We didn't need another price prediction. We didn't ask for a bottom call, an ETF flow forecast, or a soothing tweet about liquidity conditions. What Vitalik Buterin offered instead — somewhere between a blog post and a fireside chat — was something far more unusual: a probability attached to mathematics. His estimate, as reported, is that SNARKs, fully homomorphic encryption, and indistinguishability obfuscation have roughly a 60% chance of reaching what he calls 'sub-10x overhead.'
Strip away the jargon and the number becomes luminous. Sub-10x means the cost of proving, computing on, and hiding data falls below ten times the cost of doing the same work in plaintext. On its face, the statement reads like an academic footnote. It is not. In a bear market where operators are bleeding and the word 'survival' has replaced the word 'ape,' a technically grounded probability about the cost curve of cryptographic primitives is perhaps the most actionable thing anyone has published this quarter. Price predictions tell you what markets think of the past. This number tells you something about which protocols might exist in the future.
Let's place the three primitives on a map, because they are not interchangeable and they almost never receive equal attention. zk-SNARKs — succinct non-interactive arguments of knowledge — are the industrial workhorses of the zero-knowledge era. They let a prover convince a verifier that a statement is true without revealing why it is true. Rollup ecosystems such as zkSync Era, Starknet, and Polygon's proving pipeline have turned them into the engine rooms of Layer 2 scaling, and their costs are already something the market can measure in gas statements and sequencer fees.
Fully homomorphic encryption is the longer bet. FHE allows a computer to perform arbitrary operations on encrypted data without ever decrypting it. Where ZK proves a claim about hidden data, FHE computes directly on hidden data as though the data were visible. Since Craig Gentry's thesis in 2009, the field has struggled with astronomical overheads — sometimes thousands of times slower than plaintext computation. That is the reason we have never had a practical private smart contract at scale that does real computation on encrypted state.
iO — indistinguishability obfuscation — is the strangest and, in some ways, the most powerful of the three. An obfuscator takes a program and transforms it into a functionally identical black box, from which no adversary can meaningfully reverse-engineer the original logic. For over a decade, iO was practically theoretical, closer to a cryptographic philosopher's stone than a deployable component.
Vitalik's claim is not that these are solved. What he reportedly conveys is a confidence level on a shared trajectory. My reading — informed by my own frustrated attempts in 2017, when I abandoned scheduled fiat audit work to build a proof-of-knowledge demo in ZoKrates, convinced that mathematics was the new social contract — is that we are looking at the difference between a primitive that remains a research artifact and one that becomes a default.
That distinction matters more than it sounds. For years, all three families have lived in a world where overheads of 100x or 1,000x were simply accepted as the entry fee for privacy. Sub-10x is not just another performance milestone. It is a psychological level. When the multiplier lives at one digit, design intuition flips from 'we add privacy to this app' to 'we build privacy in from the start.' The compiler can hide the machinery. The application interface no longer punishes the user for caring about confidentiality.
I have watched adoption curves for a decade — for governance frameworks, for liquidity incentive designs, for NFT reputation schemes — and the pattern is consistent: humans rarely adopt the best technology; they adopt the technology whose cost fits into their existing workflow. During DeFi Summer, when I was running weekly Governance Jam sessions on Discord with over 500 participants, the proposals we ratified were rarely the mathematically elegant ones. They were the ones that asked nothing new of participants. That principle generalizes to cryptography. Privacy isn't adopted when it is philosophically compelling. It is adopted when the compiler hides the complexity and the user's mental tab stays low. That is what sub-10x overhead actually buys.
There is also an operator's argument hiding inside this number, and it is more urgent than the philosophical one. Over the past several quarters, I have watched Layer 2 teams treat proving costs as if they were weather — an external force to endure and complain about. In my audit work on ZK rollup architectures, the same spreadsheet keeps appearing: proving overhead versus transaction fee revenue. In a bull market, fee spikes conveniently obscure the mismatch. In a bear market, the mismatch is the story. The recent decline in activity has stripped away the subsidy that high gas prices used to provide, and the operators who are bleeding today are not bleeding because their product is bad. They are bleeding because the cryptographic overhead of their own stacks has become higher than the market value of what they settle.
Proving costs are not weather. They are architecture. If the cost of generating and verifying a proof fell by an order of magnitude, a substantial portion of today's L2 treasury burn disappears even with gas prices permanently stuck at bear levels. If proving costs stay where they are, a meaningful share of these teams will face a solvency question before the next bull cycle arrives. That is why Vitalik's 60% is, in my view, a survival metric dressed up as a research prediction. A sub-10x world is not merely a faster world. It is a world in which the bottom of the cost curve no longer kills the participants who are building on it.
