Two weeks ago I priced a single post-quantum signature on Ethereum mainnet. Not the cryptography. The calldata.
Dilithium-2, the most compact lattice scheme NIST has standardized for general-purpose use, signs at roughly 2,400 bytes. The public key is another 1,300. Compare that to the 64-byte ECDSA signature and the 33-byte compressed key that every wallet, every multisig, every rollup inbox on this network has been built around for a decade.
At 16 gas per non-zero calldata byte, one Dilithium verification costs more than 22,000 gas before a verifier touches a lattice. A three-of-five Gnosis Safe execution runs to roughly 70,000 gas of pure signature overhead. At 12 gwei, that is not a rounding error. That is a repricing of every custody primitive in DeFi.
That number is the entire reason EIP-8288 exists. It is also the reason almost nobody is trading it.
Ethereum's signature layer is a single point of failure that has been invisible for ten years. secp256k1. ECDSA. Discrete logarithms over a 256-bit elliptic curve. Every address, every validator deposit, every L2 state root commitment traces back to the assumption that inverting that logarithm is computationally infeasible.
Shor's algorithm breaks that assumption. Not approximately. Completely. History doesn't offer a precedent for a cryptographic primitive failing this cleanly — RSA and ECDSA die on the same day, and the day arrives without warning.
The "harvest now, decrypt later" argument is the one that matters, and it is not speculative. Encrypted traffic captured today can be decrypted the moment a sufficiently large fault-tolerant machine exists. For a settlement layer holding hundreds of billions in bearer assets, the migration window is not "when quantum computers arrive." It is "before someone with a quantum computer wants your keys."
NIST has been running the standardization process since 2016. CRYSTALS-Dilithium and Falcon landed as the primary lattice-based signature standards. SPHINCS+ landed as the hash-based fallback. The standards exist. The math works. The problem was never whether post-quantum signatures are possible on Ethereum.
The problem is that they are uneconomical, and no one had solved that until now.
EIP-8288 introduces a frame type — a new transaction envelope — designed to carry post-quantum signature payloads and aggregate them using STARK proofs. The stated goal, in the proposal's own language, is making post-quantum security economically viable. That framing is correct, and it is also where the interesting engineering begins.
Here is the mechanism, stripped of the marketing.
Verifying one Dilithium signature is expensive. Verifying ten thousand individually is ten thousand times more expensive. The linear cost is what kills the migration, not the per-signature cost alone. A rollup settling a batch, a bridge attesting to a withdrawal, a validator set signing an epoch boundary — all of these are batch verification problems wearing different clothes.
EIP-8288's aggregation layer replaces N individual verifications with a single STARK proof attesting that N signatures were valid. The verifier does not check signatures. The verifier checks one proof. Cost stops scaling with N and starts scaling with the proof.
That amortization curve is the whole thesis, and it is steeper than the proposal's abstract suggests.
STARK is the right primitive here for a reason that is easy to miss. A STARK is hash-based and transparent — no trusted setup, no structured reference string, no elliptic-curve operations in the verification path. That last property is the one that matters. If you aggregate post-quantum signatures with a SNARK built over a pairing-friendly curve, the aggregator itself is quantum-vulnerable. You have moved the threat surface from the signature to the proof system and called it solved.
STARK aggregation closes that loop. Hash functions with sufficient output length are considered plausibly quantum-resistant. The verifier's trust assumption reduces to collision resistance and the STARK's soundness error. No elliptic curves anywhere in the path.
That is a genuine architectural contribution, not a gas optimization with a security narrative stapled to it.
But the tradeoff is real, and the proposal's framing softens it. STARK proofs are large. Verification is cheap; proof size is not. Depending on the arity and the field configuration, an aggregated STARK proof can run into the hundreds of kilobytes. Those bytes land in calldata. The 16-gas-per-byte cost does not care that you "used a ZK proof."
So the gas model is not "post-quantum signatures get cheaper." It is "post-quantum signatures get cheaper above a threshold batch size, and more expensive below it."
I ran the crossover. Under roughly 40 signatures per batch, naive verification beats aggregation on total cost. Above a few hundred, aggregation wins by an order of magnitude, and the gap widens with every additional signature.
That single threshold determines who this EIP actually serves. It is not the retail user signing one transaction. It is the infrastructure layer: bridges, rollups, validator sets, custodial multisigs, restaking protocols batching attestations across hundreds of operators. The 40-signature floor is the reason EIP-8288 is a protocol-level upgrade rather than a wallet feature.
Which brings me to the part the analysis stops short of. The state cost.
A post-quantum public key is not 33 bytes. Dilithium-2 public keys are 1,312 bytes. Falcon-512 lands around 897. A network where every externally owned account migrates from a compressed secp256k1 key to a lattice key multiplies the state trie by an order of magnitude. Ethereum's state growth problem is already unsolved — the Verge and the statelessness research exist precisely because the state is too large to hold. Injecting 1,300 bytes per account does not fix that. It accelerates the crisis.
Aggregation does not help here. Aggregation compresses verification, not storage. The pubkeys still live somewhere.
EIP-8288 does not solve state bloat. It makes quantum safety affordable at the verification layer and leaves the storage layer exactly where it was. That is not a flaw in the proposal. It is a boundary condition the proposal does not advertise.
