Chapter 00 — Why it matters
On Solana, compute is cheap.
Memory is what costs.
Every account you create costs money. Try to reach a million users and you hit that wall. Light Protocol's ZK Compression dropped the price of memory by orders of magnitude. Let's start by feeling how tall the wall is.
The expensive part isn't computing — it's shelf space. Solana is known for cheap transactions, but keeping an account on the shelf carries a separate rent. The more users you have, the higher that rent stacks.
Solana has two places to store things
Both are "onchain," yet the price differs wildly depending on where you put the data. ZK Compression's whole idea is to use both, deliberately.
DEMOMove the data and watch
Press the button and accounts A–D travel from prime real estate down into the archive below. All that stays upstairs is a 32-byte fingerprint (hash).
Account space (upstairs)
What validators hold in memory at all times. Programs can read it instantly, but you pay rent just to keep it there.
Rent: expensive
Ledger (the archive)
Where transaction records pile up. Costs almost nothing, but programs cannot read it directly.
Rent: near zero
So ZK Compression doesn't delete anything. It changes where data lives and leaves just a fingerprint upstairs. That single idea runs through every chapter from 00 to 05.
Measuring the wall: a rent calculator
Pick how many people your app hands tokens to. We'll put regular token accounts and compressed accounts side by side.
DEMODrag the user count
The slider runs from 1,000 to 100 million. Figures are estimates based on published numbers.
Horizontal axis is logarithmic (each step is 100x). Units are SOL.
Move the slider and both bars grow — but the gap between them never changes. That constant gap is the published 5,000x ratio, drawn to scale.
Assumptions: about 0.002 SOL per regular account and about 0.0000004 SOL per compressed account (derived from the official "100 accounts = 0.2 SOL / 0.00004 SOL" table). USD figures assume 1 SOL = $150, for reference only.
The example from the official keynote: a million token accounts.
Source: the ZK Compression keynote at Breakpoint 2024 (Helius blog). At a SOL price of $150, 1,000 accounts cost around $300 and a million around $300,000. The $60 on the compressed side is calculated on the same assumption.
You're not the only one paying
The rent comes out of your wallet. But the accounts themselves never go away either — validators worldwide keep holding them. Those two forces pull against each other, which is why the price can't simply be cut.
① Out of your wallet
You pay per person, up front
Handing someone a token requires an account of their own, at roughly 0.002 SOL each. That cost leaves your wallet, multiplied by your user count, before you've shipped a single feature.
1M people = 2,000 SOL
② Across the whole network
Make it cheap and you get too many
Accounts don't disappear once created; validators worldwide keep holding them. So cutting the rent means more of them pile up. Make it cheaper and don't let it grow are locked in a tug of war.
Alarm line: 1GB / epoch
DEMOA look inside the rent formula
Rent is size times a per-byte price. Start by looking inside the size.
Size you are billed for effective_size
128 + 165 = 293 B × per-byte price = rent per account
Today's price: 6,960
0.00203928 SOL
for 1M people 2,039 SOL
Proposed price: 696
0.00020393 SOL
for 1M people 204 SOL
The price 6,960 is a constant set years ago. As SOL climbed, rent kept rising in real terms.
DEMOThe tug of war over the price
One proposal cuts the price, another stops it going too far. Five steps to follow.
Starting point. The price is 6,960, so one token account costs about 0.00204 SOL — too steep for developers.
As long as every account needs its own spot upstairs, there's no escaping this tug of war. ZK Compression solves it from outside the rope.
An honest note
- Every figure on this page is an estimate based on published numbers. Real rent depends on account size in bytes, and USD values move with the SOL price.
- Both "5000x" and "1000x" are phrases the project itself uses. The multiplier changes with what's being compared (token accounts vs PDAs), so whenever you see a number, check what was measured against what.
- The multiplier isn't fixed. Rent itself is under active review, and a tenfold cut to the per-byte price would narrow the gap from roughly 5,000x to around 500x. Whenever you see a multiplier, check which per-byte price it assumes.
- What gets cheap is the shelf space — not everything. Compression brings its own costs in transaction size and compute, covered in chapters 02 and 03.
- The 1M users = about $300,000 figure and the airdrop story both assume the SOL price at the time in 2024. The often-quoted 500 million accounts, a million a day is also a May 2024 figure, and no refreshed official number could be confirmed since.
Chapter 01 — Anatomy
Why trust data
that isn't there?
In the last chapter the data moved down to the archive, leaving a 32-byte fingerprint upstairs. So how is that fingerprint made, and how does the chain confirm something really was there? Let's find out by hand.
A hash is a fingerprint of data. Change one character and you get an entirely different value. And no matter how long the original is, the fingerprint is always 32 bytes.
