Ethereum may be trying to make privacy sturdier for the quantum era without making every private transaction prohibitively expensive. Vitalik Buterin is pushing EIP-8288, a proposal that could slash the cost of quantum-safe private transactions by more than 99%.
Buterin said Wednesday that he hopes the proposal makes it into I-star, the Ethereum upgrade planned after Hegota. The proposal would move some of the network’s most expensive cryptographic work away from the execution path, where every transaction currently has to carry the computational burden.
The numbers explain why. Post-quantum signatures can run between 2 and 3 kilobytes and require roughly 150,000 to 200,000 gas to verify. STARK proofs are considerably heavier, topping 128 kilobytes and reaching 512 kilobytes when generated quickly.
That can push a quantum-safe private transaction into the millions of gas. A well-optimized private transaction costs around 300,000 gas today, according to Buterin, but adding quantum resistance can send that figure to roughly 10 million.
EIP-8288 takes a very different approach: instead of putting all that cryptographic machinery directly on-chain, the transaction would simply point to a dependency.
EIP-8288 Wants Ethereum to Verify the Claim, Not Carry the Weight
The dependency would be a compact statement saying, in effect, that a particular message was signed by a particular key or that certain data satisfies a given proof. Each claim would take just 96 bytes.
From there, the heavier lifting happens outside the execution path. Mempool nodes would gather those claims every second and use them to produce a single recursive STARK covering the batch.
The block would then carry that one proof rather than forcing the network to process every cryptographic operation independently.
The result, in Buterin’s estimate, could bring both post-quantum signatures and STARK-based verification down into the low tens of thousands of gas. That would put quantum-safe privacy dramatically closer to the cost profile of ordinary private transactions.
The proposal also comes with a much bigger architectural decision attached.
Recursive proofs need a language capable of expressing the statements being verified, and one of the leading candidates is RISC-V, the open instruction set widely used in chip design. Adopting it for this role would effectively make RISC-V Ethereum’s canonical instruction set.
Buterin has already framed that as a serious protocol choice. He called it a “big decision” that should be made carefully, while arguing that it is ultimately necessary for the direction he sees Ethereum taking.
That direction is not entirely new. In July, Buterin outlined a Lean Ethereum roadmap that would rethink nearly every major component of the protocol over three or four years, with recursive STARKs positioned near its center.
EIP-8288 also opens the door to something that sounds almost like a privacy trick for Ethereum accounts: private account abstraction.
Under the concept Buterin sketched, an account’s logic could remain hidden on-chain while ownership of every position and asset linked to that account changes in a single transaction. The public blockchain would see the result without necessarily exposing which holdings were involved.
For EIP-8288 to reach that future, however, it needs company. The proposal depends on Frames, a broader transaction overhaul Buterin promoted on Sunday, and Frames itself has not yet been scheduled for an upgrade.
Buterin wants both included in I-star, which he has described as the final Ethereum upgrade before the network enters its Lean era. Neither proposal has been assigned to a fork yet.
That makes EIP-8288 less of an immediate Ethereum feature than a glimpse at how the network could handle privacy, proving and quantum resistance several steps ahead. The intriguing part is that the proposed savings are not coming from making cryptography simpler. They come from changing where Ethereum does the work.