The hidden detail in the report — the one no one in the market has yet priced — is that these primitives are already embedded in production systems, just at punishing costs. zk-SNARKs are load-bearing in every major rollup. The question was never whether they work. It was whether they could become cheap enough to run everywhere. If the industry obtains an order-of-magnitude improvement in proving efficiency, the consequences are not a new token narrative. The consequences are that data privacy and compute efficiency stop being trade-offs and start being complementary properties.
Let me go primitive by primitive, because the 60% probability is not evenly distributed across all three. For zk-SNARKs, the probability feels almost conservative. The timeline of zero-knowledge proving has been a repeated story of asymptotic cleverness: folding schemes such as Nova and ProtoStar, custom gates, lookup arguments, and increasingly specialized hardware have each delivered multiplicative gains. We are no longer waiting for a single white paper to change everything. We are watching a Cambrian explosion of incremental engineering. The progress is no longer gated on a breakthrough; it is gated on integration. That is the definition of an industry that reaches sub-10x within a visible time window.
FHE is the more radical claim. General-purpose fully homomorphic encryption at sub-10x overhead is not an extension of today's state of the art; it is a leap. The honest reading is that the first practical deployments will not be general-purpose at all. They will be application-specific, leveled homomorphic schemes optimized for machine-learning inference or private database queries. The engineering trick will be in reducing the scope of the computation until the overhead becomes tolerable, then expanding scope from there. The path to sub-10x FHE runs through narrow corridors, not through open plains. That fact does not reduce the importance of the destination — a chain where a DAO treasury can compute over encrypted votes without ever exposing individual preferences — but it should temper our expectations about how quickly the full version of the promise arrives.
iO is the hardest of the three, and I suspect Vitalik would admit as much in a longer conversation. Indistinguishability obfuscation is the crown jewel because it subsumes so many other primitives: if you can obfuscate programs effectively, you can wrap homomorphic operations inside the obfuscated logic and achieve FHE-like outcomes without separately deploying an FHE scheme. But real-world iO constructions remain slow, unwieldy, and difficult to audit. The gap between a feasibility result and a production obfuscator is enormous. When I read the news of Vitalik's estimate, my first instinct was to discount the iO component heavily and assume the aggregate 60% is really doing most of its work in the ZK and FHE columns.
Even with that discount, the strategic picture does not change. In a crypto ecosystem starved for credible technical narratives — where every other announcement is a token unlock or a points program — this is a reminder that the industry's deepest value layer is still math, not marketing. The report's risk flags are worth stating plainly: there is no audited code, no public repository, no peer review behind Vitalik's statement. This is an informed opinion from one of the most sophisticated technologists in our field, not a shipped product. The moment we confuse the two is the moment we drift back into the speculative habits that bear markets exist to punish.
What interests me more than the 60% itself is the conversation it opens about governance. As someone who has spent the better part of the past decade building DAO governance frameworks, I have noticed that our accountability models are brutally limited by the transparency of data. We can audit a treasury because we can see its transactions. We can audit a voting process because votes are public. But the moment we demand privacy — for negotiations, for health data, for personnel decisions inside a decentralized organization — our audit tools stop working. The only answer we have invented so far is the trusted intermediary, which defeats the entire purpose of decentralization.
Sub-10x FHE and iO change that equation. In 2025, I collaborated with an AI ethics lab in Chicago on what we called an Ethical Constraint Protocol — a framework for autonomous DAO treasuries where AI agents manage multi-sig wallets under human-in-the-loop oversight. The hardest design problem was not the smart contract logic. It was the impossibility of keeping strategic treasury decisions private while still proving to stakeholders that constraints were respected. We wanted the code to be auditable without exposing the data it operated on. We wanted the community to verify the constraints without seeing the contents. That tension is exactly what FHE and iO are designed to resolve — the ability to check a computation without revealing the raw materials of that computation.
The deepest contribution of sub-10x cryptography is not speed. It is the possibility of accountable opacity — a world where a DAO can process sensitive information without a central party, and where counterparties can verify behavior without violating confidentiality. That is a governance upgrade, not just an efficiency upgrade. It is the difference between a system that asks you to trust a leader and a system that asks you to trust a proof.
This is also why I keep returning to the identity dimension. We spent 2021 and 2022 debating whether NFTs were profile pictures or status signals, while the real action was happening underneath: the emergence of portable, self-sovereign claims. Identity isn't a badge. It isn't a wallet with a balance. It is a set of verifiable claims about what a person or protocol has actually done — and those claims, once we have iO and FHE at acceptable costs, can be both private and provable. The future of reputation will not be built on publicly doxxed attestations. It will be built on proofs that reveal only what the holder chooses to reveal.
