Ethereum has moved the anti-quantum target to 2028, with the real bottleneck shifting from cryptography to the rollout pace.

Written by: @yq_acc

Translated by: AididiaoJP, Foresight News

Devcon 8 has set a more aggressive timeline for Ethereum than the official plan: to complete the anti-quantum transition by December 2028. The research team believes that cryptography can keep up, but the rollout pace this autumn indicates that the real bottleneck is not the algorithms, but whether hard forks can be launched on time.

Mumbai Sets the Tone: 2028 Goal, One Year Earlier Than Official Plan

Devcon 8 was held from November 3 to 6, 2026, at the Jio World Centre in Mumbai, marking the first time Devcon was hosted in India. On the morning of the opening day, Ethereum Foundation researcher Justin Drake announced the most significant news of the event: the hope to complete the anti-quantum and post-AI transformation by December 2028, meaning three hard forks must be rolled out within 24 months after Glamsterdam.

This is a year earlier than the Ethereum Foundation's official plan. In a priority article published in September, EF committed to achieving three-layer anti-quantum by December 2029, stating that this date would not change until after an external expert review in January 2027. In other words, researchers are now pushing for 2028, while 2029 is set as the deadline.

What happened the same week illustrates why this gap is significant. On October 22, the next hard fork, Glamsterdam, was withdrawn from the second testnet. On the last day of Devcon, EF explained the reason: a gas repricing broke the assumptions relied upon by already deployed contracts. The anti-quantum Ethereum's cryptography is close to ready; the constraint lies in how to bring it online one fork at a time, without breaking existing functionalities.

The Mumbai venue itself is also shrinking. Over four days, there were 370 talks and 399 speakers, roughly 43% fewer sessions than at Bangkok's Devcon 7. This was intentional: EF cut 54 positions this year, about one-fifth of its total staff. Two-thirds of the main venue's talks were labeled with the "CROPS" attribute in EF's charter, that is, censorship-resistant, open-source, privacy, and security. Security talks topped the list with 70, followed by 65 in privacy, and 57 in AI. Vitalik Buterin's keynote reportedly emphasized that technology makes people trust too much and verifies too little, covering topics including operating systems and chips, health tech, communication, and AI. The next Devcon IX will take place in Lisbon from October 11 to 13, 2027.

Three Forks in 24 Months, Ethereum Hasn't Moved This Quickly in Recent Years

EF's draft roadmap outlines forks in order, with later forks represented by letter placeholders: H* is Hegotá, followed by I*, J*, K*, and L*. The anti-quantum Ethereum will be built along these forks.

Hegotá, in 2027, is not an anti-quantum fork but will introduce framework transactions, allowing each account to choose its own signature scheme. This is a path away from ECDSA. I* introduces leanVM, a minimal proof virtual machine, and anti-quantum "lean" transactions. J* brings hash-based validator signatures and anti-quantum data sampling, which EF calls a "minimal viable anti-quantum" milestone. K* and L* will introduce enforceable proofs and complete the remaining aspects of Lean architecture reconstruction.

Three forks in 24 months equate to one every eight months. The intervals in recent years for Ethereum have been 11 months, 14 months, and 7 months, while Glamsterdam has already taken 11 months and is still not complete. According to EF's own calculations, to reach L* by December 2029 requires one fork every 7.2 months. At a speed of 12 months, only J* can arrive on time.

The sense of urgency comes from both ends.

One side is that the cost of attacks is decreasing. In March, researchers from Google Quantum AI, UC Berkeley, the Ethereum Foundation, and Stanford published a paper estimating that the logical qubits needed to break Ethereum's elliptic curve signatures are fewer than 1,200, with fewer than 500,000 physical qubits needed, and the runtime measured in minutes. This speed is fast enough to launch an attack while a transaction is still in the memory pool.

The other side is the "post-AI" risks described by Drake. In July, Anthropic reported that one of its models found an attack method that reduced the key recovery difficulty of the lattice signature scheme HAWK-256 from about 2^64 operations to about 2^38 operations—a significant decrease in difficulty. In October, Drake called on the industry to "calmly begin planning for a bunker mode," which means preparing for the worst-case scenario: that AI-assisted mathematics might break ECDSA before any quantum computer does.

Both lines point in the same direction: hash functions. Among cryptographic primitives, they rely on the fewest assumptions and are the hardest to break.

Glamsterdam Stuck: A Gas Repricing Disrupted the Mainline

Glamsterdam began operating on the Sepolia testnet on October 6. The two core changes were well-designed: the embedded proposer-builder separation incorporated builder bids into the protocol and moved execution out of the slot key path; block-level access lists declared the read and write sets of each block in advance, allowing clients to execute in parallel.

