A ZK rollup is a Layer 2 blockchain that batches thousands of transactions offchain and settles them back to Ethereum using a single cryptographic validity proof. Every batch comes with a succinct zero-knowledge proof that Ethereum verifies in milliseconds — the moment that proof is accepted, the batch is final. No seven-day challenge window, no optimistic assumption, no wait for fraud proofs to time out.
​

This guide walks through how ZK rollups work in 2026, the difference between zk-SNARKs and zk-STARKs, where the major zkEVMs (zkSync Era, Polygon zkEVM, Scroll, Linea) and Starknet sit on the EVM-compatibility spectrum, and how ZK rollups compare to optimistic rollups on finality, cost, and developer tradeoffs. If you are new to the Layer 2 landscape entirely, start with what is a Layer 2 blockchain and come back.
​

Ethereum mainnet settles around 15 transactions per second. A ZK rollup settles thousands, pushes the proof down to Ethereum, and inherits Ethereum's security guarantees without inheriting its throughput ceiling. In 2026 the dominant ZK rollups collectively settle more stablecoin volume than every optimistic rollup combined, and L2Beat's live TVL dashboard tracks the shift in real time. The scaling story started as theoretical in 2019; by 2026 every major zkEVM is production and the question is no longer "will ZK work?" but "which flavor, for which workload?"
​

The core loop is simple. A sequencer orders transactions, executes them offchain, and posts two things to Ethereum: the compressed transaction data (so anyone can reconstruct the state) and a validity proof attesting that the new state root was produced correctly from the old one. A verifier contract on Ethereum checks the proof. If it passes, the new state is canonical and final.
​

The cryptographic heart of this is a SNARK or STARK — a proof system that lets a prover convince a verifier that a long computation was carried out correctly, without replaying the computation. Vitalik Buterin's SNARK primer remains the canonical explanation of the underlying math. What matters operationally is that proof verification on Ethereum is cheap and fast, while proof generation offchain is expensive but parallelizable.
​

Optimistic rollups post state roots and assume they are correct unless someone submits a fraud proof within a challenge window, traditionally seven days. That window is why withdrawals from optimistic rollups take a week unless you pay a liquidity provider to front the funds. ZK rollups sidestep this entirely — the validity proof is the correctness guarantee. Once Ethereum accepts the proof, the batch is final, and withdrawals clear as fast as the next Ethereum block. The Ethereum Foundation's rollup docs put this plainly: ZK rollups have no challenge period.
​

The other cost component is data availability — publishing enough information for anyone to reconstruct the rollup's state. Before Ethereum's Cancun upgrade landed EIP-4844, this meant paying calldata gas for every batch. EIP-4844 introduced blobs, a cheaper data lane specifically sized for rollup payloads, which cut ZK rollup fees by roughly an order of magnitude overnight. The EIP-4844 spec and its ongoing extensions (PeerDAS, full danksharding) continue to compress the data side of the equation through 2026.
​

Two proof families dominate. SNARKs (Succinct Non-interactive Arguments of Knowledge) are small and fast to verify but typically require a trusted setup ceremony and rely on elliptic-curve pairings that are not post-quantum. STARKs (Scalable Transparent Arguments of Knowledge) are larger but require no trusted setup and use hash-based cryptography that is post-quantum secure. zkSync, Polygon zkEVM, Scroll, and Linea use SNARK-based systems. Starknet uses STARKs, detailed in StarkWare's STARK explainer. In practice both families work; the choice is a tradeoff between proof size, verifier cost, and long-term cryptographic assumptions.
​

