Most activity on Ethereum happens on rollups: networks that run transactions on their own chain and post the results back to Ethereum. The largest of them are optimistic - the posted results are assumed honest, and anyone withdrawing funds waits out a challenge window, usually seven days, in case someone proves fraud in time.
ZK rollups work the other way: every batch comes with a validity proof that Ethereum checks, so a withdrawal can finalize once the proof is verified. The hybrid rollup adds validity proofs to an optimistic chain that is already running, without rebuilding it: the sequencer, contracts and users stay as they are, and withdrawals no longer have to wait out the challenge window.
Metis announced the Hybrid Rollup in March 2023, but the design depended on a prover that did not yet exist. While that prover was being built, post-quantum security became a requirement with published deadlines, and the Hybrid Rollup is now being completed with a proof path built to meet them.
The idea took shape in 2022, during that year's discussions about scaling Ethereum: keep the optimistic model, add zero-knowledge proofs, and get "developer flexibility and cryptographic finality" in one protocol. In March 2023, at ETHDenver, Metis announced it as the Hybrid Rollup, with the goal of cutting withdrawal times from seven days to roughly four hours. Metis's roadmap, published the following month, described the architecture as "STARK-based provers/verifiers on MIPS, generated by Cannon", said the rollup would be "achieved by utilizing zkMIPS", and listed "quantum safety" among the expected benefits.
Those terms need explaining.
Cannon is the fault-proof (fraud-proof) system developed for Optimism's codebase, on which Metis is also based. It runs a chain's state-transition logic as a program compiled for MIPS, a processor instruction set. In a dispute, the disagreement is narrowed down to a single MIPS instruction, which Ethereum then executes to settle it. The plan was to prove the same MIPS programs with zero-knowledge proofs instead, using a prover called zkMIPS.
Building zkMIPS was the largest part of the plan. The research team working on it became a separate project, ZKM, which launched in July 2023 as a project incubated by the Metis Foundation. Our chief scientist's concept piece, Hybrid Rollup, set out the full design: the two rollup types combined in one protocol, with zkMIPS as the prover.
The design was complete on paper. The prover it depended on did not exist yet.
Proving an optimistic chain's state means proving that the chain's own software - the node logic that derives and executes blocks - ran correctly. That can be done with a proof circuit written specifically for the chain, but the circuit then has to be rewritten every time the chain upgrades. The practical alternative is a zkVM: a prover that runs an ordinary program and produces a proof that it ran correctly, so the chain's existing code can be proven as it is.
In March 2023, no production-grade zkVM existed, at ZKM or anywhere else.
The rest of the industry faced the same limitation. OP Succinct, the first general way to upgrade an OP Stack chain to validity proofs, arrived in September 2024, eighteen months after the Hybrid Rollup was announced. Celo activated ZK-based fault proofs on its mainnet in December 2025. In February 2026, Optimism named Succinct its first preferred proving provider and said validity proofs would become canonical across the OP Stack. Adding ZK proofs to optimistic chains is now the industry's general direction, but the first production route to it appeared only in 2024.
Metis said at the time that the Hybrid Rollup was waiting on the prover. In March 2024, its CEO told an interviewer: "Once ZKM launches, Metis will unveil its very awaited Hybrid Rollup."
We spent the following three years building it. Work on the code began in October 2023. The first version of zkMIPS went public in February 2024 as an alpha testnet - a release for developers to test, not to run in production. The production-grade version came fourteen months later, after a complete overhaul of the prover's architecture: zkMIPS 1.0 shipped in May 2025, and in July it was renamed Ziren.
Ziren is a zkVM for programs compiled to MIPS32, an instruction set with decades of compilers and tooling behind it. We chose an established, stable instruction set deliberately; as the team wrote in July 2025, ZK systems must stay “secure not just today, but years from now”. The design, its security arguments and its measurements are published in the Ziren paper. Ziren has had two external security reviews: an audit by Veridise and fuzzing and vulnerability research by Consensys Diligence. Ziren 2.0, released this month, comes with machine-checked proofs in the Lean theorem prover that each of its circuit components is deterministic, and an average proving time of 8.6 seconds per Ethereum mainnet block on four GPUs, as listed on Ethproofs.
Ziren's first real-world deployment was on Bitcoin, not Ethereum. GOAT Network, a Bitcoin L2 built on the zkMIPS stack, launched its alpha mainnet in March 2025 - "the first real-world deployment of zkMIPS and a proving ground", as ZKM's update put it that spring. Proving went live there as the prover matured: by the end of July 2025, Ziren was proving GOAT's blocks in real time on its BitVM2 testnet, and in the last quarter of 2025 GOAT activated its native bridge on a trust-minimized, Ziren-based mechanism.