The problem arose from the repricing. EIP-8037 set the new state price at 1,530 gas per byte to slow state growth. Writing a new storage slot increased from 22,100 gas to 110,020 gas, and deploying a 24 kB contract roughly increased the cost by 8 times. This level of cost cannot fit within the gas limit of each transaction (224) (the original text seems erroneous, possibly referring to 2^24). Therefore, gas exceeding the limit enters an independent state gas reserve pool, transferred in full to the called contract, and refunded upon a call rollback.

ChainSecurity pointed out that this would allow errors that were previously terminated due to gas exhaustion to now run to completion, thereby bypassing common anti-malicious interference checks. EF listed eight broken invariants, rules that the protocol must always adhere to; AllCoreDevs summarized that 13 DeFi projects were affected. The Hoodi testnet was delayed, and no dates were provided for either Hoodi or the mainnet. All Core Devs coordinator Nixo wrote that this "very likely pushes the Glamsterdam mainnet to 2027."

The lesson is not just one EIP. The true interface of the blockchain is every observable behavior—gas costs, 63/64 rule, whether accounts can run code—each carries migration risk. This is significant because Hegotá's framework transactions list EIP-8037 as a requirement.

Hegotá: Censorship-Resistant and Signature Replaceable

Hegotá has two key mechanisms. FOCIL (EIP-7805) requires 16 validators per slot to each publish a list, with a maximum of 8 KiB transaction pool transactions. The next block must include these transactions unless they are invalid or the block is full, with the proposer enforced through fork choice. To censor a transaction, all includees who see it must now take action together, instead of just securing one builder.

Framework transactions (EIP-8141) allow accounts to define how to authorize themselves, thus enabling migration to anti-quantum signatures without needing to fork each time a scheme changes. The rejected proposals better illustrate the design philosophy: optional execution proofs, embedded privacy pools, block-in-blobs; the latter was rejected as it deepened reliance on KZG commitments. The LUCID encrypted memory pool was postponed to subsequent forks. Ethereum repeatedly opts for mechanisms that improve the protocol as a better platform, rather than embedding specific applications.

The Cost of Anti-Quantum Consensus: Longer Signatures and Aggregation Placeholder

Validators need to register a sleeping hash-based key in addition to existing keys (EIP-8450 draft). leanXMSS signatures are 2,404 bytes, while BLS only requires 96 bytes. BLS signatures can be added, while hash-based signatures cannot, so aggregators are required to prove they checked all signatures themselves. leanVM aggregates about 965 signatures per second on a laptop, turning 1,500 signatures into a 265 KiB proof, verifying in 7.4 milliseconds.

On the data layer, KZG commitments give way to LeanDA, which uses Merkle commitments with leanVM proofs to demonstrate that data is correctly encoded. On the user side, wallets receive leanSPHINCS, signing at 7,740 bytes, but upon aggregation in the memory pool (EIP-8288), each incurs about 33,000 gas; directly verifying requires 150,000 to 200,000 gas.

There's a point about "formal verification" that needs clarification. Drake announced end-to-end formal verification for leanVM. The project's Lean 4 proof of work established the reliability of instruction semantics and constraints, but the Rust implementation only performed differential testing, and the reliability of recursive proofs remains an open question, with the code yet to be production-ready.

EIP-8288: Moving Cryptography into the Memory Pool

If there is a proposal that best represents where Vitalik Buterin wants Ethereum to go, it is EIP-8288 "Signatures and Proof Aggregation in the Memory Pool." He co-authored the draft with Thomas Coratger in June. A series of posts on October 19 articulated the argument plainly: precompiles and EVM are both unsuitable for supporting much of Ethereum's cryptography because both must handle data that gets on-chain. His September article already included processing signatures and proofs in parallel in the memory pool as part of Ethereum's design for 2030.

It addresses the volume issue. A hash-based signature is 2 to 3 KB, and verifying it in EVM requires 150,000 to 200,000 gas. The STARK required by privacy protocols ranges from 128 to 512 KB. Uploading each one to the chain would make anti-quantum accounts prohibitively expensive, and privacy transactions impractical; moreover, both are too large to pass the FOCIL include list.

EIP-8288 keeps heavy data off the chain. Transactions declare but do not carry: framework transactions (EIP-8141) introduce a frame mode that lists dependencies as 96-byte references—schemes, data hashes, key hashes. A transaction can declare up to 16 leanSPHINCS signatures and one STARK. Nodes check the real signatures and proofs when the transaction arrives, folding them into a recursive STARK every second. Builders and FOCIL includers do the same for what they package. The block header adds only one recursive STARK, covering all dependencies within the block, and validators only verify this one.