Folding four accounts into one root
Edit any number below. Real SHA-256 runs right here in your browser. Watch the colour travel upward from whichever leaf you changed.
DEMOBuild a Merkle tree
Edit a leaf and its fingerprint changes — along with every fingerprint above it. If the root changes, you know something was rewritten.
👆 Try changing a single character in any of them
Four accounts' worth of state collapsed into one 32-byte root. A real tree is 26 levels deep and holds around 67 million leaves — and still only the single root goes onchain.
This demo uses SHA-256. Light Protocol itself uses the Poseidon hash, which is friendlier to ZK circuits (more on that in chapter 04).
The proof is 128 bytes, however many you read
With only a root onchain, you have to show that your balance really is in that tree. Do it naively — send the whole path — and it falls apart fast.
DEMOCompare how much you have to send
Drag the number of accounts read at once. A Solana transaction caps out at 1,232 bytes.
Sending paths blew past the limit at just {n} accounts. The proof still fits in 128 bytes.
They all fit in one envelope
Any number of "yes, it really is in there" claims fold into a single proof. Add more accounts and the size stays 128 bytes.
✨ There's a story behind the number 128 —— we'll come back to it in chapter 04
Who keeps this machine running
Compression doesn't happen onchain alone. Three places, each with its own cast. Tap to read about them.
DEMOAnatomy
Tap whichever name interests you to see its job and where it runs.
Onchain
Ledger (the archive)
Workers outside the chain
👆 Tap a name
Seven characters here, and each one's job fits in a sentence.
Common mix-ups
These three trip up intermediate readers most often. Tap a card for the answer.
An honest note
- The tree on this page has four leaves; a real V1 state tree is 26 levels deep (about 67 million). Same mechanism, only the depth differs.
- The demo hashes with SHA-256 and builds parents by concatenating children's hex strings. The real implementation uses Poseidon and packs data differently. This is a simplified version for grasping the idea.
- Despite the "ZK" in the name, app developers don't write circuits. Generating and verifying proofs happens inside the protocol.
- 1,232 bytes is the cap on an entire Solana transaction. Even with a 128-byte proof, the data you read plus other instructions can still hit that ceiling.
- A proof shows that something is included in the tree — not that its contents are correct. Whether an amount is valid is checked separately by the program.
Chapter 02 — Lifecycle
What happens when
you send 5 USDC?
Chapter 01 introduced the cast. Now let's watch all of them work through a single transfer. The proof travels across three places: your device, off-chain services, and the chain itself.
A regular transfer takes one move. A compressed one takes five. More moves, but the upstairs rent drops to zero. Let's follow those moves.
DEMOFollow one transfer
Alice sends Bob 5 USDC. Each arrow shows only what is actually moving on that step.
The starting point. Alice wants to send Bob 5 USDC. All she holds is a private key — the balance itself sits down in the archive.
What those moves cost
The rent is gone. In its place comes computation. Here's how much, next to a regular transfer.
DEMOCompare the compute (CU)
CU is Solana's unit of computation. The breakdown for the compressed transfer comes from the official documentation.
This exceeds the default ceiling of 200,000 CU, so you have to request a larger compute budget explicitly.
What you pay
Compute, and bytes on the wire
On top of the 128-byte proof, the account data you read or write rides along in the transaction. The 1,232-byte ceiling gets close fast.
about 65x the CU
What you get
Zero rent upstairs
No account to create for each recipient. Hand tokens to a million people and none of it is paid up front.
2,000 SOL of rent → 0
An honest note
- A single state tree has a write ceiling of 12,000,000 CU per block. At 292,000 CU per transfer that's about 41 of them. This is why the trees come as a forest rather than one tree.
- V2's "up to 70% reduction" is a stated maximum. Real savings vary with conditions, so treat the V2 bar here as an approximation.
- The proof is a fixed 128-byte allowance per transaction. But the account data itself is sent separately, and that part grows with how many accounts you touch.
- The ~4,500 CU for a regular SPL transfer is a commonly measured figure, not an official constant. It's here to convey the order of magnitude.
- Of these five moves, the extra waiting unique to compression is only the first two. Proof generation is optimised to milliseconds, and the confirmation wait after sending is the same as any transfer.
Chapter 03 — Where it fits
Where it works,
and where it doesn't.
Compression isn't universal. The ceiling from chapter 02 — roughly 41 writes per block per tree — largely decides what it suits. Try your own case against it.
The upside comes from count; the ceiling comes from frequency. More accounts means more savings, and more writes means hitting a tree's throughput budget.
DEMOTry your own case
Pick how many accounts you need and how often each is written. We'll work out the rent saved and the throughput required.
