Ethereum's 2028 Challenge: Quantum Resistance Roadmap Hits Release Bottleneck

Written by: @yq_acc

Compiled by: AididiaoJP, Foresight News

Devcon 8 has set a more aggressive timeline for Ethereum than the official plan: to complete the transition to quantum resistance by December 2028. The research team believes that cryptography can keep pace, but the release rhythm this fall indicates that the real bottleneck is not the algorithms, but whether hard forks can be launched on time.

Mumbai Sets the Tone: 2028 Target, One Year Ahead of Official Plan

Devcon 8 was held from November 3 to 6, 2026, at the Jio World Center in Mumbai, marking the first time Devcon has been held in India. On the morning of the opening day, Ethereum Foundation researcher Justin Drake announced the most significant news of the event: the goal is to complete the transition to quantum resistance and post-AI transformation by December 2028, which means three hard forks must be launched within 24 months after Glamsterdam.

This is one year earlier than the Ethereum Foundation's official plan. In a priority article released in September, EF committed to achieving three layers of quantum resistance by December 2029, explicitly stating that this date would not change before a review with external experts in January 2027. In other words, researchers are now pushing for 2028, with 2029 as the preset deadline.

Events occurring in the same week illustrate why this gap is significant. On October 22, the next hard fork, Glamsterdam, was removed from the second testnet. On the last day of Devcon, EF explained the reason: a gas repricing broke the assumptions relied upon by deployed contracts. The cryptography for quantum-resistant Ethereum is nearly ready, but the constraint lies in how to roll it out fork by fork without breaking what is already operational.

The Mumbai venue itself is also shrinking. Over four days, there were 370 presentations and 399 speakers, about 43% fewer than at Devcon 7 in Bangkok. This was intentional: EF cut 54 positions this year, about one-fifth of its total staff. Two-thirds of the main venue's presentations were tagged with the "CROPS" attribute in EF's charter, which stands for censorship-resistant, open-source, privacy, and security. There were a maximum of 70 security-related presentations, 65 on privacy, and 57 on AI, ranking third. Vitalik Buterin's keynote address reportedly emphasized that technology has led to excessive trust and insufficient verifiability, covering topics such as operating systems and chips, health technology, communication, and AI. The next Devcon IX will be held from October 11 to 13, 2027, in Lisbon.

Three Forks in 24 Months: Ethereum Hasn't Moved This Fast in Years

EF's roadmap draft arranges the forks in order, with subsequent forks temporarily labeled with letters: H* is Hegotá, followed by I*, J*, K*, and L*. Quantum-resistant Ethereum will be built along these forks.

Hegotá, scheduled for 2027, is not a quantum-resistant fork but will introduce framework transactions that allow each account to choose its own signature scheme. This is the path to moving away from ECDSA. I* introduces leanVM, a minimal proof virtual machine, and quantum-resistant "lean" transactions. J* introduces hash-based validator signatures and quantum-resistant data sampling, which EF describes as a "minimum viable quantum resistance" milestone. K* and L* will introduce proof enforcement and the remainder of the Lean architecture reconstruction.

Three forks in 24 months mean one every eight months. The recent intervals for Ethereum have been 11 months, 14 months, and 7 months, while Glamsterdam has already been 11 months and is still not completed. According to EF's own calculations, to reach L* by December 2029, a fork would need to occur every 7.2 months. At a pace of 12 months, only J* can arrive on time.

The urgency comes from both ends.

On one end, the cost of attacks is decreasing. In March of this year, researchers from Google Quantum AI, UC Berkeley, the Ethereum Foundation, and Stanford published a paper estimating that the logical qubits required to break Ethereum's elliptic curve signatures are less than 1,200, and the physical qubits are less than 500,000, with a runtime measured in minutes. This speed is fast enough to launch an attack while a transaction is still queued in the memory pool.

On the other end is the "post-AI" risk mentioned by Drake. In July, Anthropic reported that one of its models found a method to reduce the difficulty of recovering keys from the lattice signature scheme HAWK-256 from about 2^64 operations to about 2^38 operations—significantly lowering the difficulty. In October, Drake urged the industry to "calmly start planning for bunker mode," preparing for the worst-case scenario: in case AI-assisted mathematics breaks ECDSA before any quantum computer does.

Both lines point in the same direction: hash functions. In cryptographic primitives, they rely on the least assumptions and are the hardest to break.

Glamsterdam Stalled: A Gas Repricing Disrupted the Main Line

Glamsterdam has been running on the Sepolia testnet since October 6. The two core changes are well-designed: the embedded proposer-builder separation incorporates builder bids into the protocol, moving execution out of the slot critical path; the block-level access list pre-declares the read/write set for each block, allowing clients to execute in parallel.

