Ethereum co-founder Vitalik Buterin has publicly backed a proposal that would reduce the gas cost of quantum-safe private transactions from roughly 10 million to the low tens of thousands, a cut of more than 99%, and has said he wants it included in a future network upgrade called I-star.
Buterin announced his support on Wednesday 9 September, pointing to EIP-8288, which he co-authored in June alongside Thomas Coratger. The proposal targets the enormous computational overhead that post-quantum cryptography currently imposes on Ethereum transactions.
Why Current Costs Are Prohibitive
Post-quantum signatures today run to 2 or 3 kilobytes and cost between 150,000 and 200,000 gas to verify on Ethereum. STARK proofs are considerably heavier, weighing in at over 128 kilobytes and as much as 512 kilobytes when generated quickly, pushing verification costs into the millions of gas. Buterin noted that a well-engineered private transaction costs around 300,000 gas under current conditions, but making that same transaction quantum-safe pushes the figure to approximately 10 million gas.
How EIP-8288 Works
The proposal bypasses on-chain cryptography entirely by introducing a ‘dependency’ system. Instead of publishing a full signature or proof on-chain, a transaction declares a short 96-byte claim that a message was signed by a specific key or that some data satisfies a particular proof. Mempool nodes gather those claims every second, generate a single recursive STARK that proves all of them simultaneously, and forward that combined proof. Each block then carries one proof covering every transaction within it.
Under this architecture, Buterin said both standard private transactions and quantum-safe ones would settle in the low tens of thousands of gas, collapsing the current cost gap between the two.
A Consequential Decision on RISC-V
Recursive proofs require a shared language to express cryptographic statements, and the front-running candidate is RISC-V, an open instruction set widely used in chip design. Buterin described adopting RISC-V as a ‘big decision’ that warrants careful deliberation, while also calling it necessary. If the proposal is accepted, RISC-V would become Ethereum’s de facto canonical instruction set, a structural shift with long-term implications for the protocol.
Buterin first floated this direction in July as part of a broader Lean Ethereum roadmap, which envisions rebuilding almost every major protocol component over three to four years and placing recursive STARKs at the core of the architecture.
Additional Use Cases
Beyond quantum-safe private transactions, Buterin sketched a second application: private account abstraction. Under this model, an account’s logic could be kept hidden on-chain, and ownership of every position and holding attached to it could be transferred in a single transaction without revealing which assets were involved.
Timeline and Dependencies
EIP-8288 depends on Frames, the transaction-format overhaul Buterin promoted the previous Sunday, which is itself not yet scheduled for any upgrade. Buterin wants both EIPs included in I-star, the upgrade he has described as coming after Hegotá. He has said Hegotá will be Ethereum’s last major upgrade before the Lean era begins. As of publication, neither EIP has been formally assigned to a fork, and both remain at the proposal stage.
