Ethereum after Hegotá: why the roadmap is turning to post-quantum security and proofs
Vitalik Buterin calls Hegotá the last conventional fork. EIP-8288 and the Lean Ethereum plan show why quantum resistance and STARKs now drive the roadmap.
ETHEREUMBLOCKCHAINANALYSIS
Daniel Hartley
10/28/20263 min read
For a decade, Ethereum has evolved through a steady rhythm of hard forks, each bundling a handful of improvements. That rhythm is about to change. Vitalik Buterin has said that Hegotá, the fork after Glamsterdam, will likely be the last conventional upgrade before a multi-year rebuild of the protocol that he has compared in scope to the Merge. This month's debate around EIP-8288, a proposal Buterin co-wrote, offers a concrete look at what that rebuild involves and why quantum computing sits near the center of it.
The problem with today's signatures
Nearly every Ethereum account is secured by elliptic-curve signatures. They are compact and cheap to verify, but a sufficiently powerful quantum computer could in theory break them. No such machine exists today, and estimates of when one might arrive vary widely. Blockchains, however, cannot switch cryptography overnight. Migrating hundreds of millions of accounts and the contracts built around them takes years of preparation, which is why researchers argue the work must begin well before the threat is real.
The obstacle is cost. Post-quantum signature schemes produce much larger signatures than the ones Ethereum uses now, and verifying them on-chain is expensive. The same is true for STARK proofs, the zero-knowledge proofs Ethereum increasingly relies on for scaling and privacy. Putting large numbers of either directly into blocks would eat up capacity quickly.
What EIP-8288 proposes
EIP-8288, created in June by Buterin and Thomas Coratger and still a draft, tackles that cost by moving verification out of the block itself. Transactions declare the signatures and proofs they depend on, and nodes in the public mempool continuously combine them into a single recursive STARK, re-aggregating about once a second. A block is valid only if its header carries one proof that all declared dependencies are correct. Instead of checking thousands of large signatures, the network checks one compact proof.
Buterin has argued that this general-purpose approach beats adding special precompiles, built-in shortcuts, for every new signature scheme or proof system, a stance that has been described as an attempt to end Ethereum's precompile wars. The design builds on the frame transactions of EIP-8141 and on tooling from the Lean Ethereum research effort. It would require a hard fork, and several key parameters have not yet been defined.
EIP-8288 is one piece of a larger agenda. In a July post following a researcher gathering in Berlin, Buterin outlined a rebuild that touches transaction verification, finality, storage, privacy and, eventually, the virtual machine itself, with RISC-V among the candidates to succeed the EVM. He estimated it would take three to four years. Ethereum Foundation researcher Dankrad Feist responded that this was too slow and that AI-assisted development could compress the timeline. The direction is not unique to Ethereum. In October, Starknet's community voted to back research into becoming a post-quantum layer 1, a sign that quantum readiness is moving from academic papers into governance decisions across the ecosystem.
Why it matters now
Three reasons make this shift relevant to investors and builders today rather than in 2030. The first is credibility with long-term capital. Institutions that hold ether through ETFs, custody accounts and corporate treasuries increasingly ask how the asset would survive a change in cryptographic assumptions. A visible, funded plan is part of the answer.
The second is scaling. The same aggregation techniques that make post-quantum signatures affordable also cut the cost of verifying zero-knowledge proofs, which supports the push to raise base-layer throughput and to settle layer 2 networks more cheaply.
The third is execution risk. Ethereum is attempting to rebuild the engine while the car is moving, with roughly $290 billion in ether alone at late-October prices. The Glamsterdam testnet delay this month, triggered by an obscure interaction between new gas prices and old contracts, shows how small changes can ripple through existing code. A rebuild that touches storage and the virtual machine will carry far more edge cases of that kind.
What to watch
The near-term markers are the final contents of Hegotá, how client teams respond to EIP-8288, and whether quantum-safe signatures arrive first as an optional account type that users can adopt voluntarily. Longer term, the question is whether Ethereum can deliver a protocol of this complexity within Buterin's timeline without splintering its developer community or freezing feature work for years. The answer will shape how ether is valued for the rest of the decade. A network that can show a credible path to quantum resistance and cheaper verification gives long-term holders a reason to look past this autumn's weak price action. One that stalls in endless redesign gives competitors, several of which already market faster finality and newer cryptography, an opening.