Ethereum Accelerates Quantum-Resistant Transition, Faces Implementation Hurdles
Mumbai, India – At Devcon 8 in Mumbai, Ethereum researchers unveiled an ambitious plan to complete the network’s quantum-resistant transition by December 2028, a full year ahead of the official roadmap. However, recent setbacks with the Glamsterdam hard fork and the rapidly decreasing cost of quantum attacks highlight the formidable challenges ahead.
Aggressive Timeline Set for Quantum Readiness
Ethereum is now facing an unprecedented race against time. At Devcon 8, researchers announced a plan to deploy three hard forks within 24 months, aiming to achieve quantum resistance by the end of 2028. While cryptographic advancements are progressing, the delays in the Glamsterdam upgrade underscore a critical reality: the cost of quantum attacks has plummeted to mere minutes, and advanced AI models are already demonstrating vulnerabilities in previously secure signature schemes.
Devcon 8 has set a more aggressive timeline for Ethereum’s quantum transition than previously stated. The research team believes cryptography can keep pace, but the release cadence this fall suggests the real bottleneck is not algorithms but the timely deployment of hard forks.
The conference, held from November 3-6, 2026, at the Jio World Centre in Mumbai, marked the first time Devcon was hosted in India. On the opening day, Ethereum Foundation researcher Justin Drake delivered a bombshell announcement: the goal is to complete the post-quantum and post-AI transition by December 2028. This implies the deployment of three hard forks within 24 months, following Glamsterdam.
This accelerated schedule is a year ahead of the Ethereum Foundation’s official plan. In a September priority paper, the EF committed to achieving three layers of quantum resistance by December 2029, explicitly stating this date would not change before an external expert review in January 2027. The current research push for 2028 effectively moves the target deadline forward.
Events from the same week underscored the importance of this accelerated timeline. On October 22, the next hard fork, Glamsterdam, was withdrawn from the second testnet. On the final day of Devcon, the EF explained the reason: a gas repricing mechanism disrupted assumptions relied upon by deployed contracts. While the cryptography for a quantum-resistant Ethereum is nearly ready, the true limitation lies in the ability to deploy these changes sequentially via hard forks without breaking existing functionality.
Devcon 8: A Shift in Focus and Scale
The Mumbai venue itself reflected a shift in scale. With 370 talks and 399 speakers over four days, the number of sessions was approximately 43% lower than at Devcon 7 in Bangkok. This reduction was intentional, following the EF’s decision to lay off 54 employees, about one-fifth of its workforce, earlier this year. Two-thirds of the main stage presentations were tagged with “CROPS” attributes from the EF charter – Censorship Resistance, Open Source, Privacy, and Security. Security talks were the most numerous with 70, followed by privacy with 65, and AI with 57. Vitalik Buterin’s opening keynote, as reported by media, focused on how technology has led to over-reliance and under-verification, touching upon operating systems and chips, health tech, communication, and AI. The next Devcon, Devcon IX, is scheduled for October 11-13, 2027, in Lisbon.
The Forking Path to Quantum Resistance
The EF’s draft roadmap outlines a sequence of forks, with later ones initially designated by letters: H for Hegotá, followed by I, J, K, and L*. The quantum-resistant Ethereum will be built upon these successive upgrades.
Hegotá, slated for 2027, is not a quantum-resistant fork itself but will introduce framework transactions, allowing each account to select its own signature scheme. This marks a path away from ECDSA. I will introduce leanVM, a minimal proof virtual machine, and quantum-resistant “lean” transactions. J will incorporate hash-based validator signatures and quantum-resistant data sampling, which the EF terms the “minimal viable quantum-resistant” milestone. K and L will introduce mandatory proofs and the remaining components of the Lean architecture refactor.
The plan for three hard forks in 24 months averages one every eight months. Ethereum’s recent fork intervals have been 11, 14, and 7 months, while Glamsterdam has already exceeded 11 months without completion. According to the EF’s own calculations, reaching L by December 2029 would require a fork every 7.2 months. At a 12-month pace, only J would meet the deadline.
Dual Threats Driving Urgency
The urgency stems from two converging fronts.
One is the rapidly decreasing attack threshold. In March of this year, a joint paper by researchers from Google Quantum AI, UC Berkeley, the Ethereum Foundation, and Stanford estimated that fewer than 1,200 logical qubits and fewer than 500,000 physical qubits would be needed to break Ethereum’s elliptic curve signatures, with execution times measured in minutes. This speed is sufficient to launch an attack while a transaction is still in the mempool.