This matters for Ethereum for two reasons. GOAT is a Type-1 zkEVM, so what Ziren proves there - the execution of an EVM chain, block by block - is the same thing an Ethereum L2 needs proven. And Bitcoin is a harder environment for proofs than Ethereum: its base layer cannot run a proof verifier the way an Ethereum smart contract can, so a Bitcoin L2 has to enforce its proofs through more involved constructions such as BitVM2 and BitVM3.
Ziren has therefore already done the job an Ethereum L2 needs, in the more demanding environment.
Two things changed during those three years.
First, the original design is no longer new. With OP Succinct in production and Optimism moving to make validity proofs canonical, adding ZK proofs to an optimistic rollup is now a service several providers offer.
Second, and more importantly, post-quantum security went from being a vague concern to a concrete requirement with dates. A quantum computer large enough to run Shor's algorithm would break elliptic-curve cryptography, which most of the industry relies on, including the signatures that control blockchain accounts.
The requirement took shape gradually, over the same years the prover was being built:
These deadlines affect the hybrid rollup directly, because of how proofs reach Ethereum today. Nearly every zkVM proof submitted to Ethereum is first wrapped in a small elliptic-curve proof - Groth16 or PLONK, over the BN254 curve - because verifying the full proof directly on Ethereum costs too much gas. The wrapper is cheap to verify, but it depends on elliptic-curve cryptography, which a large enough quantum computer would break.
The standard way of adding ZK proofs to an optimistic rollup therefore does not meet the requirement pq.ethereum.org sets for zk-rollups: that the proof system itself be secured.
By mid-2025 our prover was production-grade, and it could have been integrated into the Hybrid Rollup as initially designed. By then, adding ZK proofs to optimistic chains was already in production elsewhere, and NIST had already proposed end dates for elliptic-curve cryptography.
We chose to build the Hybrid Rollup with the post-quantum proof path included from the start, rather than add one later.
In August 2025 we began the work, tracked publicly on GitHub, to remove the elliptic curves that remained in Ziren's path to Ethereum. There were two: one inside the proof system, used to keep memory consistent across the separate pieces a long computation is split into, and the BN254 wrapper described above.
The research went beyond the prover. The same engineers who built Ziren run Applied PQC, a post-quantum research group that has published a study of how L2s migrate to post-quantum cryptography and a browser playground that runs the NIST post-quantum schemes. GOAT Research has published a design for moving GOAT's validator consensus keys to ML-DSA-65, a NIST post-quantum signature standard. Both were public before NIST published its final transition dates in October.
The resulting design keeps everything in the 2023 version: the optimistic chain stays as it is, and validity proofs replace the challenge window. It adds one requirement: the proof's path to Ethereum must be hash-based from end to end, with no elliptic-curve wrapper, and the proof must be verified directly by the EVM. Quantum algorithms reduce the security margins of hash functions but are not known to break them, whereas a large enough quantum computer would break elliptic-curve cryptography outright.
We call this design the post-quantum hybrid rollup.
Both components named in Metis's 2023 roadmap now exist. In May 2025, Metis's Andromeda upgrade activated fraud proofs on its mainnet; the fault-proof program behind them, published in Metis's repository, is a Cannon-style program compiled to MIPS. Ziren is a STARK-based prover for MIPS programs, so the program Metis already runs for its fraud proofs is the kind of program Ziren proves.
Nothing in the 2023 architecture has been dropped. What has changed is the proof path, so that the system does not depend on cryptography with published end dates. Metis's 2023 roadmap listed quantum safety as an expected benefit of the Hybrid Rollup; in the current design, it is a requirement.
The work to remove the remaining elliptic curves is public and in progress, and we measure it against the rule we set out in September in Hash-based is not the same as post-quantum: read the security theorem, not the primitive list.
The switch happens in stages. Both proof paths are in the code from the start; the classical path, with the BN254 wrapper, is enabled first, and the hash-based path replaces it component by component - the memory check inside the proof and the final verification step. Until the last component is switched over, the chain runs on the classical path and carries no post-quantum claim.
Ziren is already in use on a Bitcoin L2 today. Ethereum L2s are next, starting with a partner we have worked with since the beginning. The Metis Foundation's portfolio describes ZKM as the verification layer of its stack, "built for longevity, ensuring that the proofs generated today remain valid."
The post-quantum hybrid rollup is how we intend to keep that true.