A zkEVM is a ZK rollup that runs EVM bytecode so existing Ethereum contracts can be ported over. The complication is that the EVM was not designed with ZK proving in mind — some opcodes are expensive to prove, and there are multiple levels of compatibility you can target. The canonical taxonomy is Vitalik's four types of zkEVM: Type 1 (fully Ethereum-equivalent, slower to prove), Type 2 (EVM-equivalent, minor state-tree changes), Type 3 (EVM-compatible with some opcodes handled differently), Type 4 (compiles Solidity to a custom VM).
​

zkSync Era is a Type 4 zkEVM from Matter Labs. Solidity compiles through zkSync's LLVM-based toolchain into a custom VM optimized for ZK proving. The tradeoff: some Ethereum bytecode quirks (particular precompiles, certain low-level EVM behaviors) do not port without adjustment, but proving is faster and cheaper. zkSync has been live on mainnet since 2023 and settles meaningful stablecoin volume. For the deeper architectural tour, the zkSync documentation is the canonical source.
​

Polygon zkEVM targets EVM equivalence more directly (Type 2 leaning toward Type 3). Existing Solidity contracts, debuggers, and tooling work with minimal changes. Polygon's zkEVM docs describe the prover architecture in detail, and the stack now ships as Polygon CDK so other teams can deploy their own zkEVM rollups with shared liquidity through AggLayer.
​

Scroll is the research-heavy Type 2 zkEVM, built in close collaboration with the Ethereum Foundation's applied-ZK team. It aims for bytecode-level equivalence and publishes its circuits as open source. Scroll's engineering blog is one of the better public sources on prover performance engineering in 2026.
​

Linea is ConsenSys's Type 2 zkEVM, integrated tightly with MetaMask and Infura. Developer experience is the pitch — a rollup that feels like Ethereum, with the wallet and RPC side already handled. Recent upgrades have closed most of the prover-time gap to competitors.
​

Starknet is not a zkEVM. It uses STARK proofs and its own language, Cairo, optimized for ZK proving. Contracts written in Solidity do not port directly; you either rewrite in Cairo or use a transpiler. In exchange, Starknet's prover economics are among the best in the field, and the Starknet documentation reflects years of production experience. For stablecoin workloads where absolute prover cost matters more than Solidity portability, Starknet is usually in the evaluation set.
​

Throughput across the major ZK rollups sits in the thousands of TPS in bursts, with sustained throughput bounded more by Ethereum's blob capacity than by prover speed. Proof generation time has dropped from hours in 2022 to minutes — and in some cases seconds — as specialized hardware (GPUs, FPGAs, and early ASICs) comes online. Benchmarks from the zk-SNARKs category on ethresear.ch track the state of the art as it moves.
​

Typical ZK rollup transaction fees in 2026 sit in the single-digit cents range for simple transfers and tens of cents for moderately complex DeFi interactions. Post-EIP-4844, the dominant cost is usually proof verification and sequencer overhead, not data availability. Real-time fee comparisons live on L2Fees.info, which tracks representative transactions across every major L2.
​

A ZK rollup's security rests on three pillars: the soundness of the proof system, the correctness of the verifier contract on Ethereum, and data availability so users can exit even if the sequencer goes offline. All three are testable. Circuits are audited, verifier contracts are small and heavily reviewed, and data availability is guaranteed as long as the rollup posts to Ethereum. The attack surface is narrower than optimistic rollups' because you are not relying on a watcher to submit a fraud proof in time — you are relying on a cryptographic proof that has already been verified.
​

Where trust assumptions creep back in: most production ZK rollups today run a centralized sequencer (for MEV capture and UX) and a permissioned prover network (because proving hardware is expensive and specialized). Decentralizing both is the roadmap for every major rollup in 2026. L2Beat's risk framework scores each rollup on these dimensions; it is the best single source for understanding what you are actually trusting when you deposit.
​

The two rollup families solve the same problem with different cryptoeconomics. Optimistic rollups, covered in depth in our optimistic rollup explainer, assume transactions are valid and rely on a challenge period plus fraud proofs to catch fraud. ZK rollups prove validity up front. The practical differences: optimistic rollups have mature EVM equivalence and cheap proving (there is no proving — just fraud-proof machinery); ZK rollups have fast finality, no withdrawal delays, and a stronger long-term security story. Arbitrum and Optimism still lead total-value-locked in 2026, but every new rollup that launches chooses ZK, and the existing optimistic stacks are migrating toward ZK fraud proofs. Ethereum's optimistic rollup docs and the ZK rollup docs put the contrast side by side.
​

