Vitalik Buterin, the co-founder of Ethereum, recently shared a detailed quantum-resistance roadmap for Ethereum on X (formerly Twitter) on February 26, 2026. This post outlines a long-term plan to protect the Ethereum network from future threats posed by quantum computers, which could eventually break current cryptographic algorithms used in blockchains.

Quantum computers, once sufficiently advanced, could use algorithms like Shor's to crack widely used cryptographic schemes such as ECDSA (for wallet signatures) and BLS (for validator signatures in consensus). While practical large-scale quantum computers don't exist yet, progress in the field has prompted proactive planning.

Vitalik identifies four key vulnerable components in Ethereum today:

• Consensus-layer BLS signatures (used by validators).

• Data availability commitments and proofs (currently based on KZG).

• EOA signatures (ECDSA used by standard externally owned accounts/wallets).

• Application-layer zero-knowledge (ZK) proofs (often relying on KZG or Groth16 in L2s and apps).

The goal is to upgrade these gradually over potentially 4+ years and multiple hard forks without disrupting the existing ecosystem.

• Current issue: BLS signatures are vulnerable to quantum attacks.

• Solution: Replace them with hash-based signatures (e.g., variants of Winternitz), which are considered quantum-safe.

• For earlier phases (before full "lean finality"), adopt a "Lean available chain" model with fewer signatures per slot (~256–1024), reducing the need for complex aggregation.

• For aggregation in lean consensus: Use STARKs (quantum-resistant zero-knowledge proofs).

• Key challenge: Choosing the right post-quantum hash function, as it could become Ethereum's "final" hash for a long time. Options under consideration include:

  • Poseidon2 (with extra rounds or non-arithmetic layers like Monolith).

  • Poseidon1 (older but potentially safer against recent attacks, though ~2x slower).

  • BLAKE3 or other highly efficient conventional hashes.

• Current issue: Relies on KZG commitments for erasure coding and proofs.

• Solution: Transition to STARK-based systems.

• Challenges:

  • KZG has useful "linearity" properties for 2D Data Availability Sampling (DAS); STARKs lack this.

  • Ethereum opts for a conservative path: Maximize 1D DAS (e.g., PeerDAS), which is sufficient for current scaling goals.

  • STARK proofs are larger than blobs; recursive STARKs or alternative techniques are needed for efficient erasure coding verification.

  • Supporting distributed blob selection adds logistical complexity.

• Overall: Feasible but requires significant engineering effort.

• Current issue: Standard wallet signatures use ECDSA, which is quantum-vulnerable.

• Solution: Introduce native Account Abstraction (AA) (see related EIPs) so accounts can support any signature algorithm, including quantum-resistant ones.

• Challenges: Quantum-safe signatures are gas-expensive:

  • Hash-based: ~200k gas.

  • Lattice-based: Currently very inefficient, but could improve with vectorized math precompiles (e.g., operations like +, *, %, dot products, NTT) for lattice schemes and STARKs.

• Long-term fix: Protocol-level recursive signature and proof aggregation to reduce per-transaction overhead to near zero.

• Current issue: SNARKs cost ~300–500k gas; full quantum-resistant STARKs could reach 10M+ gas, making them impractical for L2s, privacy tools, etc.

• Solution: Implement protocol-layer recursive aggregation (similar to ideas in EIP-8141).

  • Transactions include a "validation frame" — an isolated area for verifying signatures/proofs.

  • Frames can be batched and verified by a single STARK proof.

  • Proving happens at the mempool layer (~every 500ms, nodes submit proofs for new valid txs), so blocks only include one static proof instead of many large ones.

  • Result: Blocks can handle thousands of large signatures/proofs (3–256 kB each), but on-chain verification remains cheap.

Vitalik references earlier posts and EIPs for deeper technical details on mechanisms like recursive aggregation and the "Strawmap" (Ethereum's broader long-term upgrade plan).

This is a comprehensive, multi-year strategy to future-proof Ethereum's cryptography against quantum threats while preserving decentralization, scalability, and usability. It builds on ongoing work like the Ethereum Foundation's post-quantum research team, FOCIL (for censorship resistance), and the Hegota fork discussions.

The post emphasizes that while the quantum risk remains theoretical for now (potentially materializing before 2028 or later), acting early avoids rushed, disruptive changes later. For full technical depth including specific EIPs, strawman proposals, or related research check Vitalik's original X thread or ethereum.org resources.

This roadmap highlights Ethereum's commitment to long-term security in an evolving technological landscape.