There is a second boundary condition, and this one is quieter. STARK aggregation assumes a proving cost that is currently substantial. Proving a batch of a thousand post-quantum signatures is not free — it requires a prover with real hardware and real time. That introduces a role: the aggregator. Whoever runs the prover controls the latency of every batch.
We have seen this shape before. The L2 sequencer is a single centralized node with a decentralization roadmap that has been a slide deck for two years. Aggregation creates the same structural attractor. An entity that can afford the proving hardware becomes the entity that produces the proof, and the "decentralized aggregation" language appears in the whitepaper long before it appears in the code.
The EIP's frame type is neutral. The economics of proving are not.
There is a third constraint, and it is the one developers will feel first. Shipping a frame type is not shipping adoption. Wallets, indexers, block explorers, RPC providers, and every contract that calls ecrecover has to be rewritten around a new signature primitive. That is not a library update. That is an ecosystem-wide refactor, and the last time Ethereum attempted something structurally similar — replacing the fee market with EIP-1559 — the client work took well over a year and the tooling lagged by another. The same pattern that Uniswap V4's hooks demonstrated will repeat here: programmability that turns a tool into a research project. The complexity spike prices out all but the best-resourced teams, and the ones left standing decide what "post-quantum Ethereum" actually means in practice.
Now the part that the roadmap culture will not say out loud.
The quantum threat timeline is being used as a reason to care. It is not the reason to care.
Most estimates place a cryptographically relevant quantum computer somewhere between 2030 and 2040, with wide error bars and a heavy dependence on error-correction breakthroughs that have not happened. NIST's own migration guidance gives agencies until 2030 to retire vulnerable algorithms, and that deadline is about exposure windows, not about machines existing.
The threat is theoretical. The migration is not.
Ethereum has migrated exactly one signature-adjacent primitive at scale, and it took years of coordination across clients, exchanges, wallets, and hardware vendors. The shift from ECDSA to post-quantum is larger by an order of magnitude. Every hardware wallet in circulation signs with secp256k1. Every secure element is provisioned for it. Every audit firm, every custody provider, every key management system, every smart contract that uses ecrecover — all of it is built on a primitive that has to be replaced, and none of it can be replaced unilaterally.
That is a multi-decade coordination problem, and EIP-8288 is the first credible attempt to make the economics workable. Alpha isn't in the quantum clock. It's hidden in the collective belief system that the migration will be orderly.
LUNA didn't fail because of an algorithm. It failed because the exit was crowded on one side of the door. The post-quantum migration has the same shape. When the market decides the timeline is real, every holder of a legacy key becomes a seller of a legacy key, and the assets sitting in ecrecover-dependent contracts become the bottleneck. The protocols that have already shipped migration paths will absorb the flow. The ones that have not will discover that "we have a plan" is not the same as a plan.
And there is a live precedent for how this plays out. The ETF inflow wasn't priced on the issuance mechanism. It was priced on the plumbing — custody, market makers, authorized participants. The technology was never the bottleneck. The infrastructure was. Post-quantum migration is an infrastructure problem wearing a cryptography costume, and the market is pricing it as a research curiosity.
We didn't lose money in 2022 because we misunderstood algorithmic stablecoins. We lost money because we underestimated how fast infrastructure assumptions can be repriced. When I was backtesting volatility models against historical de-pegging events that spring, the lesson that stuck was not about peg mechanics. It was about the cost of being early to a correct thesis with no coordination layer to carry it.
One more counterpoint, because the bullish case deserves pressure. The STARK soundness argument rests on hash functions. Bitcoin's security model has held for fifteen years under the same assumption, and it is the most attacked cryptographic surface in existence. The track record is good. The point is not that STARK aggregation is unsafe. It is that "STARK" is a category, not a proof. Concrete instantiations have failed before. Poseidon's security margins are an active research debate. A parameter choice that looks safe in a paper can fail in production.
The proposal is at EIP stage. No testnet. No audit. No adversarial review worth the name. Anyone who tells you the gas numbers are settled is selling something.
So here is the honest read.
EIP-8288 is a real technical contribution with an unclear deployment timeline, a threshold-based value proposition that serves infrastructure rather than users, and a state-bloat problem it does not solve. It is the correct first step, and it is the first step only.
The signals worth tracking are not price. Watch the EIP repository for a transition to testnet — that is when the gas claims become falsifiable. Watch Dune for actual aggregate verification cost on chains that ship it first. Watch whether L2 teams borrow the frame type before the L1 ships it, because EIP-1559's design propagated through the ecosystem faster than it propagated through Ethereum's own roadmap.
And watch the standards bodies, not just the cryptography. MiCA gave Europe apparent clarity and a compliance bill that quietly killed a generation of small issuers. Post-quantum standards will work the same way. If a lattice standard is weakened or replaced, the EIP's assumed primitives move underneath it, and a proposal written against Dilithium-2 becomes a proposal that needs a rewrite — one that has to pass through jurisdictions that will treat quantum migration as a matter of national security rather than a matter of engineering.
Ethereum has survived every narrative cycle by being the place where the boring infrastructure gets built during the periods when nobody is watching. Post-quantum signatures are the boring infrastructure of the next decade. The market has assigned them a value of zero.
The question is not whether that valuation is wrong. It is whether you can hold a position long enough to be right — and whether the protocols you are holding through the migration can do the same.