"If I wanted to destroy bitcoin I would just fund infinite developers who are very talented and tell them to make it better." - Michael Saylor on op_return I think he is not completely wrong, there is a risk. A risk of distraction, a risk of wanting to work on cool stuff because they are exciting, etc. those risks exist. BUT, in my opinion, what Michael Saylor actually thinks is closer to this: “If I wanted to destroy Bitcoin I would just scare people so that no one touches it and address the remaining issues and challenges that prevent Bitcoin to truly become P2P cash at the planet scale. It will make it easier for us to capture it and just hammer the NGU and digital gold narratives. Fuck their cypherpunk values and their hope of freedom.” Who benefit the most from scaring people from ever touching Bitcoin again to try to improve it and fulfill its promise ? I think that considering Bitcoin final now is the biggest gift to governments or any powerful adversarial forces that would want to capture Bitcoin or prevent it from being adopted widely as money, and not just as digital gold. Complacency also can kill Bitcoin. Job is not finished. The real fight has barely started.

Seeing some of the comments, I realize there might be some confusion or misunderstanding about what this means. I confirm and re-iterate that this is an incredible performance and that no other proving system in the world today can achieve such feats with this level of cost-efficiency, trustlessness, and soundness. We're pushing the boundaries of ZK tech to make Bitcoin's history verifiable in ways that were unimaginable before. First, some comments suggested sarcasm like: "They got it all the way 'down' to 6.5 hours", implying it's slow or underwhelming. Hmm, I think there's a huge confusion here! The 6.5 hours is the time to generate the FULL RECURSIVE PROOF for the entire chain. This is done ONLY ONCE, by ONE machine (and we're optimizing to bring costs down further). LETS FOCUS ON THE REAL DEAL => Verification takes just 50-100 MILLISECONDS, even on small devices like phones. It's not about proving time, it's the asymmetry STARKs provide: proving is compute-intensive but one-off; verifying is blazing fast and scales infinitely. As we work hard to be able to prove full block execution (scripts, txs, etc.), verification will still be ~100ms for the whole chain. That's the game-changer! Next element: "Proofs don’t validate." Actually, verifying the proof does validate! Instead of re-executing everything (the slow, traditional way), you verify the STARK proof, which cryptographically guarantees the same result, but exponentially faster and with less computation. It's like compressing validation into a tiny, efficient check without sacrificing security. To explain further, here's a high-level workflow for our Compressed SPV Proof (using STARKs via Cairo+Stwo): - Batch Execution: An executor processes batches of Bitcoin block headers (e.g., 1-10k, then 10k-20k) with bootloader and assumevalid Cairo programs, generating traces and execution inputs. - Proof Generation: A prover creates a STARK proof attesting that block validation logic was correctly executed over those headers. - Verification: The compressed proof + current chain state + MMR root goes to an on-chain/off-chain verifier, which trustlessly confirms:Validity & linkage of all headers back to genesis. * Target block's inclusion (via MMR proof). * Sufficient cumulative difficulty/work. * Correct timestamps & consensus rules. * Target tx inclusion (via Merkle/SPV proof). See more details: https://github.com/starkware-bitcoin/raito

This is for the proof generation of the whole header chain. Not for the verification. The verification of the proof takes 50-100ms even on a small device.

Yes 👍

As for the non interactive part, it’s being obtained using Fiat Shamir, which enable to simulate some random oracle and queries of the verifier without interactivity

The zero knowledge part is from the verifier perspective. The prover needs of course the knowledge of the chain in this case. Btw note that we use a STARK proof here for the scaling properties and not for the privacy aspect. The goal is then to be able to verify in 50-100ms the validity of the entire header chain even on a small device like a phone

Machine: c4-highmem-32 32 vcpus 248 GB RAM Actual usage is 190/248, in "real-time" mode <100GB proof size: ~1MB on-demand hourly cost is $2.085424 USD total cost: 2.085424*6.5 = $13.55 and this is not even the final form! (this is WITHOUT SHA256 builtin, Cairo M31, GPU acceleration, Proving parallelization) https://github.com/starkware-bitcoin/raito

NEW WORLD RECORD. WE CAN PROVE THE WHOLE BITCOIN BLOCK HEADER CHAIN IN 6.5 HOURS. FOR $13.5. YES, WE HAVE PROVEN 16 YEARS OF BLOCKCHAIN HISTORY OF A $2 TRILLION ASSET FOR LESS THAN A BIG MAC COMBO MENU. STWO, FASTEST PROVER IN THE WORLD, BACKBONE OF STARKNET.

One day you will pay using fiat currency for the last time without even realizing it. Bitcoin.

Welcome to the freedom of speech protocol