Author: SNZ Holding, ETHTAO
This article is compiled from the September 16 AMA by EF researchers with the community on Reddit, original AMA record: https://www.reddit.com/r/ethereum/comments/1wf48x3/comment/p9pw3pv/
Quantum-resistant throughout all stages
On September 16, 2026, the Ethereum Foundation’s Protocol team held a new AMA on Reddit, covering scaling, privacy, post-quantum security, formal verification, ETH issuance, and client funding. When viewed together, these responses reveal a growing consensus: **post-quantum migration is shaping Ethereum’s technical priorities for the coming years, with ZK proofs increasingly integrated into the design of accounts, consensus, and privacy.** Meanwhile, technical progress has not resolved disagreements around economic policy and governance.
The value of this AMA lies in researchers explaining both the work in progress and the trade-offs and differing judgments involved. Many responses clearly represent personal opinions, so understanding this discussion requires consistently distinguishing between achieved results, pending upgrade proposals, and longer-term research ideas.
Quantum resistance is the starting point for understanding these trade-offs. The Protocol team’s goal is to achieve quantum-resistant Ethereum L1 by December 2029. This objective involves the entire chain: user accounts require new signature mechanisms, the consensus layer needs alternatives to BLS for signing and aggregation, and the data availability layer must adjust its reliance on KZG. Work across these layers must be coordinated and cannot be accomplished through a single isolated upgrade. Even after the core protocol completes its migration, wallets, Rollups, bridges, and applications will not automatically gain quantum resistance—they must each independently audit their cryptographic dependencies and migrate accordingly.
Frame transaction is all you need—the ultimate solution to account abstraction
The key change at the account level is Frames, which makes transaction validation logic programmable. Combined with the associated migration proposal, users will have the opportunity to move their accounts away from control by secp256k1 keys and continue to update signature schemes in the future. This flexibility is important because quantum-resistant technologies are still evolving, and the protocol needs to allow room for different schemes to evolve.
However, there is still a significant gap between supporting a new signature scheme and making it affordable and practical. In his response, Vitalik compared the computational and data costs: ECDSA signatures require approximately 4,000 gas, while SPHINCS+ quantum-resistant signatures need between 100,000 and 250,000 gas, depending on the parameters. Therefore, future work also includes aggregating signatures before transactions are included in blocks and replacing large amounts of raw data and computation with proofs. Such a mechanism could serve quantum-resistant accounts while also reducing the cost of privacy-preserving transactions.
ZK-EVM is beginning to enter real-world production
L1-zkEVM and quantum-resistant migration are thus converging on more technical intersections. Both approaches are leveraging RISC-V zkVMs, enabling shared investment in proof systems and optimization tools. Over the past year, related work has advanced to execution specifications, testing, client integration, and open-source tool development. Multiple zkVMs have made progress in performance and security, with execution clients and verified programs undergoing tests such as block validation and execution witness generation. A key current milestone is whether the optional execution proof in EIP-8025 can be incorporated into Hegotá to accumulate experience for future deployments.
Justin Drake is quite optimistic about real-time proofs. He believes the main performance risks have been significantly reduced and mentions that some teams are confident about achieving approximately two-second proofs for the vast majority of mainnet blocks by 2027. However, other responses emphasize engineering conditions: gas limits, new precompiles, and block structure will all alter the proof burden; if performance is insufficient, mandatory proofs should be delayed. State growth may also become a scaling bottleneck before proof delays do. Performance breakthroughs are expanding the options, but mainnet deployment still requires complete security and integration work.
This architecture also introduces a decentralization trade-off: generating proofs may require specialized hardware, but verifying proofs can be inexpensive. Ethereum aims to use this division of labor so that ordinary validators do not need to continuously upgrade their equipment as execution throughput increases. Correspondingly, the centralization risks associated with builders and provers must be carefully addressed, with research directions including lowering the hardware barrier for individual provers and exploring distributed proof generation.
Privacy is progressing steadily, but many foundational tasks still need to be completed.
Privacy is advancing based on these accounts and proof-of-capability. The seemingly contradictory statements in this AMA actually refer to different levels: one side believes native privacy transactions may be supported by 2027, while Justin considers the probability of implementing a unified privacy pool directly into the protocol by the end of 2028 to be nearly zero. The former discusses how privacy applications can directly utilize Ethereum’s public transaction channels, while the latter addresses whether a unified privacy pool should be hardcoded into the protocol.