The other threat, as highlighted by Drake, is the “post-AI” risk. In July, Anthropic reported that one of its models found an attack method that reduced the key recovery difficulty for the lattice-based signature scheme HAWK-256 from approximately 2^64 operations to about 2^38 – a significant reduction in difficulty. In October, Drake called for the industry to “calmly start planning for bunker mode,” meaning preparing for the worst-case scenario: AI-assisted mathematics breaking ECDSA before any quantum computers can.
Both trends point towards a single cryptographic primitive: hash functions. Among cryptographic primitives, they rely on the fewest assumptions and are the most difficult to break.
Glamsterdam’s Gas Repricing Stalls Progress
Glamsterdam has been running on the Sepolia testnet since October 6. Its two core changes are well-designed: embedded proposer-builder separation incorporates builder bids into the protocol and moves execution off the critical path of the slot; and block-level access lists pre-declare the read/write sets for each block, enabling parallel execution by clients.
The issue lies with gas repricing. EIP-8037 sets the price for new state at 1530 gas per byte to slow state growth. Writing to a new storage slot increases from 22,100 gas to 110,020 gas, an approximately eightfold increase in the cost of deploying a 24 KB contract. This magnitude of cost exceeds the 224 gas limit per transaction. Consequently, excess gas enters a separate state gas reserve pool, fully passed to the called contract and refunded upon rollback.
ChainSecurity noted that this could allow error handlers, previously halted due to gas exhaustion, to complete execution, thereby bypassing common checks against malicious interference. The EF listed eight invariants that were broken – rules the protocol must always uphold; the AllCoreDevs summary indicated 13 DeFi projects were affected. The Hoodi testnet has been delayed with no new date provided for Hoodi or the mainnet. Nixo, coordinator for All Core Devs, stated this “very likely pushes Glamsterdam mainnet into 2027.”
The implications extend beyond a single proposal. The true interface of a blockchain is every observable behavior – gas costs, the 63/64 rule, whether an account can execute code – each representing a migration risk. This is significant because Hegotá’s framework transactions list EIP-8037 as a requirement.
Hegotá: Laying the Groundwork for Future Forks
Hegotá incorporates two key mechanisms. FOCIL (EIP-7805) requires each of the 16 validators per slot to publish a list of included transactions, up to 8 KiB of mempool transactions. The next block must include these transactions unless they are invalid or the block is full, enforced by proposers via fork choice. To censor a transaction, one would now need all observers to collude, rather than just a single builder.
Framework transactions (EIP-8141) allow accounts to define their own authorization methods, enabling migration to quantum-resistant signatures without requiring a fork for each new scheme. Rejected proposals offer further insight into the design philosophy: optional execution proofs, embedded privacy pools, and block-in-blobs, the latter being rejected for increasing reliance on KZG commitments. The LUCID encrypted mempool has been deferred to a later fork. Ethereum consistently favors mechanisms that make the protocol a better platform rather than embedding specific applications.
Validators will need to register a dormant hash-based key in addition to their existing keys (EIP-8450 draft). leanXMSS signatures are 2048 bytes, while BLS is only 96 bytes. BLS signatures can be aggregated, but hash-based signatures cannot, so aggregators will instead prove they have checked all signatures. leanVM can aggregate approximately 965 signatures per second on a laptop, turning 1500 signatures into a 265 KiB proof verifiable in 7.4 milliseconds.
On the data layer, KZG commitments are yielding to LeanDA, which uses Merkle commitments with leanVM proofs to verify data encoding. For users, wallets will adopt leanSPHINCS, with signatures of 7740 bytes. However, after aggregation in the mempool (EIP-8288), each costs approximately 33,000 gas; direct verification requires 150,000 to 200,000 gas.
Formal Verification and the Path Forward
“Formal verification” warrants clarification. Drake announced end-to-end formal verification for leanVM. While the project’s Lean 4 proof demonstrates the reliability of instruction semantics and constraints, the Rust implementation has only undergone differential testing, leaving the reliability of recursive proofs an open question, and the code is not yet production-ready.
If one proposal best represents Vitalik Buterin’s vision for Ethereum’s future, it is EIP-8288, “Mempool-Internal Signatures and Proof Aggregation.” He co-authored the draft with Thomas Coratger in June. A series of posts on October 19 articulated the argument clearly: precompiles and the EVM are ill-suited to host most of Ethereum’s cryptographic support, as both require data to be on-chain. His September article already listed parallel processing of signatures and proofs within the mempool as part of Ethereum’s 2030 design.