This brings several results. Anti-quantum signatures become cheaper: a leanSPHINCS signature costs about 33,000 gas, with 3,000 from the frame itself, and 30,000 accounted for in the block STARK; direct verification demands 150,000 to 200,000. Privacy becomes affordable: once the STARK dependency is opened (currently reserved in the draft), on-chain verification of privacy proofs that require millions of gas can be done for about 60,000 gas. There is no need to add precompiles for every new scheme: new signing schemes can incorporate proofs without waiting for a fork. Core developers are already moving in this direction: in October, they voted down a precompile for ML-DSA to be added to Hegotá, favoring hash-based solutions. The block overhead has a ceiling: specifications keep builder overhead at about 256 KB per aggregated interval, regardless of how many signatures are included.

However, it is still early. EIP-8288 is a draft, STARK dependencies are only reserved, and the aggregation keys and dependency hashes remain marked "pending." Transaction rollbacks will also incur costs; the authors acknowledge this may increase the risk of memory pool Denial of Service attacks and claim the reliability of recursive proofs is "widely believed" but not yet proven. Coverage states it is aimed at forks after Hegotá, but no scheduling has been indicated. It also depends on Hegotá launching framework transactions, which in turn relies on the ongoing review of Glamsterdam's repricing.

Finality, Proofs, and Other Progress

Ethereum's current finality requires about 16 minutes. The draft EIP-8453 "Decoupling Consensus" splits this into two parts: a fast usable chain confirmed by a committee composed of about 512 validators; and a separate finality component run by all validators. The primary goal is to accelerate finality by at least four times. More long-term goals are outlined on finality.watch: from an exploratory 36 seconds (noted as "not a prediction" by the site), aiming for a polar star of one block every second and two seconds for final confirmation. Meanwhile, the Fast Confirmation Rule could shorten deposit confirmation times for exchanges and cross-chain bridges to 12 to 24 seconds.

With proofs replacing re-execution, speed issues have already been resolved. On November 8, three proposers reached the real-time standard for Ethproofs using 4 to 16 consumer-grade GPUs, with proof costs per block between about $0.003 and $0.007. The new bottleneck has become the guarantee of security. EF's next milestone is set for early December, aiming for 128-bit provable security. As Cody Gunton stated at Devcon, "No team has yet produced a formally verified validator implementation." Proof integration has been paused: Hegotá does not include optional proofs, and the roadmap draft places mandatory proofs at K*. The gas limit increase is also pending subsequent forks: the mainnet still stands at 60 million gas per block, while Sepolia is about 200 million, and the gigagas goal aims for 200 times today's throughput.

The remaining progress can be summarized briefly.

On the blob side, the target since January has been 14, with an upper limit of 21, yet from June to September, the average usage per block was only about 4.4; each blob cost significantly less than a cent, with capacity running ahead of demand.

On the rollup side, the data platform L2BEAT was rebranded as ETHBEAT, and most of the rollup's value remains at Stage 1, with Base around $14 billion and Arbitrum about $9 billion.

On the interoperability front, the Ethereum Economic Zone demonstrated atomic calls between L1 and L2 on the devnet, and Gnosis Chain plans to join in spring 2027.

On the privacy front, EF's Kohaku wallet stack showcased privacy transfers using Privacy Pools and Tornado Cash, although the code has not yet been audited.

On the security front, Binance lost approximately $6.36 billion on October 29, attributed to North Korean TraderTraitor. The attack leveraged 50 pre-signed EIP-7702 authorizations to empty a hot wallet. TRM Labs reported that this upgrade amplified the attack but was not the cause.

What to Watch Next

Several things are worth keeping an eye on next.

• On November 12, ACDC #191 and on November 19, ACDE #249 will discuss fixes for EIP-8037/8038 and provide new Hoodi testnet dates.
• In January 2027, whether December 2028 will be formally set as the anti-quantum deadline.
• whether the Hegotá development network can run both FOCIL and framework transactions simultaneously.
• Which anti-quantum key registry will ultimately be chosen and which fork it will be included in.
• What hash function and finite field will be ultimately selected for leanVM, and whether its proof system's reliability can be demonstrated.
• In December, whether EF can achieve the 128-bit zkEVM security milestone.

Ethereum now knows how to design the anti-quantum version. The open question left by Mumbai is whether it can maintain the pace of delivering a hard fork every eight months while advancing design.