The near-term goal is closer to the former approach. Through Frames, related account mechanisms, and FOCIL, privacy-focused applications can leverage public mempools and the censorship-resistance provided by protocols, reducing reliance on dedicated relays. Ethereum could thus support multiple privacy applications without first defining a single official privacy pool. In the future, if quantum-resistant privacy proofs can be efficiently aggregated, costs and scalability may improve further. The associated years remain conditional targets or personal projections.
Researchers still differ on whether a built-in privacy pool is necessary in the long term. Justin has mentioned the idea of default-private staked ETH and enabling unstaked ETH to connect to this system; others argue that post-upgrade immutable privacy applications may already possess properties close to a protocol-integrated pool, so it remains debatable whether it is worthwhile to encode this directly into the protocol. Enhanced L1 privacy capabilities do not render privacy L2s obsolete: basic transfers, privacy-preserving stablecoins, privacy-focused DeFi, and full privacy-enabled smart contract environments may still be handled by separate systems.
Formal verification is making encouraging progress
While ZK is expanding what the protocol can do, formal verification is providing stronger security foundations for these changes. The post highlights security proofs for certain signature schemes, validation of zkVM circuit constraints, and related work on the EVM execution engine. The verification process has already helped the team identify and fix real bugs, but end-to-end verification—from cryptographic constructions and proof systems all the way to the specific execution engine—remains incomplete.
Notably, this work is forming a more complete toolchain: Clean attempts to describe circuits directly in Lean; hax and Aeneas help connect Rust implementations to formal specifications; VCVio and ArkLib provide foundational cryptographic proofs; and evm-asm advances verifiable execution. Automated research and performance optimization are also beginning to integrate with proofs, enabling optimized programs to undergo rigorous verification. This makes formal verification more likely to become part of everyday development, rather than being confined to post-development reviews.
Faster Ethereum is on the way
Ethereum’s pursuit of speed is also adapting to these new constraints. Ben Edgington stated in his response that the originally envisioned single-slot finality path has, in his view, come to an end, but the goal of approaching that experience remains. The new decoupled consensus approach allows finality to improve incrementally, without waiting for all issues—validator scale, network, and signature aggregation—to be resolved simultaneously. He anticipates that in the early stages, finality time could be reduced from approximately sixteen minutes to about four minutes, with longer-term goals of achieving finality within one or two slots.
Monetary policy still requires broader community consensus.
Technical design can continuously narrow the scope of the problem, but ETH issuance policy still requires broader social consensus. Justin Drake and Anders Elowsson have both explicitly supported adjusting the current issuance mechanism in their personal capacities. They are concerned that ongoing staking incentives will place increasing relative pressure on non-stakers, pushing more users toward exchanges or liquid staking tokens, and heightening risks related to contracts, governance, and centralization.
This debate also involves the role of ETH in the economy. How would the status of native ETH as a currency and collateral change if an increasing amount of ETH is converted into staking vouchers with additional risks? Are businesses centered around staking yields crowding out other DeFi innovations? Could reduced issuance make it harder for independent stakers to enter the market? These questions cannot be answered solely by comparing nominal APYs—they require analysis of participants’ actual costs and the composition of stakers.
Supporting reform does not mean a solution has been finalized. Anders emphasized that any adjustment to issuance requires a well-designed incentive structure, a model that can explain the total staked amount and participant composition, and an open discussion about the benefits and costs. Community members have raised objections regarding the urgency of reform, who should convene the discussions, and whether the existing process is sufficient. The AMA did not result in any policy conclusions regarding reduced issuance or capped staking ratios.
EF's new organizational structure will include dedicated teams collaborating with the community.
Collaboration at the organizational level is also expanding. The Access Layer is beginning to take on application and developer support work above the protocol, Ethlabs members continue to participate in technical discussions and architecture reviews, and Ethereum Institutional is working with researchers to explain quantum-resistant pathways and Strawmap to institutions. The connection between future research, implementation, and applications will increasingly depend on sustained collaboration across multiple teams. Meanwhile, the roadmap itself remains under revision, and researchers have not yet provided complete solutions to issues such as L2 value capture, cross-chain liquidity, and privacy interoperability.