Stablecoin flow has followed ZK rollups more aggressively than any other Layer 2 use case. Fast finality plus low fees plus Ethereum settlement is the exact profile payments and treasury teams want. USDC, USDT, and USDC.e are live on every major ZK rollup, and cross-chain stablecoin movement between them increasingly uses intent-based protocols rather than slow native bridges. For teams moving stablecoins between L2s — including ZK rollups, optimistic rollups, and newer chains — Eco's orchestration network handles the routing, solver selection, and settlement under one API, so the cross-rollup complexity stays below the application layer.
​

For a team porting an existing Solidity codebase, the order of least-surprising to most-surprising is typically: optimistic rollups (near-perfect equivalence), Scroll and Linea (Type 2 zkEVMs), Polygon zkEVM (Type 2/3), zkSync Era (Type 4, some changes needed), Starknet (rewrite in Cairo). Tooling (Hardhat, Foundry, MetaMask) works across all of them, and block explorers are universally available. If your contract does not rely on exotic opcodes, the porting exercise is usually measured in days, not weeks.
​

Three honest limitations remain in 2026. Prover cost is still meaningful at scale — cheaper than it was, but a real line item for high-throughput rollups. Sequencer decentralization is a work-in-progress across the industry. And cross-rollup composability — calling a contract on zkSync from a contract on Scroll atomically — is still solved at the intent layer rather than natively. ethresear.ch's ongoing threads are where the frontier of these problems gets worked out in public.
​

Pick a ZK rollup if you need: fast withdrawals back to Ethereum (minutes, not a week), strong cryptographic finality for compliance or settlement reasons, cheap fees at high throughput, or a forward-looking security story. Pick an optimistic rollup if you need: maximum EVM equivalence, proven years-long operational track record, or the ecosystem depth of Arbitrum and Optimism. Most production teams in 2026 end up deploying on both and routing between them.
​

ZK rollups prove validity upfront with a cryptographic proof that Ethereum verifies for every batch. Optimistic rollups assume validity and rely on a seven-day challenge window plus fraud proofs. The result: ZK rollups offer fast finality and fast withdrawals; optimistic rollups offer simpler tech and deeper EVM equivalence today.
​

Most production ZK rollups run a centralized sequencer and a permissioned prover network today. Data is still posted to Ethereum, so users can always exit. Decentralizing sequencers and provers is active work across zkSync, Scroll, Polygon zkEVM, and Starknet — track L2Beat's risk scores for live status.
​

After EIP-4844 landed blob data, ZK rollup fees for simple transfers dropped to the single-digit cents range on most major rollups. That is roughly a 10x reduction from pre-4844 levels and typically 50-100x cheaper than Ethereum L1. L2Fees.info tracks representative transactions live.
​

Yes. zkSync Era, Polygon zkEVM, Scroll, Linea, and Starknet have been live on mainnet for years, with billions in TVL collectively. Production stablecoin teams deploy on them routinely. The remaining open problems — sequencer decentralization, cross-rollup atomic composability, prover efficiency — are engineering work, not open research.
​

If you want maximum Solidity compatibility, Scroll or Linea. If you want a mature stack with deep ecosystem integrations, Polygon zkEVM or zkSync Era. If prover cost dominates and you can work in Cairo, Starknet. Most production teams end up on two or three and route between them at the application layer.
​

A zkEVM is a ZK rollup that runs EVM bytecode. Vitalik's taxonomy names four types: Type 1 (fully Ethereum-equivalent), Type 2 (EVM-equivalent with minor state changes), Type 3 (EVM-compatible with some opcode differences), Type 4 (compiles Solidity to a custom VM). Higher numbers mean faster proving; lower numbers mean better equivalence.
​