This is where compression shines
Many accounts, written sparingly. Airdrops and large-scale PDA issuance live right here.
The per-tree budget is an estimate from 12,000,000 CU per block ÷ 292,000 CU per write ≈ 41. Real capacity shifts with how writes are spread and how trees are operated.
Where it's actually used
Four representative cases, all sitting in the ◎ zone. Tap a card to open it.
The biggest trade-off
You gave up the rent and gained a new dependency. This is the decisive difference from a regular account.
DEMOWhat if the indexer stops?
Flip the switch. See what becomes unreadable — and what stays safe.
Both read fine. The difference only shows up when the indexer goes down.
An honest note
- You can run the indexer yourself — Photon is open source. In practice most setups lean on a provider, so the concentration risk doesn't vanish.
- The acquisition announcement said the Light Token SDK is slated for sunset, while ZK Compression itself was explicitly confirmed to continue. If you're weighing a payments use case, check the current status first.
- Audits were done by OtterSec, Neodyme and Zellic, the circuits were formally verified by Reilabs, and a bug bounty runs on Immunefi. An audit is still not proof that no bugs exist.
- The "about 41 per block" figure assumes V1's 292,000 CU. If V2 lowers the compute, that ceiling rises. The constraint isn't fixed.
- This page's verdict is a simple model looking only at rent and throughput. Real designs also weigh data size, concurrency, and who operates what.
Chapter 04 — Toward privacy
This company began
with secrets.
Light Protocol started in 2021 as a privacy company. Compression was something invented along the way. In 2026 it returns to where it began — and you'll also find out whose tools the last three chapters were quietly standing on.
Remember the 128 bytes from chapter 01? The reason that number is 128 comes down to a tool Light wrote into Solana itself.
DEMOWhere 128 bytes comes from
A Groth16 proof is 256 bytes as it stands. Watch the moment it halves.
sol_alt_bn128_compression
Light is who wrote that compression syscall into Solana. The 128 bytes you saw in chapter 01 is a product of this very tool.
Light's fingerprints, inside Solana itself
Back in 2021, the maths Light needed for privacy simply wasn't in Solana. So they wrote it and got it merged. Every chapter you've read has been running on top of it.
sol_poseidon
A hash that suits ZK circuits. The fingerprints in the state tree are made with this.
the tree in ch01
sol_alt_bn128_group_op
Elliptic curve maths for verifying proofs: pairing, addition, multiplication.
ch02's 100k CU check
sol_alt_bn128_compression
Compression that folds a proof to half its size — 256 bytes becomes 128.
ch01's 128 bytes
Which means every ZK application on Solana runs on ground Light laid. Compression turned out to be one use of that ground.
Transfers you can see, transfers you can hide
"Privacy" means different things depending on what gets hidden. Here's the same single transfer, shown three ways.
DEMOWhat's visible, what's hidden
Switch approaches with the buttons and watch what an explorer would show.
Everything is public. Who sent what to whom, readable by anyone in the world.
A map of privacy on Solana
Three approaches that often get conflated, sorted by what they encrypt. Watch the status labels too.
Confidential BalancesLIVE
Encrypts: the amount only
Arrived April 2025 as a Token-2022 extension. ElGamal homomorphic encryption hides amounts, but addresses stay visible. Confidentiality, not anonymity.
Solana Privacy ProtocolANNOUNCED
Encrypts: sender, receiver, asset and amount
The main thrust after Helius acquired Light. Fully onchain, with no wrapped tokens or bridges. Viewing rights can be granted to an auditor and revoked.
MPC-based (e.g. Arcium)ANOTHER ROAD
Encrypts: the computation itself
A different approach from ZK, computing over data while it stays encrypted. Same word "privacy," different machinery — worth care when comparing.
2026.06.10
Helius acquires Light Protocol
An honest note
- Solana Privacy Protocol is still not generally available as of July 2026. The acquisition announcement said developer access would come "in the coming months." What this page shows reflects that announcement, not a running feature.
- Confidential Balances provides confidentiality, not anonymity. Amounts are hidden, but who transacted with whom remains visible. That distinction matters a great deal.
- The encrypted display in this demo is a schematic for explaining what a viewer would see. It does not reproduce the real format or length of any ciphertext.
- Privacy technology sits close to regulation in every jurisdiction. That's why features like selective disclosure exist, but legal treatment varies by place and by year.
- The auditor mechanism means different things in the two approaches. Confidential Balances uses a global auditor set on the mint by the issuer, covering every transfer amount for that token. Privacy Protocol was announced as rights the user grants and revokes. Don't assume "has an auditor" means the same thing in both.
