Overview
- EIP-8288 aims to integrate quantum-resistant signatures and STARK proofs into a single proof for each Ethereum block.
- Buterin estimates that the gas cost for private transactions made quantum-safe, currently about 10 million, could drop to tens of thousands.
- This proposal is still in draft form and builds upon the transaction overhaul called Frames, which he introduced recently.
Vitalik Buterin, a co-founder of Ethereum, expressed his aspiration on Wednesday for a proposal that would drastically reduce the costs associated with quantum-safe private transactions by over 99%, to be included in an upcoming network update.
The proposal, known as EIP-8288, co-authored by Buterin in June, seeks to remove the most demanding cryptographic processes from the network's execution path. Currently, post-quantum signatures can be 2 to 3 kilobytes in size and require 150,000 to 200,000 gas for verification.
A note on recursive STARK mempools (EIP-8288) https://t.co/KGUHKCcFqf
This is an EIP that I am hoping we can get included in I-star (the fork after Hegota) that you can think of as the next step after Frames, that would unlock extreme amounts of power. Particularly:
*…
— vitalik.eth (@VitalikButerin) September 9, 2026
STARK proofs, on the other hand, are even larger, exceeding 128 kilobytes and reaching up to 512 kilobytes when generated quickly, resulting in verification costs in the millions of gas. Currently, a well-designed private transaction requires about 300,000 gas, while making it quantum-safe spikes the cost to approximately 10 million. But under EIP-8288, Buterin anticipates both types of transactions could be reduced to the low tens of thousands.
This approach avoids placing the cryptography on-chain entirely. Instead, a transaction specifies a "dependency"—a brief assertion that a message was signed by a specific key or that certain data meets a proof—costing only 96 bytes. Mempool nodes would then gather these claims every second, create a single recursive STARK that proves all of them simultaneously, and forward it. Each block would contain one proof that covers everything within it.
Consideration of RISC-V
For recursive proofs to work, a common language for expressing statements is essential, and the leading candidate is RISC-V, an open instruction set used in chip design. If adopted, this would effectively become Ethereum's de facto canonical instruction set, a significant decision that Buterin believes should be made with caution.
Myriad: ETH above 4K when Bitcoin goes above 100K? Click to make your prediction.This concept was previously suggested by Buterin in July during a discussion about the Lean Ethereum roadmap, which aims to reconstruct nearly every major protocol component over the next three to four years, positioning recursive STARKs at its foundation.
Buterin also outlined another potential application: private account abstraction, which involves keeping an account's logic hidden on-chain while allowing the ownership of all associated positions and holdings to be changed in a single transaction without disclosing specifics.
EIP-8288, co-authored by Buterin and Thomas Coratger, is contingent upon Frames, the transaction overhaul he advocated for on Sunday, which is not yet scheduled. He aims for both EIP-8288 and Frames to be part of I-star, the upgrade following Hegota, which he has stated will be Ethereum's last update before entering the Lean era. Neither proposal has been assigned to a specific fork yet.