Ethereum co-founder Vitalik Buterin is backing a proposal that could reduce the cost of quantum-safe private transactions by more than 99% in a future network upgrade.

EIP-8288, which Buterin co-authored with Thomas Coratger in June, would bundle quantum-resistant signatures and STARK proofs into a single proof for each Ethereum block. The draft proposal would move the heaviest cryptographic work out of the network’s execution path.

Post-quantum signatures currently measure about 2 to 3 kilobytes and cost between 150,000 and 200,000 gas to verify. STARK proofs are larger, exceeding 128 kilobytes and reaching as much as 512 kilobytes when generated quickly, putting their verification cost in the millions of gas.

Buterin said a well-engineered private transaction currently costs about 300,000 gas, while making it quantum-safe raises the cost to roughly 10 million gas. Under EIP-8288, he said, both versions could cost only tens of thousands of gas.

The proposal is described in the EIP-8288 specification. Buterin also discussed it in a post on X:

A note on recursive STARK mempools (EIP-8288) This is an EIP that I am hoping we can get included in I-star (the fork after Hegota) that you can think of as the next step after Frames, that would unlock extreme amounts of power. Particularly: *… — vitalik.eth (@VitalikButerin) September 9, 2026

The design would avoid placing the cryptographic operations directly on-chain. Instead, each transaction would declare a “dependency”—a short claim that a message was signed by a particular key or that data satisfies a proof. Each dependency would cost 96 bytes.

Mempool nodes would collect the claims every second, generate one recursive STARK proving all of them together, and pass that proof onward. Each block would then carry a single proof covering all of its transactions. Buterin’s original X post is available at https://twitter.com/VitalikButerin/status/2097711433073172837.

RISC-V as a common language

Recursive proofs need a common language for expressing statements. The leading candidate is RISC-V, an open instruction set used in chip design. Adopting it would make RISC-V Ethereum’s de facto canonical instruction set.

Buterin described that as a “big decision” that should be approached carefully, while saying he believes it is necessary. He raised the same possibility in July as part of a Lean Ethereum roadmap that would rebuild almost every major protocol component over three or four years and place recursive STARKs at the core.

He also outlined private account abstraction as another potential use. Under that approach, an account’s logic could remain hidden on-chain while ownership of every position and holding attached to the account changed in a single transaction without revealing which assets were involved.

EIP-8288 depends on Frames, the transaction overhaul Buterin promoted on Sunday. Frames is itself unscheduled. Buterin wants both proposals included in I-star, the upgrade after Hegota, which he has said would be Ethereum’s last before the Lean era begins. Neither proposal has been assigned to a fork.