Bitcoin consensus, proven with Core's own code. Verify one small proof.
Hazync runs Bitcoin Core's own unmodified consensus code inside a zero-knowledge VM, script by script, signature by signature, and folds it into a single succinct proof. Not a reimplementation. The exact code the network already trusts.
The difference
Everyone else reimplements consensus. We don't.
Every prior effort expresses Bitcoin's rules in a circuit language, and inherits one question forever: does the reimplementation match Core in every edge case? Low-S, the SIGHASH_SINGLE bug, MINIMALIF, the exact sigop accounting, taproot's annex, the CVE-2012-2459 merkle malleability, miss one and the proof attests the wrong thing.
Hazync compiles Bitcoin Core v28's real interpreter.cpp, SignatureHash, and libsecp256k1 to RISC-V and proves those, two narrow portability shims, zero consensus-logic changes. Bitcoin has no separate spec: Core is the reference.
How it works
Validate once. Prove it. Verify forever.
The whole point is the separation, validate ≠ prove ≠ verify. Proving is expensive and done by a few; verifying is cheap and done by everyone.
The real block
A block plus an inclusion proof for every coin it spends.
header · txs · Utreexo proofsfrom any archive node
Run real Core code
The guest executes Bitcoin Core's own consensus code and emits a STARK.
VerifyScript · SignatureHashlibsecp256k1 · UTXO transition
Compose the chain
Each block proof folds into the running chain proof, genesis to tip.
recursion · log-depthparallel range-fold
Check one proof
Every node verifies a single receipt, no re-execution, no peers.
millisecondsevery node, cheap
Prove a block's transactions with real Core code, then fold it onto the running chain proof, genesis to tip. The single proof grows one block at a time; blocks prove independently, so the party splits the work by height.
A verified receipt commits exactly this ChainState, and nothing else can produce it. Checked in milliseconds; SNARK-wrappable to a few hundred bytes, to verify anywhere.
Live · Proof Party
Claim a block. Prove it. Put your name on Bitcoin’s history.
Every proof is verified by the coordinator, nobody can fake it, chained onto the genesis-anchored frontier, and credited to you on an open, signed ledger. Take a single block or a range, prove it on your GPU, and submit.
Choose a block to prove
# claim it, prove on your GPU, submit, signed with your key, in one command $ hazync run ,
Leaderboard
signed ledgerRecently verified
liveWhat it proves
Every consensus rule, on real mainnet blocks.
Enforced with real Core code, each demonstrated on actual mainnet data.
Proven on real data
Real STARK receipts, real mainnet blocks.
Not execute-mode traces, cryptographic proofs a verifier can check, generated on GPU.
The first Bitcoin transaction
Satoshi → Hal. Full consensus validity, end-to-end, as a verified STARK receipt.
SegWit + Taproot, at scale
A modern block with key-path and script-path taproot spends, proven whole.
A folded chain proof
Every block linked into one recursive proof; parallel range-fold verified.
A real 90-day time-lock
A live Taproot CSV spend, validated with real median-time-past, matching mainnet.
What a proof can't cover
By design, not omission.
The interesting objections live at the trust boundary. Stated up front, a proof is only as honest as its edges.
Self-audited, adversarially, eight rounds
Every finding fixed, validated, and negative-tested.
Eight rounds of hostile self-review, each one attacking the fixes from the round before, until a round turned up nothing. The serious ones assumed a prover who can mine: downgrading a block's height to switch every soft-fork off and mint a 50 BTC subsidy, and inflating the fee on a multi-input transaction toward 21M BTC. Both are closed, alongside the segmented-proof binding, the recursion image-id, and the coordinator's cross-range seam. Every fix ships with a negative test that rejects the bad case, and a replayable suite runs them all. The full list, round by round, is in SECURITY.md.
CVE-2012-2459, identical merkle root, caught and rejected on the mutation flag.
Run it
Check a proof yourself, no build, no GPU.
