Vitalik Buterin Backs Proposal to Cut Cost of Quantum-Safe Private Transactions by Over 99%
Vitalik Buterin says he hopes a proposal that would cut the cost of quantum-safe private transactions on Ethereum by more than 99% makes it into a future network upgrade — a specific, narrow fix aimed at a problem that has nothing to do with whether Ethereum’s signatures survive a quantum computer and everything to do with whether privacy-preserving transactions are affordable at all once they do.
The proposal, EIP-8288, targets a cost problem that sits at the intersection of two expensive things: zero-knowledge privacy and post-quantum cryptography. A well-engineered private transaction on Ethereum today costs roughly 300,000 gas. Make that same transaction quantum-safe using current methods, and the cost jumps to somewhere around 10 million gas — a roughly 33-fold increase that makes quantum-resistant privacy effectively unusable for ordinary transactions under today’s fee markets. Buterin’s proposal is aimed squarely at closing that gap, and he’s suggested it could bring both figures down to the low tens of thousands of gas if implemented as designed.
The mechanism works by moving the heaviest cryptographic verification off the chain’s execution path entirely. Instead of a transaction carrying and proving its own quantum-safe signature or zero-knowledge proof on-chain, it instead declares a compact “dependency” — a roughly 96-byte claim that some message was signed by some key, or that some data satisfies some proof. Mempool nodes collect these dependency claims from many transactions, typically over a roughly one-second window, and generate a single recursive STARK proof that verifies all of them at once. The block that eventually gets produced carries just that one aggregated proof covering every transaction inside it, rather than each transaction paying to verify its own cryptography individually.
Buterin floated the idea in a post on X, and has said he hopes it can be included in the upcoming I-Star upgrade — the network update expected to follow the Hegota fork, itself positioned as the step after the recent Frames update. As of now, EIP-8288 remains a draft proposal rather than a scheduled protocol change, meaning its inclusion in any specific upgrade is not yet settled.
Note: the embedded post above is Buterin discussing the recursive STARK mempool concept underlying EIP-8288 in the context of broader transaction-format design; it is not a post specifically quantifying the 99% cost reduction figure, which comes from EIP-8288’s own technical writeup and subsequent reporting.
What makes this proposal distinct from Ethereum’s other quantum-related work is the specific target: cost, not feasibility. Ethereum’s broader post-quantum roadmap already covers making consensus-layer signatures, data-availability commitments, and account signatures resistant to quantum attacks in principle. EIP-8288 doesn’t add a new category of quantum protection — it addresses whether the privacy-preserving version of that protection is cheap enough for anyone to actually use once it exists. A quantum-safe private transaction that costs 10 million gas is a proof of concept; one that costs a few tens of thousands of gas is something ordinary users could plausibly pay for, which is the gap Buterin is trying to close before quantum-safe cryptography becomes something the network actually needs in production rather than a contingency plan sitting in a repository.
Readers wanting background on Ethereum’s broader quantum-resistance efforts can see coin680’s earlier coverage of Ethereum’s first step toward quantum-resistant staking, and newcomers to the topic can start with the Bitcoin Academy.
This article is for informational purposes only and is not financial advice. Ethereum Improvement Proposals are drafts subject to change or rejection; EIP-8288 is not a finalized or scheduled protocol upgrade. Always research thoroughly before making decisions based on proposed protocol changes.