Most activity on Ethereum happens on rollups: networks that run transactions on their own chain and post the results back to Ethereum. The largest of them are optimistic - the posted results are assumed honest, and anyone withdrawing funds waits out a challenge window, usually seven days, in case someone proves fraud in time.
ZK rollups work the other way: every batch comes with a validity proof that Ethereum checks, so a withdrawal can finalize once the proof is verified. The hybrid rollup adds validity proofs to an optimistic chain that is already running, without rebuilding it: the sequencer, contracts and users stay as they are, and withdrawals no longer have to wait out the challenge window.
Metis announced the Hybrid Rollup in March 2023, but the design depended on a prover that did not yet exist. While that prover was being built, post-quantum security became a requirement with published deadlines, and the Hybrid Rollup is now being completed with a proof path built to meet them.
The idea took shape in 2022, during that year's discussions about scaling Ethereum: keep the optimistic model, add zero-knowledge proofs, and get "developer flexibility and cryptographic finality" in one protocol. In March 2023, at ETHDenver, Metis announced it as the Hybrid Rollup, with the goal of cutting withdrawal times from seven days to roughly four hours. Metis's roadmap, published the following month, described the architecture as "STARK-based provers/verifiers on MIPS, generated by Cannon", said the rollup would be "achieved by utilizing zkMIPS", and listed "quantum safety" among the expected benefits.
Those terms need explaining.
Cannon is the fault-proof (fraud-proof) system developed for Optimism's codebase, on which Metis is also based. It runs a chain's state-transition logic as a program compiled for MIPS, a processor instruction set. In a dispute, the disagreement is narrowed down to a single MIPS instruction, which Ethereum then executes to settle it. The plan was to prove the same MIPS programs with zero-knowledge proofs instead, using a prover called zkMIPS.
Building zkMIPS was the largest part of the plan. The research team working on it became a separate project, ZKM, which launched in July 2023 as a project incubated by the Metis Foundation. Our chief scientist's concept piece, Hybrid Rollup, set out the full design: the two rollup types combined in one protocol, with zkMIPS as the prover.
The design was complete on paper. The prover it depended on did not exist yet.
Proving an optimistic chain's state means proving that the chain's own software - the node logic that derives and executes blocks - ran correctly. That can be done with a proof circuit written specifically for the chain, but the circuit then has to be rewritten every time the chain upgrades. The practical alternative is a zkVM: a prover that runs an ordinary program and produces a proof that it ran correctly, so the chain's existing code can be proven as it is.
In March 2023, no production-grade zkVM existed, at ZKM or anywhere else.
The rest of the industry faced the same limitation. OP Succinct, the first general way to upgrade an OP Stack chain to validity proofs, arrived in September 2024, eighteen months after the Hybrid Rollup was announced. Celo activated ZK-based fault proofs on its mainnet in December 2025. In February 2026, Optimism named Succinct its first preferred proving provider and said validity proofs would become canonical across the OP Stack. Adding ZK proofs to optimistic chains is now the industry's general direction, but the first production route to it appeared only in 2024.
Metis said at the time that the Hybrid Rollup was waiting on the prover. In March 2024, its CEO told an interviewer: "Once ZKM launches, Metis will unveil its very awaited Hybrid Rollup."
We spent the following three years building it. Work on the code began in October 2023. The first version of zkMIPS went public in February 2024 as an alpha testnet - a release for developers to test, not to run in production. The production-grade version came fourteen months later, after a complete overhaul of the prover's architecture: zkMIPS 1.0 shipped in May 2025, and in July it was renamed Ziren.
Ziren is a zkVM for programs compiled to MIPS32, an instruction set with decades of compilers and tooling behind it. We chose an established, stable instruction set deliberately; as the team wrote in July 2025, ZK systems must stay “secure not just today, but years from now”. The design, its security arguments and its measurements are published in the Ziren paper. Ziren has had two external security reviews: an audit by Veridise and fuzzing and vulnerability research by Consensys Diligence. Ziren 2.0, released this month, comes with machine-checked proofs in the Lean theorem prover that each of its circuit components is deterministic, and an average proving time of 8.6 seconds per Ethereum mainnet block on four GPUs, as listed on Ethproofs.
Ziren's first real-world deployment was on Bitcoin, not Ethereum. GOAT Network, a Bitcoin L2 built on the zkMIPS stack, launched its alpha mainnet in March 2025 - "the first real-world deployment of zkMIPS and a proving ground", as ZKM's update put it that spring. Proving went live there as the prover matured: by the end of July 2025, Ziren was proving GOAT's blocks in real time on its BitVM2 testnet, and in the last quarter of 2025 GOAT activated its native bridge on a trust-minimized, Ziren-based mechanism.
