Vitalik Buterin Pushes Ethereum Plan to Slash Quantum-Safe Privacy Costs

EIP-8288 is a draft Ethereum improvement proposal that aims to move the heaviest post-quantum cryptography out of the on-chain execution path by batching proofs. Instead of verifying large post-quantum signatures and STARK proofs individually on-chain, a short on-chain "dependency" would assert that some message was signed or that some data satisfies a proof. Mempool nodes would collect these short claims and produce a single recursive STARK that covers all claims in a block, which the block would then carry as the sole proof. Buterin has argued the approach could drive dramatic cost reductions. He noted that post-quantum signatures today tend to be 2–3 kilobytes and cost roughly 150,000–200,000 gas to verify, while STARK proofs can exceed 128 kilobytes, rising to as much as 512 kilobytes when produced quickly and costing verification in the millions of gas. He said a well-engineered private transaction currently costs about 300,000 gas and about 10 million gas if made quantum-safe; under EIP-8288 both cases could fall to the low tens of thousands of gas. The proposal depends on periodic aggregation: dependency claims would be compact (about 96 bytes), and mempool nodes would gather them every second to create a single recursive proof for inclusion. That mechanism requires a shared language for expressing statements inside recursive proofs, and the leading candidate is RISC-V — an open instruction set architecture commonly used in chip design. Buterin described adopting RISC-V in this role as a "big decision" and said the choice should be made carefully. EIP-8288 builds on Frames, a transaction overhaul Buterin recently promoted, and he has asked for both changes to be included in I-star, the fork planned after Hegota. Neither Frames nor EIP-8288 is scheduled or assigned to a specific fork yet. Beyond lowering costs, Buterin also suggested use cases such as private account abstraction, where account logic and bundled position transfers could remain hidden on-chain while ownership and attached holdings move in a single, privacy-preserving transaction.