Vitalik Buterin, the co-founder of Ethereum, recently shared a detailed quantum-resistance roadmap for Ethereum on X (formerly Twitter) on February 26, 2026. This post outlines a long-term plan to protect the Ethereum network from future threats posed by quantum computers, which could eventually break current cryptographic algorithms used in blockchains.

Quantum computers, once sufficiently advanced, could use algorithms like Shor's to crack widely used cryptographic schemes such as ECDSA (for wallet signatures) and BLS (for validator signatures in consensus). While practical large-scale quantum computers don't exist yet, progress in the field has prompted proactive planning.

Vitalik identifies four key vulnerable components in Ethereum today:

• Consensus-layer BLS signatures (used by validators).

• Data availability commitments and proofs (currently based on KZG).

• EOA signatures (ECDSA used by standard externally owned accounts/wallets).

• Application-layer zero-knowledge (ZK) proofs (often relying on KZG or Groth16 in L2s and apps).

The goal is to upgrade these gradually over potentially 4+ years and multiple hard forks without disrupting the existing ecosystem.

• Current issue: BLS signatures are vulnerable to quantum attacks.

• Solution: Replace them with hash-based signatures (e.g., variants of Winternitz), which are considered quantum-safe.

• For earlier phases (before full "lean finality"), adopt a "Lean available chain" model with fewer signatures per slot (~256–1024), reducing the need for complex aggregation.

• For aggregation in lean consensus: Use STARKs (quantum-resistant zero-knowledge proofs).

• Key challenge: Choosing the right post-quantum hash function, as it could become Ethereum's "final" hash for a long time. Options under consideration include:

  • Poseidon2 (with extra rounds or non-arithmetic layers like Monolith).

  • Poseidon1 (older but potentially safer against recent attacks, though ~2x slower).

  • BLAKE3 or other highly efficient conventional hashes.

• Current issue: Relies on KZG commitments for erasure coding and proofs.

• Solution: Transition to STARK-based systems.

• Challenges:

  • KZG has useful "linearity" properties for 2D Data Availability Sampling (DAS); STARKs lack this.

  • Ethereum opts for a conservative path: Maximize 1D DAS (e.g., PeerDAS), which is sufficient for current scaling goals.

  • STARK proofs are larger than blobs; recursive STARKs or alternative techniques are needed for efficient erasure coding verification.

  • Supporting distributed blob selection adds logistical complexity.

• Overall: Feasible but requires significant engineering effort.

• Current issue: Standard wallet signatures use ECDSA, which is quantum-vulnerable.

• Solution: Introduce native Account Abstraction (AA) (see related EIPs) so accounts can support any signature algorithm, including quantum-resistant ones.

• Challenges: Quantum-safe signatures are gas-expensive:

  • Hash-based: ~200k gas.

  • Lattice-based: Currently very inefficient, but could improve with vectorized math precompiles (e.g., operations like +, *, %, dot products, NTT) for lattice schemes and STARKs.

• Long-term fix: Protocol-level recursive signature and proof aggregation to reduce per-transaction overhead to near zero.

• Current issue: SNARKs cost ~300–500k gas; full quantum-resistant STARKs could reach 10M+ gas, making them impractical for L2s, privacy tools, etc.

• Solution: Implement protocol-layer recursive aggregation (similar to ideas in EIP-8141).

  • Transactions include a "validation frame" — an isolated area for verifying signatures/proofs.

  • Frames can be batched and verified by a single STARK proof.

  • Proving happens at the mempool layer (~every 500ms, nodes submit proofs for new valid txs), so blocks only include one static proof instead of many large ones.

  • Result: Blocks can handle thousands of large signatures/proofs (3–256 kB each), but on-chain verification remains cheap.

Vitalik references earlier posts and EIPs for deeper technical details on mechanisms like recursive aggregation and the "Strawmap" (Ethereum's broader long-term upgrade plan).

This is a comprehensive, multi-year strategy to future-proof Ethereum's cryptography against quantum threats while preserving decentralization, scalability, and usability. It builds on ongoing work like the Ethereum Foundation's post-quantum research team, FOCIL (for censorship resistance), and the Hegota fork discussions.

The post emphasizes that while the quantum risk remains theoretical for now (potentially materializing before 2028 or later), acting early avoids rushed, disruptive changes later. For full technical depth including specific EIPs, strawman proposals, or related research check Vitalik's original X thread or ethereum.org resources.

This roadmap highlights Ethereum's commitment to long-term security in an evolving technological landscape.