Vitalik Buterin on Ethereum’s Roadmap: zkEVM, Quantum Resistance and 10-Second Finality

Two days after the largest DeFi hack of 2026 drained $292 million from a bridge and sent $6.6 billion fleeing from Aave, Vitalik Buterin took the stage in Hong Kong and made the case for why Ethereum was built the way it was.

The timing was not lost on anyone in the room.

Vitalik’s Message Is Clear: Security Over Speed

Speaking at the opening ceremony of the 2026 Hong Kong Web3 Carnival, Buterin described Ethereum as a “world computer” – not a payments network competing on transactions per second, but a platform for verifiable data and shared digital assets where users control their own security.

That framing is a direct answer to the criticism Ethereum has faced for years. While Solana and other chains chase throughput, Buterin is doubling down on something different: trustworthiness.

Inside Ethereum’s Roadmap

Buterin laid out a three-layer plan.

In the short term, Ethereum is focused on scaling the gas limit, rolling out zkEVM, and beginning preparation for the post-quantum era. zkEVM allows Ethereum to perform more complex computations while keeping on-chain information verifiable – scaling without sacrificing transparency.

In the mid term, the goal is reducing transaction finality to between 10 and 20 seconds. Today that process takes roughly 16 minutes.

The long-term vision is the most ambitious: full quantum resistance, formal verification of the entire protocol, and maximised decentralisation. Buterin wants Ethereum to be verifiable by anyone on any device.

“zkVM allows you to verify the chain without relying on a large computer to run all operations yourself,” he said. “Everyone should verify the chain before you trust it; even your phone and IoT devices should verify the chain.”

The $292M Hack That Made Vitalik’s Argument For Him

The rsETH exploit on April 18 exposed exactly the kind of cross-chain bridge complexity Ethereum has historically been cautious about. An attacker used a single-verifier configuration on a LayerZero bridge to mint 116,500 unbacked rsETH tokens, deposit them on Aave as collateral, and walk away with real ETH. The fallout froze markets, trapped depositors, and raised uncomfortable questions about DeFi’s composability risk.

Buterin did not address the hack directly. He did not need to.

A roadmap built around security, decentralisation, and verifiability is the answer. The critics who say Ethereum moves too slowly might want to ask how a faster, less decentralised Ethereum would have handled Saturday.