Zero-Knowledge Proofs Could Reduce Key Risks in Blockchain Bridges

Blockchain bridges need to confirm that assets have moved between chains, but the systems used to approve those transfers can create attractive targets for attackers. Karel Kubat, founder of Union Labs, argues that zero-knowledge proofs offer another way to verify activity: prove a claim is true without revealing the underlying data or relying on a multisignature wallet to authorize the transfer.

The approach has implications beyond bridges. Zero-knowledge proofs can support private checks of identity or financial eligibility, and can bundle transactions to reduce the work required for verification. Kubat’s case is that these proofs can improve privacy and throughput while preserving decentralization. The practical question is how well the cryptographic machinery and its implementation hold up in real systems.

Proving a claim without exposing its data

A zero-knowledge proof lets one party convince another that a statement is true without disclosing the information behind it. For instance, a rental applicant could demonstrate that their income meets a lease requirement without sharing an exact salary or pay stubs. The recipient learns whether the condition is satisfied, while the applicant keeps the underlying details private.

Kubat describes the technical process as starting with arithmetization: translating a statement into mathematical functions. Those functions form a circuit, and the input data is checked through proving backends. The result is a cryptographic proof that the computation was carried out correctly. A verifier can check that proof without receiving the original data, and Kubat says the verification is inexpensive.

That separation between the claim and the information used to establish it is the central privacy benefit. A service can verify that a user meets a condition without collecting a full record of their finances or identity. The same pattern could apply to businesses or financial institutions demonstrating creditworthiness or other criteria in large transactions.

It does not make sensitive information disappear from every part of a system. The proof still depends on the correctness of the circuit, the proving process and the verifier. For teams assessing a deployment, those components are part of the design that needs scrutiny, alongside the data that users disclose.

Why bridges attract attackers

Bridges relay transactions or messages between separate blockchains. In the common transfer model described by Kubat, assets are locked on the original chain and then represented on the destination chain, where they are minted. During the process, assets held by the bridge can become a concentrated pool that attackers may try to access.

Many conventional bridges use multisignature wallets to approve transfers. Validators sign requests with private keys, and a transaction proceeds once enough signatures are gathered. If an attacker obtains the required keys, they may be able to authorize a withdrawal of the assets held in the bridge. A small validator group, or one participant with control over many signatures, can concentrate that risk.

Kubat points to the Ronin hack as an example of the danger created by concentrated signature control. His broader criticism is structural: when bridge security depends on a limited set of keys, compromising those keys can undermine the transfer process. Storing key material on automated systems can also expose it to attack.

In Kubat’s description, a zero-knowledge bridge removes the multisignature wallet and its associated private keys from this approval model. A proof can establish that funds were deposited on or sent to another chain without sending sensitive key information to the bridge server. That reduces the information available to an attacker and removes one specific route to unauthorized withdrawals.

The distinction matters: a proof can verify a computation or statement, but the security of a bridge still depends on the rest of its implementation and assumptions. Kubat presents the design as a way to avoid a key-based point of failure, rather than as a guarantee against every possible attack.

Security, independence and scaling

Kubat contrasts this design with blockchain systems that achieve security by having many machines execute the same code. With zero-knowledge proofs, he says, computation can happen on one machine, including a user’s machine, while other participants verify the result without seeing the input data. In his view, this can reduce shared data and computation while retaining decentralization.

He also argues that bridges built around proofs can operate independently of the organization that created them. If the project behind a bridge were to disappear, Kubat says, the bridge could continue to function without a central actor controlling the information it transfers between chains. That is a design claim about autonomy; it depends on the bridge’s actual code, operation and dependencies.

On throughput, proofs can allow multiple token transfers to be bundled into one transaction. Instead of verifying every transfer as a separate transaction, a system can verify the proof for the grouped computation. This can lower costs and increase efficiency, according to Kubat. The same mechanism that limits the amount of data revealed can also reduce repeated verification work.

Union Labs recently raised $4 million in seed financing to develop a cross-chain bridge using zero-knowledge proofs. The funding figure signals the project’s development stage, but the interview provides no benchmark results, cost comparisons or measured performance figures for the bridge. Those are the details teams will need when weighing the approach against existing systems.

Adoption depends on tooling

Kubat says the field’s academic depth makes it difficult for teams to adopt without specialist expertise. His advice to blockchain leaders is to work with experienced zero-knowledge projects that can help with implementation and explain the underlying technology. For project teams, that points to a practical constraint: integrating proofs requires knowledge and engineering capacity, not just a decision to add a privacy feature.

He sees education and developer tooling as important to wider use. Easier ways to build with zero-knowledge proofs, along with clearer learning resources, could lower the barrier for teams working on new or existing systems. The challenge is to make the tools accessible without obscuring what they prove, what assumptions they rely on, and how verification fits into a system’s security model.

Karel Kubat and Union Labs

Kubat is the founder of Union, which he describes as a trustless bridge powered by zero-knowledge technology. Before Union, he was CTO of Composable Finance, which he says he grew to a $450 million valuation. He has worked on smart contracts since 2016, starting with Solidity and adding Rust and Go in 2018.

His work has included developing the IBC Protocol on Substrate, associated with Polkadot. For developers evaluating proof-based bridges, the key takeaway is specific: zero-knowledge proofs can reduce data exposure and remove reliance on a set of signing keys, while transaction bundling can reduce verification overhead. Adoption will depend on teams being able to inspect the design, understand its assumptions and measure its performance in deployment.