Every proof on the board is public and reproducible. Grab the prebuilt verifier, it's the canonical guest, the same code that made the proofs, download any proven block, and check it against real Bitcoin Core consensus. Any Linux x86-64 box, no GPU, no toolchain.
# 1 · get the prebuilt verifier (no build) $ curl -L -o host https://github.com/bitcoin-ghost/hazync/releases/latest/download/hazync-host-x86_64-linux-gnu $ chmod +x host # 2 · download a proof by block number and verify it $ curl https://bitcoinghost.org/hazync/api/proof/1 -o proof.bin $ ./host verify-any proof.bin # → RANGE-OK # 3 · confirm the binary IS the canonical guest — the id you're verifying against # (reproducible byte-for-byte via reproduce/Dockerfile) $ ./host method-id 36a0415d5763ed62e71c44915d36caa34ae840cfd1051587bce1de27be0dd7f5
Want to prove blocks? Grab the CUDA prover binary (NVIDIA GPU + CUDA 12.6) and join the Proof Party; full steps in CONTRIBUTING. Building from source or reproducing the image id is in the repository; the tagged release is v0.7.2.
Beyond one node
One proof, useful to everyone.
The proof is not tied to any single node. Because it attests real Bitcoin Core consensus, anyone can verify it and anyone can build on it. Every proof the party produces is public, so the whole ecosystem leans on the same work instead of repeating it.
Light clients and wallets
A phone can confirm the chain is fully valid without downloading it or trusting a server. Full-node security in your pocket.
Trustless bridges
A contract on another chain can check a Bitcoin proof and trust Bitcoin's state directly. No federation, no multisig, no watchtowers.
Layer 2 and rollups
An L2 can anchor to Bitcoin and prove settlement with one succinct receipt instead of running a full node of its own.
Any node, any client
Not only this one. Any Bitcoin implementation can verify a proof instead of re-executing history, and sync in seconds.
Prove a block once. Everyone who needs to trust it can check the proof in milliseconds, for good.
Bitcoin Ghost · planned
Full-node security. None of the spam.
Bitcoin Ghost will run hazed nodes. Once a block's validity proof exists and it's past the re-org window, its raw data can be dropped. You keep the proof and the UTXO commitment, and you are still fully validated. Because the proof already checked every consensus rule, your node trusts the proof, not the bytes.
Full consensus security
Every rule, scripts, signatures, no-inflation, PoW, the lot, was proven. No trust in peers, no assumevalid.
No forced data retention
Inscriptions, images, arbitrary payloads never have to touch your disk. A hazed node keeps the proof and the UTXO set, not the megabytes of witness spam.
Full usage preserved
The data stays available from archive nodes for anyone who wants it. Storing and serving it becomes a choice, not a requirement for full-node security.
The proof is the state
The chain proof plus the UTXO root is the exact valid state. You don't need the history to know it's correct, so you don't have to carry it.
You decide what your node stores. The proof decides what it validates. For the first time, those are two separate questions.
Bitcoin Ghost · planned
Verify one proof. Skip re-executing history.
Bitcoin Ghost nodes will sync from a single proof. A new node today re-executes ~16 years of blocks, hundreds of gigabytes, hours to days, every byte of inscription spam included. With a Hazync + hazed archive, it fetches headers, verifies one chain-tip proof, and validates only the short unproven tail.
Same full-consensus security as replaying the chain yourself, because the proof is that replay, done once and checked by everyone. The tail you validate live is only as long as the proving lag.
How to help
The method is built. Now it needs eyes and compute.
A research prototype, demonstrated end-to-end on real data, not yet externally audited. That's exactly why the code is open: real Core code invites real scrutiny.
Try to make it lie
The valuable finding is a case where a Hazync proof says valid for something Core rejects. SECURITY.md maps the soft spots, the accumulator, the recursion binding, the metadata plumbing. Reproduce in ~25 min.
Prove a slice of history
Genesis→tip is GPU-hours the parallel backfill is built to absorb, thousands of independent block proofs, folded log-depth. Pick a block on the Proof Party board and put your name on it. A community effort to prove Bitcoin's whole history, once.