The problem lies in the repricing. EIP-8037 set the new state price at 1,530 gas per byte to slow down state growth. Writing to a new storage slot increased from 22,100 gas to 110,020 gas, and deploying a 24 kB contract costs about 8 times more. This magnitude of cost cannot fit within the gas limit of 224 per transaction (as originally stated, suspected to be a 2^24 error). Therefore, gas exceeding the limit enters a separate state gas reserve pool, fully transferred to the called contract, and refunded upon rollback of the call.

ChainSecurity pointed out that this would allow previously aborted error handlers due to gas exhaustion to now complete, thereby bypassing common checks against malicious interference. EF listed eight broken invariants, which are rules that must always hold in the protocol; AllCoreDevs summarized that 13 DeFi projects were affected. The Hoodi testnet has been delayed, with no date provided for Hoodi or the mainnet. All Core Devs coordinator Nixo wrote that this "will likely push the Glamsterdam mainnet to 2027."

The lesson is not just one EIP. The true interface of blockchain is every observable behavior—gas costs, the 63/64 rule, whether accounts can run code—each of which carries migration risks. This is important because Hegotá's framework transactions list EIP-8037 as a requirement.

Hegotá: Censorship Resistance and Signature Replaceability

Hegotá has two key mechanisms. FOCIL (EIP-7805) requires each slot to have 16 validators each publish a list containing transactions from the pool, up to 8 KiB. The next block must include these transactions unless they are invalid or the block is full, with proposers enforcing compliance through fork selection. To censor a transaction, all its observers must now act together, rather than just securing one builder.

Framework transactions (EIP-8141) allow accounts to define how to authorize themselves, enabling migration to quantum-resistant signatures without needing to fork each time a scheme changes. The rejected proposals better illustrate the design philosophy: optional execution proofs, embedded privacy pools, block-in-blobs, the latter being rejected due to increasing reliance on KZG commitments. The LUCID encrypted memory pool has been postponed to subsequent forks. Ethereum repeatedly opts for mechanisms that make the protocol a better platform rather than embedding specific applications within it.

The Cost of Quantum-Resistant Consensus: Longer Signatures, Aggregation Replacement

Validators must first register a dormant hash-based key in addition to their existing keys (EIP-8450 draft). leanXMSS signatures are 2,404 bytes, while BLS requires only 96 bytes. BLS signatures can be aggregated, while hash-based signatures cannot, so aggregators must prove they checked all signatures themselves. leanVM aggregates about 965 signatures per second on a laptop, turning 1,500 signatures into a 265 KiB proof, verified in 7.4 milliseconds.

In the data layer, KZG commitments give way to LeanDA, which uses Merkle commitments plus leanVM proofs to verify that data is correctly encoded. On the user side, wallets receive leanSPHINCS, signing at 7,740 bytes, but after aggregation in the memory pool (EIP-8288), each costs about 33,000 gas; directly verifying one requires 150,000 to 200,000 gas.

There is one point to clarify regarding "formal verification." Drake announced end-to-end formal verification for leanVM. The Lean 4 project proved the reliability of instruction semantics and constraints, but the Rust implementation only performed differential testing, and the reliability of recursive proofs remains an open question, with the code not yet production-ready.

EIP-8288: Bringing Cryptography into the Memory Pool

If there is one proposal that best represents where Vitalik Buterin wants Ethereum to go, it is EIP-8288 "Signature and Proof Aggregation in the Memory Pool." He co-authored the draft with Thomas Coratger in June. A series of posts on October 19 made the argument very clear: neither precompiles nor the EVM are suitable for carrying most cryptographic support for Ethereum because both must process data on-chain. His article in September already listed parallel processing of signatures and proofs in the memory pool as part of Ethereum's design for 2030.

It addresses the volume issue. A hash-based signature is 2 to 3 KB, and verifying it in the EVM requires 150,000 to 200,000 gas. The STARK required by privacy protocols is 128 to 512 KB. Sending them one by one on-chain would make quantum-resistant accounts prohibitively expensive, and privacy transactions would also be unrealistic, as both are too large to pass the FOCIL inclusion list.

EIP-8288 keeps heavy data out of blocks. Transactions declare without carrying: the framework transaction (EIP-8141) introduces a new frame mode, listing dependencies as 96-byte references—scheme, data hash, key hash. A transaction can declare up to 16 leanSPHINCS signatures and one STARK. Nodes check the real signatures and proofs when the transaction arrives, folding them into a recursive STARK every second. Builders and FOCIL packagers do the same for their packaged content. The block header adds only one recursive STARK, covering all dependencies within the block, and validators only verify this one.