This matters for Ethereum for two reasons. GOAT is a Type-1 zkEVM, so what Ziren proves there - the execution of an EVM chain, block by block - is the same thing an Ethereum L2 needs proven. And Bitcoin is a harder environment for proofs than Ethereum: its base layer cannot run a proof verifier the way an Ethereum smart contract can, so a Bitcoin L2 has to enforce its proofs through more involved constructions such as BitVM2 and BitVM3.
Ziren has therefore already done the job an Ethereum L2 needs, in the more demanding environment.
Two things changed during those three years.
First, the original design is no longer new. With OP Succinct in production and Optimism moving to make validity proofs canonical, adding ZK proofs to an optimistic rollup is now a service several providers offer.
Second, and more importantly, post-quantum security went from being a vague concern to a concrete requirement with dates. A quantum computer large enough to run Shor's algorithm would break elliptic-curve cryptography, which most of the industry relies on, including the signatures that control blockchain accounts.
The requirement took shape gradually, over the same years the prover was being built:
These deadlines affect the hybrid rollup directly, because of how proofs reach Ethereum today. Nearly every zkVM proof submitted to Ethereum is first wrapped in a small elliptic-curve proof - Groth16 or PLONK, over the BN254 curve - because verifying the full proof directly on Ethereum costs too much gas. The wrapper is cheap to verify, but it depends on elliptic-curve cryptography, which a large enough quantum computer would break.
The standard way of adding ZK proofs to an optimistic rollup therefore does not meet the requirement pq.ethereum.org sets for zk-rollups: that the proof system itself be secured.
By mid-2025 our prover was production-grade, and it could have been integrated into the Hybrid Rollup as initially designed. By then, adding ZK proofs to optimistic chains was already in production elsewhere, and NIST had already proposed end dates for elliptic-curve cryptography.
We chose to build the Hybrid Rollup with the post-quantum proof path included from the start, rather than add one later.
In August 2025 we began the work, tracked publicly on GitHub, to remove the elliptic curves that remained in Ziren's path to Ethereum. There were two: one inside the proof system, used to keep memory consistent across the separate pieces a long computation is split into, and the BN254 wrapper described above.
The research went beyond the prover. The same engineers who built Ziren run Applied PQC, a post-quantum research group that has published a study of how L2s migrate to post-quantum cryptography and a browser playground that runs the NIST post-quantum schemes. GOAT Research has published a design for moving GOAT's validator consensus keys to ML-DSA-65, a NIST post-quantum signature standard. Both were public before NIST published its final transition dates in October.
The resulting design keeps everything in the 2023 version: the optimistic chain stays as it is, and validity proofs replace the challenge window. It adds one requirement: the proof's path to Ethereum must be hash-based from end to end, with no elliptic-curve wrapper, and the proof must be verified directly by the EVM. Quantum algorithms reduce the security margins of hash functions but are not known to break them, whereas a large enough quantum computer would break elliptic-curve cryptography outright.
We call this design the post-quantum hybrid rollup.
Both components named in Metis's 2023 roadmap now exist. In May 2025, Metis's Andromeda upgrade activated fraud proofs on its mainnet; the fault-proof program behind them, published in Metis's repository, is a Cannon-style program compiled to MIPS. Ziren is a STARK-based prover for MIPS programs, so the program Metis already runs for its fraud proofs is the kind of program Ziren proves.
Nothing in the 2023 architecture has been dropped. What has changed is the proof path, so that the system does not depend on cryptography with published end dates. Metis's 2023 roadmap listed quantum safety as an expected benefit of the Hybrid Rollup; in the current design, it is a requirement.
The work to remove the remaining elliptic curves is public and in progress, and we measure it against the rule we set out in September in Hash-based is not the same as post-quantum: read the security theorem, not the primitive list.
The switch happens in stages. Both proof paths are in the code from the start; the classical path, with the BN254 wrapper, is enabled first, and the hash-based path replaces it component by component - the memory check inside the proof and the final verification step. Until the last component is switched over, the chain runs on the classical path and carries no post-quantum claim.
Ziren is already in use on a Bitcoin L2 today. Ethereum L2s are next, starting with a partner we have worked with since the beginning. The Metis Foundation's portfolio describes ZKM as the verification layer of its stack, "built for longevity, ensuring that the proofs generated today remain valid."
The post-quantum hybrid rollup is how we intend to keep that true.
.png)
