Author: ChandlerZ, Foresight News
On August 13, Ethereum researcher Justin Drake announced on X that the Ethereum Foundation has decided to abandon the SNARK-friendly hash algorithm Poseidon at the L1 layer in favor of traditional hash functions like SHA2 or BLAKE2.
This decision is the culmination of eight years of research, tens of millions of dollars in investment, and a significant revision to the post-quantum cryptography roadmap.
Since its introduction in 2019, Poseidon has been regarded as an ideal hashing solution for applications like zkRollups and zkVMs. Its structure made it cheaper and more efficient within SNARK circuits compared to traditional binary-operation-based hash functions. However, when post-quantum security became a hard requirement for Ethereum, Poseidon's limitations began to surface.
Justin Drake stated that this shift is thanks to a breakthrough in SNARK design, specifically an "binary field" arithmetic approach that enables traditional hash functions to perform comparably to previously SNARK-optimized designs like Poseidon within SNARK circuits. A single laptop can now verify approximately 1 million traditional hash invocations per second.
The article notes that Poseidon has been a mainstream SNARK-friendly hash scheme since 2019, providing security for applications like zkRollups and zkVMs. Drake indicated that plans show a production-ready leanVM is expected to launch in 2027, with deployment across the consensus, data, and execution layers slated for 2028. The Ethereum Foundation's post-quantum team is also accelerating research related to binary fields.
Why Now?
The main barrier preventing traditional hashes from being used in SNARKs has long been computational language differences. SHA2, BLAKE2s, and Keccak heavily use Boolean operations like XOR and bit shifts. Traditional SNARKs typically handle arithmetic over large prime fields, and simulating each bit operation incurs high constraint costs. Poseidon was designed directly around prime field arithmetic, achieving higher proving speeds with fewer constraints at the cost of a shorter algorithmic history requiring ongoing cryptanalysis.
Binary fields switch the underlying mathematics to the smallest prime field containing only 0 and 1, using binary extension fields to handle larger data. Bit operations can thus be directly incorporated into the proof system. SNARKs are now adapting to traditional hashes, shifting the technical focus from designing SNARK-friendly hashes to designing hash-friendly SNARKs.
The Binius proposal by Jim Posen and Benjamin Diamond in 2023 demonstrated a path using binary tower field SNARKs. The Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026, reporting benchmarks of 82,000 BLAKE3 compressions, 42,000 SHA-256 compressions, and 30,000 Keccak permutations proven per second on a single M4 Max core, with 10-core BLAKE3 throughput exceeding 660,000 operations per second.
Drake noted that laptops can now prove about 1 million traditional hash invocations per second, at a cost roughly 100 times that of native CPU Boolean computation. SNARK.fast reportedly reached 1.8 million BLAKE3 operations per second on an M3 Max just days ago.
leanVM in 2027, Three-Layer Deployment in 2028
Another key reason for abandoning Poseidon is the accelerating timeline for post-quantum security. Project Eleven's "The Quantum Threat to Blockchains - 2026 Report" warns that the rapid development of quantum computers poses a serious threat to blockchain security. Once a "Cryptographically Relevant Quantum Computer" (CRQC) emerges, Shor's algorithm could quickly break asymmetric encryption like ECDSA (used by Bitcoin and most public chains) and RSA. Q-Day (the day of quantum decryption) is estimated to potentially arrive between 2030 and 2033, putting trillions of dollars in on-chain assets at risk.
Because blockchain public keys are static long-term and cannot be rolled back, migration is extremely difficult. The report recommends immediately initiating Post-Quantum Cryptography (PQC) migration, including quantum-resistant signature schemes based on lattices and hashes, and transitioning gradually via hybrid schemes to prevent a full-scale quantum threat outbreak.
Justin Drake warned that AI's enhanced capabilities in cryptanalysis have already impacted lattice-based scheme HAWK and isogeny-based scheme SQIsign. This has forced the Ethereum Foundation to place its bet on hash-based schemes, which are considered more resilient against quantum attacks.
Previously, Ethereum published its post-quantum roadmap, including deploying a production-ready leanVM in 2027 and completing deployment across the consensus, execution, and data availability layers in 2028. leanVM is a minimal zero-knowledge virtual machine designed for post-quantum signature aggregation and is seen as a core component of the overall strategy.
In March 2026, the Ethereum Foundation launched pq.ethereum.org as a post-quantum security resource hub. Over 10 client teams have begun running weekly post-quantum interoperability devnets. The Foundation also established the $1 million Poseidon Prize and an equal-sized Proximity Prize to advance post-quantum cryptography research. Vitalik Buterin has repeatedly emphasized that post-quantum security is a necessary condition for Ethereum's "walkaway test"—Ethereum cannot "ossify" until it achieves quantum safety.
The hash function switch does not alter the overall structure of Ethereum's post-quantum roadmap. The BLS signatures currently used by validators rely on elliptic curves. The future scheme will still be based on hash signatures like leanXMSS, with leanVM then compressing a large number of signatures into one small proof per block. A previous comparison on Ethereum's official page showed that a leanXMSS signature is about 3000 bytes, while a BLS signature is only 96 bytes. The data compression target for leanVM is approximately 250x.
SHA2 or BLAKE2s have longer histories of public analysis, allowing the EF to reduce the time spent waiting for Poseidon parameters to undergo years of cryptanalysis. Drake's strawmap points to a production-ready leanVM in 2027 and deployment across the consensus, data, and execution layers in 2028.
Competitive Race, Solana Chooses Falcon
Ethereum is not the only major public chain preparing for the post-quantum era. The Solana Foundation released its post-quantum security roadmap in April 2026. Its core developer teams, Anza and Jump Crypto's Firedancer, independently reached the same conclusion, selecting the same post-quantum signature scheme: Falcon.
Falcon is one of the NIST-standardized post-quantum signature schemes. Its signatures are compact, making it suitable for high-throughput blockchain environments like Solana.
After independent research, the two major validator client development teams, Anza and Firedancer, both selected the post-quantum digital signature scheme Falcon and have publicly shared initial implementation code on GitHub. The current roadmap has three phases: continuous evaluation of Falcon and alternatives; adopting post-quantum schemes for new wallets once the quantum threat materializes; and finally, migrating existing wallets en masse. Additionally, Blueshift's Solana Winternitz Vault has been running in the ecosystem for over two years and was cited earlier this year in a Google Quantum AI whitepaper as a leading industry case study.
The Solana Foundation stated that a material threat from quantum computing is still years away, so immediate migration is not necessary. However, research, infrastructure, and ecosystem coordination are ready, allowing for a rapid launch when the time comes, with minimal expected impact on network performance.
Starknet is currently the closest point of comparison to the EF's new direction. StarkWare's roadmap, announced on June 30, outlines a three-phase process. The first phase will replace the Pedersen hash algorithm with BLAKE2 for state commitments, contract addresses, and network configuration, while also introducing post-quantum consensus signatures like Falcon-512. The second phase focuses on migration tools for traditional contracts. The third phase addresses external dependencies still tied to Ethereum, including bridge system calls and blob data availability, and depends on Ethereum's own migration path.
Compared to other public chains, Ethereum has chosen a path of "establishing standards first, then modifying code." Abandoning Poseidon for SHA2/BLAKE2 is a choice for more mature and widely validated cryptographic primitives in the post-quantum era.
