Google Sycamore quantum processor illustrating Ethereum quantum-safe privacy research

Vitalik Buterin Backs EIP-8288 to Cut Ethereum’s Quantum-Safe Privacy Costs

By Isaac • September 10, 2026 7:34 am • Comments

Ethereum co-founder Vitalik Buterin is backing a proposal designed to make private and quantum-safe transactions dramatically cheaper by moving most of the proof work out of individual on-chain transactions.

The proposal, EIP-8288, introduces recursive STARK mempools. Instead of every transaction carrying and paying to verify a large cryptographic proof on its own, transactions would declare compact dependencies.

Mempool operators would aggregate many of those claims into a single recursive proof for the block.

Trending: U.S. Bank Moves Its Own Stablecoin Across Borders on Stellar

Decrypt reports that a dependency would take 96 bytes, while nodes could collect claims on a roughly one-second cycle and produce one proof covering the batch. Buterin estimates that a well-engineered private transaction costs around 300,000 gas today and roughly 10 million gas when made quantum-safe.

Under EIP-8288, he says both could fall into the low tens of thousands.

The cost problem is not limited to private transfers. The draft says hash-based signatures are roughly 2 to 3 kilobytes and cost 150,000 to 200,000 gas to verify, while client-friendly STARKs can reach 512 kilobytes and require millions of gas.

Rather than putting those payloads directly in each transaction, the proposal would make a block valid only when its header carries one recursive STARK covering the dependencies across the included transactions. The draft remains subject to breaking changes and would require a network upgrade.

Buterin described the proposal as the next step after Frames and said he hopes it can be included in I-star, the planned fork after Hegota:

The phrase “next step after Frames” is important. EIP-8288 depends on EIP-8141, the Frames proposal that changes how Ethereum transactions express and execute account logic.

Frames is not yet scheduled for a fork, so the recursive-STARK plan is a direction of travel rather than an imminent network feature.

Buterin highlighted the work on Frames days before publishing the EIP-8288 note:

The formal EIP-8288 specification makes clear that the design is about proving dependencies before block inclusion. That could support private account abstraction, batched signature checks and post-quantum authentication without forcing every user to pay the full verification cost separately.

There is a deeper architectural choice inside the proposal. Recursive proofs need a common language in which their statements can be expressed, and RISC-V is the leading candidate.

Adopting it would effectively make RISC-V Ethereum’s canonical instruction set for this proof layer. Buterin called that a major decision that deserves careful consideration.

The upside is substantial if the engineering works: privacy and quantum resistance become less of a premium feature and more practical for ordinary transactions. The tradeoff is that Ethereum would be committing to new mempool responsibilities, a shared proof language and a chain of dependencies on upgrades that have not yet shipped.

EIP-8288 is therefore best read as a concrete roadmap proposal, not a finished upgrade. Its significance is the cost target it puts on the table—and the possibility that Ethereum can aggregate expensive cryptography once for everyone instead of charging each transaction for it alone.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.

 

Search ProCoinNews