- The acquisition price was not disclosed. Everything in this chapter reflects announcements and reporting at the time; check official sources for the current state.
Chapter 05 — The journey
Five years, and how
to read them.
From 2021 to 2026. This timeline mixes things that were merely announced with things that actually shipped. Reading those two apart is the tool this site most wants to leave you with.
"Announced" and "you can use it" are two different events. Let's see how far apart they actually sit, using real dates.
DATAFrom announcement to launch
Two firmly dated cases, and one still in progress.
ZK Compression
ZK Compression V2
Solana Privacy Protocol
days (as of July 2026)
Sometimes three months, sometimes ten. So whenever you read the news, keep asking: is this an announcement, or is it live?
2021 → 2026
Use the filter to show only what shipped, or only what was announced.
DEMOFilter the timeline
The same history reads differently once you narrow it to what you care about.
-
2021
Founded, as a privacy companyORIGIN
Started by Swen Schäferjohann and others. The work began with ZK-based private voting, and moved on toward private transfers on Solana.
-
2022.10
Seed round led by PolychainANNOUNCED
The investors listed on the official site are Polychain Capital, Solana Ventures, Steve Vasallo, Balaji Srinivasan and others. Reporting puts the figure at about $4.5M while databases list about $4.2M — the sources disagree.
-
2022
Light v1 goes liveSHIPPED
Around 2,000 users were reported at the time to have shielded roughly $1.5M. Compression wasn't even an idea yet.
-
2023–24
ZK syscalls land in Solana itselfSHIPPED
The maths privacy needed didn't exist, so they wrote it and got it merged — the three from chapter 04. Released in v1.17, with mainnet activation rolling out in stages. This became the ground compression would later stand on.
-
2023
Light v3 / PSP announcedANNOUNCED
A vision of private Solana programs. But the market winter deepened, and a change of direction began.
-
2024.06.21
ZK Compression announced (devnet)ANNOUNCED
Built with Helius and the Solana Foundation. An argument broke out almost immediately over whether this was "really an L2."
-
2024.09.18
ZK Compression reaches mainnetSHIPPED
Released at Breakpoint 2024. Everything you explored in chapters 00 through 03 became usable from here.
-
2025.04
Confidential Balances arrivesSHIPPED
Not Light's work, but one of the three on chapter 04's map. Hiding amounts became available as a Token-2022 extension.
-
2025
V2 and Light Token Program announcedANNOUNCED
Batched trees for V2 at Accelerate, and the hot/cold Light Token Program at Breakpoint. Both were announcements at this point.
-
2026.03.24
V2 ships in production (v0.23.0)SHIPPED
The "up to 70% less" you toggled in chapter 02 became real here — about ten months after it was announced.
-
2026 Q1
Light Token SDK reaches mainnetSHIPPED
Brought token account costs down to $0.001. The acquisition announcement that followed said it is slated for sunset.
-
2026.06.10
Helius acquires Light ProtocolANNOUNCED
The aim: build Solana's canonical privacy layer. Five years on, back where it started. ZK Compression was confirmed to continue at the same time.
-
2026.07
Privacy Protocol is still pendingIN PROGRESS
Developer access was described as coming "in the coming months." By the time you read this, that may well have changed — check the official announcements.
13 / 13
Not a detour — a round trip
Tools built for privacy produced compression, and that compression came back around to privacy. Here's everything you touched on this site, on one line.
They wanted to keep secrets
The tools didn't exist, so they wrote the Poseidon and elliptic curve syscalls and got them into Solana.
Those tools made memory cheap
Fold it with hashes, confirm it with a 128-byte proof. Rent disappeared, and reaching a million people became possible.
And now, back to secrets
Compressed state suits ZK by design. The original goal is being rebuilt on top of what came from chasing it.
Where this one sits in the series
Making Solana fast is split across layers, each carried by a different project. This illustrated series walks them one at a time.
An honest note
- This timeline reflects July 2026. The Privacy Protocol entry in particular is the one most likely to have changed by the time you read it.
- The seed round figure differs by source: about $4.5M in reporting, about $4.2M in databases. We can't determine which is right, so both are shown.
- The "about 300 days" for V2 is an estimate, since the announcement date isn't known to the day. The launch date of 24 March 2026 is firm.
- The figure of over 90 million compressed accounts comes from the official site (as of 2026). How it is counted and how often it updates aren't published.
- This is an unofficial, fan-made guide. The numbers and demos are illustrative; always check primary sources before making implementation decisions.
Thank you for reading all the way here.
The expensive part was never compute — it was memory. Leave only a fingerprint and it gets cheap. And the tool for checking that fingerprint had been built five years earlier, for privacy. I hope this one continuous story was worth your time.