Now for the contrarian angle, because we owe it to ourselves to ask what the 40% failure scenario actually looks like. The most obvious failure mode is mathematical: the research community simply does not get there, or gets there too late to matter. But I have lived through enough bear markets to know that the more likely failure mode is not the math. It is us.
We have watched technically sound protocols remain half-dead for years not because the code was broken, but because the surrounding ecosystem never reached escape velocity. The Lightning Network has been a demonstration of technical viability for seven years, and yet routing failures and channel management complexity have kept it confined to a niche. The lesson is not that Lightning's creators failed. The lesson is that technical viability is necessary but not sufficient for adoption. A primitive needs distribution, discoverability, and a community willing to suffer through its rough edges. Those are social facts, not mathematical ones.
The same risk applies to FHE and iO. Even if every cryptographer on Earth wakes up tomorrow with a sub-10x implementation, the real work will be in frontend tooling, developer education, and institutional willingness to surrender the ability to peek at user data. Privacy tools have historically suffered from a distribution problem: the people who need them most are often the ones least capable of deploying them. If we repeat that pattern, Vitalik's 60% becomes irrelevant no matter which direction the math breaks.
There is also a darker reading of the iO story that we should not wave away. Obfuscation is a tool that protects code from reverse-engineering. In the hands of a decentralized community, that is liberation. In the hands of a centralized corporation or a state actor, it is a way to make enforcement algorithms invisible — a hidden rulebook that citizens cannot audit. The same cryptographic progress that enables accountable opacity for DAOs could enable unaccountable opacity for powerful institutions. The thing to fear about iO is not that it fails. It is that it succeeds and is captured first by the people with the most resources.
That is why my forecast for the next year is not about which token pumps. It is about which proving team publishes a reproducible, externally audited benchmark. Watch for three signals, in order. First, a major ZK-rollup team publishes a benchmark showing proof generation costs below ten times the equivalent execution cost on commodity hardware. Second, an FHE library ships a practical SDK that lets Solidity developers invoke encrypted computation without manually managing polynomial noise budgets. Third, an independent audit firm — CertiK, OpenZeppelin, Trail of Bits — issues a report on an iO-adjacent construction rather than another ERC-20 wrapper. Any one of those signals is more valuable than a thousand alpha leaks. It would confirm that Vitalik's probability is moving in the right direction.
During the 2022 crash, I spent months analyzing on-chain data for what I called 'silent builders' — teams with high code activity and low price correlation. I identified fifteen projects that kept shipping while the market narrative collapsed around them. Nearly all of them had one thing in common: they were reducing the cost or complexity of something fundamental. None of them were launching tokens. That experience taught me to read bear markets as research and development seasons. This quarter, the most interesting R&D signal in the entire industry is not a new L1 or a new game. It is an offhand probability estimate from the founder of Ethereum about the cost curves of cryptographic primitives.
I want to leave you with a subtlety that most summaries of this news will miss. When Vitalik says 60%, he is not saying 'probably yes.' He is saying 'yes, with a meaningful chance of no.' The honest response to that number is not euphoria and it is not dismissal. It is preparedness. Build your systems as if the breakthrough will happen. Structure your capital as if it might not. The protocols that survive this cycle will be the ones that do not depend on the 60/40 coin flip resolving in their favor. They will be the ones that can keep operating at today's overheads — and then simply get dramatically more efficient when the sub-10x era arrives.
I have spent years arguing that mathematics is the new social contract, and I still believe that. But a social contract requires more than math. It requires institutions that know how to use the math, communities that trust the proofs, and governance processes that give people a way to say no. Otherwise, the most beautiful cryptographic constructions become empty cathedrals — built with brilliance, visited by few, and maintained by no one.
The 40% failure probability is not an argument against hope. It is an argument for doing the unglamorous work of integration, education, and governance that turns mathematical possibility into lived reality. If sub-10x overhead arrives and we fail to distribute it fairly, we will have failed the test that matters most. But if we prepare the social layer now — if we build the interfaces, the ethical constraints, and the governance rails — then the next decade of cryptography will not just be fast. It will be free. Freedom isn't the absence of oversight; it's the presence of consent. Consent requires understanding, and understanding requires transparency. The sub-10x era promises to make transparency and privacy coexist. When that happens, the question will no longer be whether the math works. The question will be whether we built institutions worthy of it.
