The Zama engineering and cryptography teams have achieved a major milestone: 1,000 confidential transfers per second. It came a year earlier than anticipated, on commodity GPUs rather than custom hardware.
1,000 TPS is not just symbolic. It is the throughput required to scale onchain finance use cases, and it dramatically lowers the cost of a transaction. Across all the nodes running the Zama Protocol, a confidential token transfer now costs less than $0.00005.
FHE performance improves roughly by an order of magnitude (10x) every 18 to 24 months. On that trajectory we expect 10,000 TPS by 2028 and 100,000 TPS by 2030, enough to power global human and agentic finance.
The number behind the milestone: with the release of TFHE-rs v1.7, we reached 1,040 transactions per second (TPS) on our ERC-7984 confidential transfer benchmark, running on a single node of 8× NVIDIA H100 (SXM5) GPUs. That is roughly a 2.6× improvement over our previous best on the same hardware, and it lands a year ahead of the roadmap we published in the State of FHE report, which had 1,000 TPS down for 2027.
To be precise about what that measures: 1,040 TPS is confidential compute throughput on one GPU node, not end to end settlement on a live chain. But that is exactly the point. FHE is no longer the bottleneck for confidential transfers. For the end user, a confidential transfer and a plaintext one are indistinguishable in practice, so what limits settlement now is the chain's own consensus and block times, not the encryption.
Getting there did not come from a single trick. It came from rethinking one of the most used building blocks in TFHE, the programmable bootstrap (PBS), and at its heart, a new mixed-radix FFT designed from scratch for one goal: throughput without giving up latency.
ERC-7984 is the confidential counterpart of ERC-20, the standard behind most fungible tokens on Ethereum. It lets users transfer tokens while keeping balances and amounts encrypted end to end. In other words, it is the confidential version of the most common action on a blockchain: a transfer.
Two headline metrics matter for a blockchain:
For confidential transfers, what counts is not only how fast one finishes, but how many the network can clear per second.
Under the hood, a confidential transfer is far more than one operation. Checking the sender's balance, subtracting the amount, and crediting the recipient all happen while everything stays encrypted. That amounts to a large batch of homomorphic operations, and every one of them relies on the same primitive: the programmable bootstrap. Improving the throughput of a transfer therefore comes down to running that bootstrap many times over, as fast as possible in aggregate.
Our previous best on this hardware, TFHE-rs v1.6, cleared 400 transfers per second at 54.7 ms of latency. v1.7 reaches 1,040 transfers per second at 51.5 ms: 2.6× the throughput, with latency slightly better rather than traded away. Against a CPU baseline running the same sequential PBS variant, the GPU path is roughly 5× faster per transfer.
One practical note for teams already running on CPUs. v1.7 keeps the same sequential PBS variant, with parameters still tuned for it, so moving the computation onto GPUs requires almost no changes to the surrounding infrastructure.
In TFHE, the programmable bootstrap resets the noise in a ciphertext and applies a lookup table to the value it hides, all without ever decrypting. It is what lets us chain an arbitrary number of operations on encrypted data. It is also the most computationally expensive thing we do.
Inside the bootstrap, the heavy lifting is polynomial multiplication. Multiplying polynomials directly is slow, so we move them into the Fourier domain, where multiplication becomes a simple element-wise product, then move the result back. Those two trips are performed by a Fast Fourier Transform (FFT). Because the FFT sits in the innermost loop of the bootstrap, its efficiency sets the ceiling for everything above it. A throughput-oriented bootstrap needs a throughput-oriented FFT.
A new mixed-radix FFT tailored for production.
For the parameter set behind our protocol, each bootstrap works with degree-2048 polynomials, which map onto a 1,024-point complex FFT. We used a radix decomposition to build a new FFT that factors those 1,024 points as 16 × 4 × 16. Three things make this decomposition fast on modern GPUs.
It lives in registers. Each thread keeps its 16 FFT coefficients in registers, the fastest memory on the chip, throughout the transform, rather than repeatedly bouncing data out to slower shared memory. The radix-16 and radix-4 stages are computed in place, so a coefficient never has to leave the register file to move between stages.
Threads talk through warp shuffles. When stages do need to exchange data, cooperating threads swap values directly using warp-shuffle instructions, avoiding costly round trips through shared memory. Twiddle factors are precomputed, and the hottest handful are cached in registers so they are loaded once and reused across every iteration of the bootstrap.
The core layers multiply by trivial twiddles. The 16 × 4 × 16 factorization is chosen so that the innermost radix stages land on twiddle factors that are trivial: values like 1, −1, i and −i. Multiplying a complex number by one of these is a swap or a sign flip, not a genuine complex multiplication, which costs four real multiplies and two adds. Steering the decomposition toward these easy cases eliminates a large share of the transform's complex multiplications, leaving more headroom for batched execution.
The net effect is an FFT with a small resource footprint per operation, and that is what makes it a throughput weapon. The leaner each bootstrap is, the more of them the GPU can run at once, and the more transfers per second the node clears.
Faster bootstrap, faster everything.
Every homomorphic integer operation in TFHE is ultimately a chain of programmable bootstraps and keyswitches, and those two dominate execution. So a faster bootstrap is not a point win on one benchmark. It is a speedup that shows up in every integer operation, and in every application built on top of them.
The keyswitch got the same throughput treatment: we cast it as a matrix multiplication. Framing it that way turns it into large, uniform batches of arithmetic that fit the GPU design naturally, so the hardware can crunch them efficiently. Bootstrap and keyswitch are the two pillars of homomorphic computation, and making both throughput-friendly is what lifts the whole stack.
A single H100 now clears 47,900 bootstraps per second, or 383,200 across the full eight-GPU node. PBS latency stays essentially flat, 3.90 ms to 3.94 ms, which is the deliberate tradeoff: v1.7 buys more than twice the bootstrap throughput without moving latency in either direction. Table 2 shows how that carries into 64-bit homomorphic integer operations.
Beyond the transfer benchmark, v1.7 rounds out the stack at several layers:
Throughput is what separates a demonstration from a payment rail. Ethereum mainnet settles on the order of 15 to 20 transactions per second, and most L2s operate within one or two orders of magnitude of that. A confidential transfer stack clearing 1,040 TPS on a single node is therefore no longer sized to the benchmark. It is sized to the chains it has to run on, with headroom left over.
That changes what teams can build. Confidential stablecoin payments, payroll, institutional settlement and onchain treasury operations all stop being throughput-constrained and become product questions instead. At less than $0.00005 per confidential transfer, they stop being cost-constrained too. Confidentiality becomes a default you can turn on, not a performance budget you have to justify.
Check out the release note and the complete benchmark.
Additional Links
News, research and product releases
Protocol
Solutions
PRODUCTS
Resources
community
company
.svg)
.svg){kind=icon}
.jpg)
.jpg)