On August 13th, Ethereum researcher Justin Drake posted on X, stating that the Ethereum Foundation has decided to abandon the SNARK-friendly hash algorithm Poseidon at the L1 layer in favor of traditional hash functions like SHA2 or BLAKE2.
This decision stems from eight years of research, tens of millions of dollars in investment, and a major revision to the post-quantum cryptography roadmap.
Since its introduction in 2019, Poseidon has been considered the ideal hash scheme for applications like zkRollups and zkVMs. Its structure makes it cheaper and more efficient in SNARK circuits compared to traditional hash functions based on binary operations. However, when post-quantum security became a hard requirement for Ethereum, Poseidon's limitations began to surface.
Justin Drake stated that this shift is thanks to breakthrough progress in SNARK design, specifically through a "binary field" operational approach. This makes the performance of traditional hash functions in SNARK circuits comparable to that of Poseidon, which was previously optimized for SNARKs. A single laptop can now verify about 1 million traditional hash invocations per second.
The article notes that since its 2019 launch, Poseidon has been a mainstream SNARK-friendly hash scheme, providing security for applications like zkRollups and zkVMs. Justin Drake mentioned that plans indicate a production-ready leanVM is expected by 2027, with deployment for the consensus, data, and execution layers targeted for 2028. The Ethereum Foundation's post-quantum team is also accelerating research related to binary fields.
Why Now?
Traditional hashes have long struggled to be incorporated into SNARKs, primarily due to computational language differences. SHA2, BLAKE2s, and Keccak heavily use Boolean operations like XOR and bit shifts. Traditional SNARKs typically operate over large prime fields, simulating each bit operation at a high constraint cost. Poseidon was designed directly around prime field arithmetic, achieving higher proving speed with fewer constraints at the cost of a shorter algorithm history, requiring ongoing cryptanalysis.
The binary field shifts the underlying mathematics to the smallest prime field containing only 0 and 1, using binary extension fields to handle larger data. Bit operations can thus enter the proof system directly. SNARKs are now adapting to traditional hashes, shifting the technical focus from designing SNARK-friendly hashes to designing hash-friendly SNARKs.
Binius, proposed by Jim Posen and Benjamin Diamond in 2023, demonstrated a path for SNARKs using binary tower fields. The Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026. Its M4 Max benchmark showed single-core performance of 82,000 BLAKE3 compressions, 42,000 SHA-256 compressions, and 30,000 Keccak permutations per second. The 10-core BLAKE3 throughput exceeded 660,000 operations.
Drake noted that a laptop can now prove about 1 million traditional hash invocations per second, with an overhead roughly 100 times that of native CPU Boolean computation. SNARK.fast recently achieved 1.8 million BLAKE3 operations per second on an M3 Max.
leanVM in 2027, Three-Layer Deployment in 2028
Another key reason for abandoning Poseidon is the accelerating timeline for post-quantum security. The report "The Quantum Threat to Blockchains - 2026 Report" by Project Eleven points out that the rapid development of quantum computers poses a serious threat to blockchain security. Once a "cryptographically relevant quantum computer" (CRQC) emerges, Shor's algorithm could quickly break asymmetric encryption like ECDSA (used by Bitcoin and most public chains) and RSA. Q-Day (Quantum Decryption Day) is projected to arrive between 2030 and 2033, potentially putting trillions of dollars in on-chain assets at risk.
Since blockchain public keys are long-lived and static, and rollbacks are impossible, migration is extremely difficult. The report recommends immediately initiating Post-Quantum Cryptography (PQC) migration, including quantum-resistant signature schemes based on lattices and hashes, and transitioning gradually through hybrid schemes to avoid the full impact of the quantum threat.
Justin Drake warned that the increasing capabilities of AI in cryptanalysis have already impacted lattice-based scheme HAWK and isogeny-based scheme SQIsign. This has forced the Ethereum Foundation to place its bets on hash-based schemes, which are considered more resistant to quantum attacks.
Previously, Ethereum announced its post-quantum roadmap, including deploying a production-ready leanVM in 2027 and completing deployment on the consensus, execution, and data availability layers by 2028. leanVM is a minimalistic zero-knowledge virtual machine specifically for post-quantum signature aggregation, seen as the core component of the entire strategy.
In March 2026, the Ethereum Foundation launched pq.ethereum.org as a post-quantum security resource center. Over 10 client teams have begun running weekly post-quantum interoperability devnets. The Foundation also established a $1 million Poseidon Prize and an equal Proximity Prize to advance post-quantum cryptography research. Vitalik Buterin himself has repeatedly emphasized that post-quantum security is a necessary condition for Ethereum's "walkaway test"—Ethereum cannot "ossify" unless it achieves quantum security.
The switch in hash functions does not alter the overall structure of Ethereum's post-quantum roadmap. The BLS signatures currently used by validators rely on elliptic curves. Future schemes will still be based on hash signatures like leanXMSS, with leanVM compressing a large number of signatures into a single small proof per block. A comparison previously provided on Ethereum's official page shows that a leanXMSS signature is about 3000 bytes, while a BLS signature is only 96 bytes. leanVM aims for a data compression target of about 250x.
SHA2 or BLAKE2s have longer histories of public analysis, allowing the EF to reduce the time spent waiting for Poseidon parameters to undergo years of cryptanalysis. Drake's suggested roadmap points to a production-ready leanVM in 2027 and deployment on the consensus, data, and execution layers in 2028.
Competition: Solana Chooses Falcon
Ethereum is not the only major public chain preparing for the post-quantum era. The Solana Foundation released its post-quantum security roadmap in April 2026. Its core developer teams, Anza and Jump Crypto's Firedancer, independently researched and converged on the same post-quantum signature scheme: Falcon.
Falcon is one of the NIST-standardized post-quantum signature schemes. Its signatures are compact, making it suitable for high-throughput blockchain environments like Solana.
The two major validator client development teams, Anza and Firedancer, after independent research, both selected the post-quantum digital signature scheme Falcon. They have publicly shared preliminary implementation code on GitHub. The current roadmap involves three steps: continuously evaluating Falcon and alternatives; adopting a post-quantum scheme for new wallets when the quantum threat materializes; and finally, migrating all existing wallets. Additionally, Blueshift's Solana Winternitz Vault has been operating within the ecosystem for over two years and was cited earlier this year as an industry-leading case in a Google Quantum AI whitepaper.
The Solana Foundation stated that a material threat from quantum computing is still years away, so immediate migration is not necessary. However, research, infrastructure, and ecosystem coordination are ready, allowing for a rapid start when the time comes. It is expected that this will not significantly impact network performance.
Starknet is currently the closest reference point to the EF's new direction. StarkWare's roadmap, announced on June 30th, is divided into three phases. The first phase will replace the Pedersen hash algorithm with BLAKE2 for state commitments, contract addresses, and network configurations, while also introducing post-quantum consensus signatures like Falcon-512. The second phase focuses on migration tools for traditional contracts. The final phase addresses remaining external dependencies still tied to Ethereum, including bridge system calls and blob data availability. The third phase depends on Ethereum's own migration path.
Compared to other public chains, Ethereum has chosen a path of "establishing standards first, then implementing code." Abandoning Poseidon in favor of SHA2/BLAKE2 is essentially a choice for more mature, widely-vetted cryptographic primitives in the post-quantum era.
