Zero-knowledge proofs (ZK proofs) allow one party to prove a statement is true without revealing anything beyond the statement's validity, but Bitcoin's Script language cannot natively verify them, forcing builders to find creative solutions for scaling and privacy. On Ethereum, ZK technology already secures billions of dollars across production rollups. On Bitcoin, the situation is fundamentally different, creating both a technical challenge and an opportunity for innovation.

Why Can't Bitcoin Verify Zero-Knowledge Proofs Directly?

Bitcoin Script lacks the cryptographic opcodes needed to check a ZK proof in a single transaction. Ethereum's Solidity contracts can verify a Groth16 proof (a specific type of ZK proof) with native precompiled elliptic curve operations at a cost of roughly 200,000 gas. Bitcoin Script has no equivalent. It lacks the pairing-based cryptography opcodes, arbitrary arithmetic operations, and Turing-complete looping constructs needed to evaluate a ZK proof.

This constraint has shaped how Bitcoin developers approach ZK technology. Rather than trying to force on-chain verification, three distinct approaches have emerged, each with different tradeoffs between decentralization, privacy, and scalability.

What Are the Main Proof Systems Bitcoin Projects Use?

Two dominant proof system families power Bitcoin ZK projects: zk-SNARKs and zk-STARKs. Each has distinct tradeoffs that shape which Bitcoin projects adopt them.

• zk-SNARKs (Groth16): Require a trusted setup ceremony but produce tiny proofs of approximately 192 bytes, verify in roughly 3 milliseconds at constant time, and are faster for most circuits. However, they are not quantum-resistant because they rely on elliptic curve pairings. Bitcoin projects using Groth16 include Citrea, BitcoinOS, GOAT/Ziren, and MAP Protocol.
• zk-STARKs: Require no trusted setup (making them transparent), are quantum-resistant because they rely on hash functions, and are slower for small circuits but faster at scale. They produce larger proofs ranging from 45 to 200 kilobytes. RGB v0.12, StarkWare, and ZeroSync use STARKs.
• Hybrid Approach: A common pattern has emerged where developers use STARKs for proving (no trusted setup, quantum-resistant computation) and compress the final proof into Groth16 before posting to Bitcoin. Citrea, for example, processes transactions through a STARK-based zkVM and then wraps the output in a Groth16 proof before inscribing it on Bitcoin.

How Are Bitcoin Projects Solving the Verification Problem?

RGB Protocol takes a fundamentally different approach to ZK on Bitcoin. Rather than trying to verify proofs on-chain, RGB moves all validation off-chain entirely. Asset data never touches Bitcoin's consensus layer. Instead, transactions are committed to Bitcoin via single-use seals (embedded in Bitcoin transactions) while the actual state transitions are validated by the transacting parties themselves.

RGB v0.12, released in July 2025, marked a significant architectural shift. The protocol replaced its previous Pedersen commitment and Bulletproof-based confidential state system with native zk-STARK support via zk-AluVM, a compact, non-von-Neumann zero-knowledge virtual machine with just 40 instructions. This change delivered a 4x reduction in consensus code (from 8,610 to 3,198 lines) and an order-of-magnitude improvement in validation speed by separating blockchain synchronization from state verification.

The practical impact is significant: RGB can now express confidential asset transfers where amounts and asset types are hidden using zero-knowledge proofs, verified entirely client-side without any on-chain computation. In August 2025, Tether announced USDT issuance on RGB, making it the first major stablecoin deployed natively on Bitcoin through client-side validation.

What Are ZK Rollups and How Do They Work on Bitcoin?

ZK rollups batch thousands of transactions off-chain, generate a validity proof attesting to their correctness, and post the proof to the base layer. On Ethereum, rollup contracts verify the proof directly via precompiled operations. On Bitcoin, this verification step is the central challenge.

Citrea launched on mainnet in January 2026 as Bitcoin's first production ZK rollup, providing full EVM-compatible smart contract execution settled on Bitcoin. The architecture works in stages: transactions are processed by a zkEVM built on RISC Zero (a RISC-V based zkVM), generating a STARK validity proof that is then compressed to Groth16 for a compact on-chain footprint. The proof is inscribed on Bitcoin, which serves as both the data availability layer and settlement layer.

For bridging, Citrea uses Clementine, a BitVM-based bridge with a 1-of-N trust model where only one honest signer is needed to ensure security. A trusted setup ceremony with 63 contributions was completed for the Groth16 verification circuit. The rollup launched with over 30 decentralized applications (dApps), though total value locked (TVL) remains under 2 million dollars as the ecosystem matures. Citrea is backed by Founders Fund, Galaxy, and Maven11.

Which Other Bitcoin ZK Projects Are Launching in 2026?

GOAT Network is the first Bitcoin Layer 2 (L2) built on BitVM2, powered by ZKM's Ziren zkVM, a MIPS-based zero-knowledge virtual machine. Ziren's real-time proving pipeline achieves block proofs in approximately 2.6 seconds, aggregate proofs in 2.7 seconds, and Groth16 compression in 10.4 seconds, supporting a 3.4-second block time through pipelined parallel architecture and a distributed GPU prover network. The underlying zkMIPS 1.0 launched in May 2025 with up to 19x faster proving over prior versions.

Several other teams are building ZK rollups anchored to Bitcoin:

• Alpen Labs (Strata): Raised 8.5 million dollars in January 2025 for a Bitcoin ZK rollup focused on lending, stablecoins, and privacy payments. Developed Glock, a technology delivering efficiency gains over standard BitVM verification. Mainnet targeted for 2026.
• BOB (Build on Bitcoin): A hybrid ZK rollup inheriting Bitcoin finality while bridging to Ethereum. BOB's implementation of BitVM3 reduced on-chain dispute costs by 87 percent, bringing them down to approximately 11 dollars per dispute through garbled circuits.
• Boundless (RISC Zero): Launched in January 2026 for Bitcoin-based ZK proof verification and settlement of Ethereum and Base proofs.

How to Understand the Tradeoffs Between Bitcoin ZK Approaches

• Client-Side Validation (RGB): Achieves ZK privacy and scalability by abandoning global state entirely. The sender must transmit the full provenance chain of an asset to the receiver, who validates it locally. This avoids on-chain verification costs but means every recipient must verify independently, and there is no shared ledger to query for balances.
• On-Chain Rollup Verification (Citrea, GOAT): Requires compressing proofs to fit Bitcoin's Script constraints, necessitating trusted setup ceremonies and careful proof system selection. Offers stronger security guarantees and shared state but at higher on-chain costs.
• Optimistic Verification (BitVM): Uses dispute resolution rather than cryptographic proof verification, reducing on-chain footprint but introducing time delays and reliance on honest watchers to challenge invalid transactions.

The diversity of approaches reflects Bitcoin's unique constraints. Unlike Ethereum, which can upgrade its consensus layer to support new cryptographic operations, Bitcoin's conservative upgrade path means builders must work within existing Script limitations. This has forced innovation in proof compression, off-chain validation, and hybrid trust models that may ultimately make Bitcoin's ZK ecosystem more resilient and decentralized than Ethereum's, which relies on precompiled operations that require protocol-level changes to update.

As these projects mature through 2026, the real test will be whether Bitcoin's ZK ecosystem can achieve meaningful adoption. Citrea's sub-2-million-dollar TVL and the nascent state of competing rollups suggest the technology is still proving its value proposition. But with major stablecoin issuers like Tether committing to RGB and institutional backing flowing to projects like Alpen Labs, the infrastructure for Bitcoin-native ZK applications is solidifying.