This brings several results. Quantum-resistant signatures become cheaper: a leanSPHINCS signature costs about 33,000 gas, with 3,000 coming from the frame itself and 30,000 being its share in the block STARK; direct verification costs between 150,000 and 200,000. Privacy becomes affordable: once STARK dependencies are opened (reserved in the current draft), on-chain verification requires privacy proofs costing millions of gas, approximately 60,000 gas. There is no need to add precompiles for each scheme: new signature schemes can be included in proofs without waiting for a fork. Core developers are already moving in this direction: in October, they rejected adding ML-DSA precompile for Hegotá, preferring hash-based schemes. Block overhead has an upper limit: the specification controls builder overhead to about 256 KB per aggregation interval, regardless of how many signatures are included.

But it is still early. EIP-8288 is a draft, STARK dependencies are only reserved, and aggregated keys and dependency hashes are still marked "TBD". Transaction rollbacks also incur fees, and the authors acknowledge that this increases the risk of memory pool denial-of-service attacks, stating that the reliability of recursive proofs is "widely believed" but not yet proven. Coverage states it is aimed at forks after Hegotá, but there is no schedule. It also relies on Hegotá to launch framework transactions, which in turn depends on the ongoing review of Glamsterdam for repricing.

Finality, Proofs, and Other Progress

Ethereum's finality currently takes about 16 minutes. The EIP-8453 draft "decouples consensus" by splitting this into two parts: a fast usable chain confirmed by a committee of about 512 validators; and an independent finality component run by all validators. The primary goal is to accelerate finality by at least four times. The longer-term goal is outlined on finality.watch: from an exploratory 36 seconds (not a prediction), aiming for a one-second block time and two-second final confirmation as the North Star. Meanwhile, the Fast Confirmation Rule allows exchanges and cross-chain bridges to shorten deposit confirmation times to 12 to 24 seconds.

By replacing re-execution with proofs, the speed issue has been resolved. On November 8, three provers achieved the real-time standard of Ethproofs on 4 to 16 consumer-grade GPUs, with proof costs per block around $0.003 to $0.007. The new bottleneck has become security guarantees. EF's next milestone is in early December, aiming for 128-bit provable security. As Cody Gunton stated at Devcon, "no team has yet produced a formally verified validator implementation." Proof integration has been paused: Hegotá did not include optional proofs, and the roadmap draft places mandatory proofs at K*. The gas limit increase is also awaiting subsequent forks: the mainnet remains at 60 million gas per block, Sepolia at about 200 million, while the gigagas target aims for 200 times today's throughput.

Other progress can be summarized briefly.

On the Blob front, since January, the target value has been 14, with an upper limit of 21. From June to September, an average of only about 4.4 blobs were used per block, with each blob costing far less than a cent, and capacity running ahead of demand.

On the Rollup front, the data platform L2BEAT has been renamed ETHBEAT, with most rollup values still stuck at Stage 1, Base at about $14 billion, and Arbitrum at about $9 billion.

On interoperability, the Ethereum Economic Zone demonstrated atomic calls between L1 and L2 on devnet, with Gnosis Chain planning to join in spring 2027.

On privacy, EF's Kohaku wallet stack showcased privacy transfers through Privacy Pools and Tornado Cash, with the code yet to be audited.

On security, on October 29, Binance was hacked for about $6.36 billion, attributed to North Korean TraderTraitor. The attack exploited 50 pre-signed EIP-7702 authorizations to drain a hot wallet. TRM Labs stated that this upgrade amplified the attack but was not the cause.

What to Watch Next

There are several things worth keeping an eye on next.

• The ACDC #191 on November 12 and ACDE #249 on November 19 will discuss fixes for EIP-8037/8038 and provide new dates for the Hoodi testnet.
• In January 2027, see if December 2028 will be officially designated as the quantum cutoff date.
• Whether the Hegotá development network can run FOCIL and framework transactions simultaneously.
• Which quantum-resistant key registry will ultimately be chosen and included in which fork.
• Which hash function and finite field leanVM will ultimately adopt, and whether it can provide reliability proofs for its proof system.
• In December, whether EF can achieve the 128-bit zkEVM security milestone.

Ethereum now knows how to design the quantum-resistant version. The open question left by Mumbai is whether it can advance the design while maintaining a hard fork delivery rhythm of every eight months.