Ethereum Could Slash The Cost of Quantum Safe Transactions

Ethereum co-founder Vitalik Buterin has put forward EIP-8288, a proposal aimed at making quantum-resistant cryptography far cheaper to run on the $ETH network. The EIP was merged into the Ethereum EIP repository on September 9, 2026, and introduces a framework for recursive STARK aggregation. Buterin is pushing for its inclusion in the I-star upgrade, the fork planned to follow the Hegota upgrade.

The Problem: Quantum-Safe Signatures Are Expensive

Quantum-resistant cryptography carries a heavy price on today's Ethereum. Buterin estimated that highly optimized privacy transactions can currently require around 300,000 gas, while a quantum-safe implementation could reach roughly 10 million gas. Those figures make widespread adoption of post-quantum signatures practically unworkable at current costs.

The proposal tackles a problem that has been lurking in Ethereum's roadmap for years: post-quantum signatures are large and expensive to verify on-chain. Instead of every transaction carrying its own hefty proof, transactions declare their quantum-resistant signatures and STARK proofs as dependencies, and mempool nodes batch them together into a single, compact aggregate proof.

How EIP-8288 Works

The proposal aims to move signature verification and proof generation out of Ethereum's main execution path, leveraging recursive aggregation within the mempool to significantly reduce on-chain overhead. Ethereum nodes would periodically aggregate dependencies between transactions to generate recursive STARK proofs, with block creators then packaging the necessary proofs for transactions to be included in a block.

Under his proposed architecture, Buterin believes those costs could potentially fall to the low tens of thousands of gas, though the figures are his estimates and would depend on the cryptographic construction and implementation. Buterin also noted that this approach could contribute to making the RISC-V architecture the standard instruction set for recursive STARK transactions in the Ethereum ecosystem. It is worth noting that the proposal is not an activated Ethereum upgrade; instead, it describes a possible change to how nodes handle signatures, proofs, and other computationally intensive dependencies before transactions are included in blocks.

The timing is notable. The Ethereum Foundation's Protocol cluster set December 2029 as the deadline for making Ethereum's base layer quantum-resistant across its execution, consensus, and data layers, and said it will treat the self-imposed deadline as non-negotiable at least until January 2027. EIP-8288 would be a meaningful technical step toward that goal, though its inclusion in any scheduled fork has not been confirmed.

Sources
Crypto Times: Vitalik Buterin Proposes Recursive STARK Mempools for Ethereum
Crypto Briefing: EIP-8288 introduces frame type for post-quantum signatures and STARK aggregation
CoinDesk: Ethereum makes quantum resistance a top priority with a 2029 deadline