This addresses the volume problem. A hash-based signature is 2-3 KB, and verifying it in the EVM costs 150,000-200,000 gas. STARKs required for privacy protocols are 128-512 KB. Uploading these individually would make quantum-resistant accounts prohibitively expensive, and privacy transactions unrealistic. Furthermore, both are too large to pass FOCIL’s inclusion lists.
EIP-8288 keeps heavy data off-chain. Transactions will declare rather than carry: framework transactions (EIP-8141) introduce a frame mode that lists dependencies as 96-byte references – scheme, data hash, key hash. A transaction can declare up to 16 leanSPHINCS signatures and one STARK. Nodes check the actual signatures and proofs upon transaction arrival, folding them into a recursive STARK per second. Builders and FOCIL inclusors do the same for their packed content. The block header will only include a single recursive STARK covering all dependencies within the block, which validators will verify.
This has several consequences. Quantum-resistant signatures become cheaper: a leanSPHINCS signature costs approximately 33,000 gas, with 3,000 from the frame itself and 30,000 amortized within the block STARK; direct verification costs 150,000-200,000 gas. Privacy becomes affordable: once STARK dependencies are enabled (currently reserved in the draft), on-chain verification of privacy proofs, which would otherwise cost millions of gas, will cost around 60,000 gas. There will be no need to add precompiles for each scheme: new signature schemes can be incorporated into proofs without waiting for a fork. Core developers are already moving in this direction; in October, they rejected adding an ML-DSA precompile to Hegotá, favoring hash-based schemes. Block overhead is capped: the specification limits builder overhead to approximately 256 KB per aggregation interval, regardless of the number of signatures within.
However, this is still early days. EIP-8288 is a draft, STARK dependencies are merely reserved, and aggregated keys and dependency hashes are still marked as “to be determined.” Transaction rollbacks also incur fees, with the author acknowledging an increased risk of mempool denial-of-service attacks and stating that the reliability of recursive proofs is “widely believed” but unproven. Coverage indicates it is targeted for forks after Hegotá, but no schedule exists. It also relies on Hegotá introducing framework transactions, which in turn depends on the ongoing review of Glamsterdam’s gas repricing.
Finality and Performance Gains
Ethereum’s finality currently takes approximately 16 minutes. The EIP-8453 draft, “Decoupling Consensus,” splits this into two parts: a fast-available chain confirmed by a committee of about 512 validators, and a separate finality component executed by all validators. The primary goal is to accelerate finality by at least fourfold. A longer-term objective, outlined on finality.watch, points towards a “north star” of one-second block production and two-second finality, starting from an exploratory 36 seconds (marked as “not a prediction” on the site). Concurrently, the Fast Confirmation Rule allows exchanges and cross-chain bridges to reduce deposit confirmation times to 12-24 seconds.
With proofs replacing re-execution, the speed issue has been addressed. On November 8, three provers achieved real-time Ethproofs standards on consumer-grade GPUs across 4-16 blocks, with per-block proof costs ranging from approximately $0.003 to $0.007. The new bottleneck has become security guarantees. The EF’s next milestone, in early December, aims for 128-bit provable security. As Cody Gunton stated at Devcon, “No team has yet produced a formally verified validator implementation.” Proof integration has been paused: Hegotá does not include optional proofs, and the roadmap draft places mandatory proofs in K*. Gas limit increases also await subsequent forks; the mainnet remains at 60 million gas per block, Sepolia at approximately 200 million, while the gigagas target is to achieve 200 times today’s throughput.
Other Developments
Other progress can be briefly summarized.
On the blob front, targets have been 14 with a limit of 21 since January. From June to September, an average of only 4.4 blobs were used per block, with each blob costing well under a cent, indicating capacity is outpacing demand.
Regarding rollups, the data platform L2BEAT has been renamed ETHBEAT. Most rollups’ value remains at Stage 1, with Base at approximately $14 billion and Arbitrum at about $9 billion.
In interoperability, the Ethereum Economic Zone demonstrated atomic L1-L2 calls on devnet, with Gnosis Chain planning to join in Spring 2027.
For privacy, the EF’s Kohaku wallet stack showcased private transfers via Privacy Pools and Tornado Cash, though the code has not yet been audited.
In security, on October 29, Binance was reportedly hacked for approximately $6.36 billion, attributed to North Korea’s TraderTraitor. The attack exploited 50 pre-signed EIP-7702 authorizations to drain a hot wallet. TRM Labs stated that while the upgrade amplified the attack, it was not the cause.
Looking Ahead
Several developments warrant close attention.
Ethereum now has a blueprint for its quantum-resistant version. The open question from Mumbai is whether it can simultaneously advance the design and maintain a delivery pace of one hard fork every eight months.
