowing the words, he can always obey. A bluffer guesses right half the time, and the scene in the paper is played 40 times, which leaves a faker roughly a one in a trillion chance. The reporter never hears the words.

Random questions asked many times, and that was the original recipe too.

A 1985 paper and a Turing Award

The idea was introduced in "The Knowledge Complexity of Interactive Proof Systems", a 1985 paper by Shafi Goldwasser, Silvio Micali and Charles Rackoff. A traditional proof is written out in full so that a reader can check every step. The three authors let the prover and verifier trade messages and toss coins, and showed that a fact could then be established statistically while giving away nothing about why it holds.

Goldwasser and Micali shared the 2012 ACM A.M. Turing Award, announced in March 2013 and worth $250,000, for work that ACM said turned cryptography from an art into a science. MIT's announcement singled out the 1985 paper as one of their most significant contributions.

Blockchains needed a different shape. A proof has to be written into a block once and checked later by every node, none of which took part in any conversation. For years the most efficient way to get proofs that short was a one-off setup phase that generates shared public parameters from secret randomness. Whoever kept that randomness could forge proofs, so Zcash generated its parameters through two elaborate multi-party ceremonies, one at launch and one for the Sapling upgrade.

Privacy: shielded payments on Zcash

Zcash released its genesis block on 28 October 2016 and became the first widespread use of zk-SNARKs, short for zero-knowledge succinct non-interactive arguments of knowledge. The succinct part means the proof is small enough to publish on a blockchain. In a shielded transaction the details are encrypted on the chain, and the attached proof convinces every node that the payment still obeys the consensus rules.

One of those rules is that value cannot appear from nowhere, which is exactly the rule the 2018 flaw would have broken. A forged proof would have looked identical to an honest one, and the same encryption that hides payment details would have hidden the extra coins.

Scaling: ZK rollups on Ethereum

The second big use has little to do with privacy. A ZK rollup executes batches of transactions away from Ethereum, publishes its transaction data or state changes to Ethereum, and attaches a validity proof that a contract on Ethereum checks before accepting the new state. Because the proof is checked up front, withdrawals do not sit out the challenge period that optimistic rollups need. ZKsync, Starknet, Scroll and Linea work this way. The data stays readable so that anyone can rebuild the rollup's state, which means the "ZK" here buys correctness, not secrecy.

Sound maths does not guarantee a product people use, though. Polygon zkEVM Mainnet Beta went live on 27 March 2023, with Vitalik Buterin making the symbolic first transaction. In June 2025 Polygon Labs announced it would wind the network down, citing slow support for an Ethereum upgrade and technical limits that made some DeFi transactions impractical, and by 3 July 2026 its sequencer had been shut down and the network had stopped producing blocks.

Proving your age without showing your ID

The same trick works well away from crypto. On 3 July 2025 Google open-sourced its zero-knowledge proof libraries on GitHub, under the name longfellow-zk, building on a partnership with Sparkasse to support age assurance in the EU. The example Google gave is a website visitor proving they are over 18 without sharing anything else at all, not even the date of birth that makes it true. Google's post tied the release to the EU's planned European Digital Identity Wallet.

Age checks are a near-perfect fit, since the website needs one yes or no.

What a zero-knowledge proof does not hide

A proof covers one statement, and everything outside that statement stays on show. A shielded Zcash payment is still a transaction in a block, so the fact that something happened, and roughly when, is public. The proof also says nothing about the network around it, such as the IP address that broadcast the transaction or the exchange account the money came from. A proof does nothing about those.

Nor does a proof check that the right statement was proved. Developers express the rules as a circuit, and the proof only confirms that the circuit was followed. If the circuit has a bug, the proof faithfully certifies the bug.

Setups can fail as well, as Zcash learned in 2018. STARKs, another family of proofs, can work without any trusted setup, which removes that one risk and leaves the rest. A zero-knowledge proof tells you one thing with great confidence. Everything else still has to be checked the old way.