Vitalik Buterin Backs EIP-8288 to Cut Ethereum (ETH) Quantum-Private Costs by Over 99%

Vitalik Targets the I-Star Fork

Quantum-resistant cryptography is prohibitively heavy for Ethereum (ETH), and co-founder Vitalik Buterin has a plan to compress it. In a September 9 post on X, Buterin walked through his note on recursive STARK mempools, EIP-8288, saying he hopes the proposal can make it into I-star, the network upgrade planned to follow Hegotá. EIP-8288, which Buterin drafted alongside researcher Thomas Coratger on June 3, remains at draft status and has not been assigned to any fork. Its premise is simple to state: rather than verifying post-quantum signatures and STARK proofs one at a time inside the execution path, the network should aggregate large batches of them into a single recursive STARK — a proof that attests to the correctness of other proofs without re-running the underlying computation.

his note on recursive STARK mempools, EIP-8288https://x.com/VitalikButerin/status/2097711433073172837?ref_src=twsrc%5Etfw

The proposal extends Frame Transactions (EIP-8141), which splits a transaction into separate frames for authentication, gas payment and execution, decoupling the signature scheme from the transaction format itself. That separation, the EIP-8141 text notes, is what opens a migration path from today's elliptic-curve authentication to quantum-resistant schemes. Frames already carries Scheduled for Inclusion status for Hegotá, and the Ethereum Foundation's protocol team has ranked it “Must ship” — its strongest tier — in that upgrade's priority assessment. Mechanically, EIP-8288 keeps bulky cryptography out of blocks altogether: a transaction declares a dependency, a 96-byte claim that some message was signed by a given key or that some data satisfies a proof. The actual signatures travel to the mempool, where nodes — a role adjacent to block validators — generate a recursive STARK attesting to batches of those claims. Block builders attach one proof covering everything they include, and per the proposal's specification the on-chain footprint shrinks to a single STARK plus 96 bytes per condition proven. For Ethereum's base layer, verification cost stops scaling with the number of exotic signatures a block contains.

From 10 Million Gas to Tens of Thousands

The case rests on raw numbers from the EIP text itself. Hash-based post-quantum signatures demand roughly 2 to 3 kilobytes of data and cost about 150,000 to 200,000 gas to verify — a punishing addition to any gas fee. STARK proofs are heavier still: beyond 128 kilobytes, up to around 512 kilobytes when generated for speed, with on-chain verification measured in the millions of gas. Buterin's worked example targets privacy: a carefully engineered private transaction costs about 300,000 gas today, and making it quantum-safe balloons the figure to roughly 10 million — a thirty-three-fold premium. Under EIP-8288, he estimates, both costs collapse to the low tens of thousands, a reduction exceeding 99%.

That arithmetic unlocks practical post-quantum privacy protocols. SPHINCS-, the hash-based signature scheme Foundation researcher Nicolas Consigny proposed for the EVM in June, would no longer need its ~3 kB signatures parked on-chain, and schemes like Falcon and ML-DSA become usable wherever clients can STARK-prove that a verification ran correctly — no EVM modification, and no new smart contract logic exposed, per scheme. Aggregation of this kind is already proven economically on Layer 2 networks; EIP-8288 effectively pulls the same trick into the L1 pipeline. Buterin also sketched private account abstraction: an account's authentication logic stays hidden while ownership of every attached position changes in one transaction without disclosing which. Longer term, recursive proofs need a shared language for statements, and the leading candidate is RISC-V, the open instruction set from chip design. Making it Ethereum's de facto canonical ISA is, in Buterin's words, a “big decision” demanding care — but a necessary one toward what he calls the Proof Singularity. Readers tracking the market in real time can follow live spot and futures prices on Binance.

Quantum Resistance by December 2029

Both threads point to a single arc. The Foundation's protocol unit targets quantum resistance across execution, consensus and data layers by December 2029, and Buterin said in August that quantum safety had climbed the L1 priority list, citing leanSPHINCS signature aggregation among concrete workstreams. The official EIP-8141 listing confirms Frames is already slated for Hegotá — even as the Foundation recently pulled the separate EIP-8363 reward-burn proposal from its priorities, a sign the Hegotá slate is still actively negotiated. Neither EIP-8288 nor Frames carries a fork assignment, and I-star inclusion remains undecided. COINOTAG's read: treat this post as agenda-setting for Ethereum's upgrade pipeline; the binding scheduling signals will arrive in upcoming Hegotá and I-star EIP lists, a re-platforming whose scale recalls Ethereum 2.0.