Eight-Year Investment U-Turn: Why Did Ethereum Suddenly Abandon Poseidon?

Original Title: "Eight-Year Investment Makes U-Turn: Why Did Ethereum Suddenly Abandon Poseidon?"
Original Author: ChandlerZ, Foresight News

On August 13, Ethereum researcher Justin Drake announced in a post on X that the Ethereum Foundation has decided to abandon the SNARK-friendly hash algorithm Poseidon at the L1 layer, opting instead for traditional hash functions like SHA2 or BLAKE2.

This decision comes after eight years of research, tens of millions of dollars in investment, and a significant revision to the post-quantum cryptography roadmap.

Since its introduction in 2019, Poseidon has been considered the ideal hash solution for applications such as zkRollup and zkVM, with its structure making it cheaper and more efficient in SNARK circuits than traditional binary-based hash functions. However, as post-quantum security became a non-negotiable requirement for Ethereum, the limitations of Poseidon began to surface.

Justin Drake stated that this transition has been made possible by breakthroughs in SNARK design, allowing traditional hash functions to perform as well in SNARK circuits using a "binary field" approach, making them comparable in performance to Poseidon, which was previously tailored for SNARK optimization. A single laptop can now verify about 1 million traditional hash calls per second.

The article explains that Poseidon has been a mainstream SNARK-friendly hash solution since 2019, providing security for applications like zkRollup and zkVM. Justin Drake mentioned that the roadmap indicates the production-grade leanVM is expected to launch in 2027, with deployments related to the consensus layer, data layer, and execution layer projected to be completed in 2028. The Ethereum Foundation's post-quantum team is also accelerating research on binary fields.

Why Now?

Traditional hashes have long struggled to enter SNARK, with the main obstacle being computational language differences. SHA2, BLAKE2s, and Keccak heavily use XOR, shifts, and other Boolean operations, while traditional SNARKs typically operate on large prime fields for arithmetic, leading to costly constraints when simulating bitwise operations. Poseidon was directly designed around prime field arithmetic to reduce constraints in exchange for faster proofs, but at the cost of a shorter algorithmic history requiring ongoing cryptanalysis.

Binary fields shift the underlying math to the smallest field containing only 0 and 1, with binary extensions carrying larger data. Bitwise operations can thus directly enter the proof system, enabling SNARKs to adapt traditional hashes. The technical focus has transitioned from designing SNARK-friendly hashes to designing hash-friendly SNARKs.

Jim Posen and Benjamin Diamond presented the Binius binary tower domain SNARK path in 2023, while the Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026, with its M4 Max benchmark achieving 82,000 BLAKE3 compressions, 42,000 SHA-256 compressions, and 30,000 Keccak permutations per single-core proof and over 660,000 throughput for 10 cores using BLAKE3.

Drake stated that a laptop can prove approximately 1 million traditional hash invocations per second, costing about 100 times more than native CPU Boolean computation. SNARK.fast achieved 1.8 million BLAKE3 compressions per second on the M3 Max a few days ago.

2027 leanVM, 2028 three-stage deployment

Another key reason for the abandonment of Poseidon is the accelerating timeline for post-quantum security. The "The Quantum Threat to Blockchains - 2026 Report" released by Project Eleven highlights that the rapid progress of quantum computing poses a significant threat to blockchain security. Once "Cryptographically Relevant Quantum Computers" (CRQCs) emerge, the Shor algorithm can quickly break ECDSA (used by Bitcoin and most public blockchains) and RSA, among other asymmetric encryption schemes. It is anticipated that Quantum Decryption Day (Q-Day) may occur between 2030 and 2033, posing a risk to trillions of dollars worth of on-chain assets.

Due to the long-lived and non-rollback nature of blockchain public keys, migration poses a significant challenge. The report recommends an immediate initiation of post-quantum cryptography (PQC) migration, including lattice-based, hash-based, and other quantum-resistant signature schemes, and a gradual transition via hybrid schemes to avert a full-blown quantum threat.

Justin Drake warned that the enhanced capability of AI in cryptanalysis has dealt successive blows to lattice-based scheme HAWK and homomorphic scheme SQIsign. This has compelled the Ethereum Foundation to double down on hash-based schemes, which are believed to offer stronger resistance against quantum attacks.

Previously, Ethereum unveiled its post-quantum roadmap, aiming to deploy the production-grade leanVM in 2027 and achieve a three-stage deployment in 2028 across the consensus, execution, and data availability layers. leanVM is a minimalistic zero-knowledge virtual machine specialized for post-quantum signature aggregation and is considered a core component of the entire strategy.

In March 2026, the Ethereum Foundation launched pq.ethereum.org as a post-quantum security resource center. Over 10 client teams have started weekly runs of the post-quantum interoperability devnet. The Foundation also established the $1 million Poseidon Prize and an equal amount Proximity Prize to advance post-quantum cryptography research. Vitalik Buterin himself has emphasized multiple times that post-quantum security is a necessary condition for Ethereum's "walkaway test," stating that Ethereum cannot be "ossified" unless it achieves quantum security.

The hash function switch will not alter the overall structure of Ethereum's post-quantum roadmap. The BLS signatures currently used by validators rely on elliptic curves, while the future scheme is based on hash-based signatures like leanXMSS, compressed into a small proof per block by leanVM. A previous Ethereum page comparison indicated that a leanXMSS signature is about 3000 bytes, a BLS signature is only 96 bytes, and leanVM aims to compress data by approximately 250 times.

SHA2 or BLAKE2s have a longer history of public analysis, allowing the Ethereum Foundation to reduce the time for the Poseidon parameters to undergo years of cryptographic analysis. Drake's strawmap points to the production-level leanVM in 2027, and the deployment of the consensus layer, data layer, and execution layer in 2028.

Neck-and-Neck, Solana Chooses Falcon

Ethereum is not the only mainstream public chain preparing for the post-quantum era. In April 2026, the Solana Foundation released its post-quantum security roadmap. The core development teams, Anza and Jump Crypto, independently chose the same post-quantum signature scheme, Falcon, after conducting separate research.

Falcon is one of the NIST-standardized post-quantum signature schemes known for its compact signatures, suitable for high-throughput blockchain environments like Solana.

Both major validator client development teams, Anza and Firedancer, independently selected the post-quantum digital signature scheme Falcon after their research and have each publicly released preliminary implementation code on GitHub. The current roadmap consists of three steps: continuous evaluation of Falcon and alternative schemes; adoption of post-quantum schemes for new wallets when the quantum threat materializes; and eventually migrating the existing wallet infrastructure entirely. Additionally, Blueshift's Solana Winternitz Vault has been running in the ecosystem for over two years and was referenced in a Google Quantum AI whitepaper earlier this year as an industry-leading use case.

The Solana Foundation has stated that the threat of quantum computing will still take several years to materialize, and immediate migration is not necessary. However, research, infrastructure, and ecosystem coordination are all ready. Once the time is right, the transition can be quickly initiated with no significant impact expected on network performance.

Starknet stands as the closest comparison to Ethereum Foundation's new direction. StarkWare announced its roadmap on June 30, divided into three phases. The first phase will replace the Pedersen hash algorithm with BLAKE2 for state commitments, contract addresses, and network configuration. It will also introduce post-quantum consensus signatures like Falcon-512. The second phase will focus on migration tools for traditional contracts, and the final phase will address external dependencies still related to Ethereum, including bridge system calls and blob data availability. The third phase will depend on Ethereum's own migration path.

Compared to other public blockchains, Ethereum has chosen a "standard-first, code-later" approach. By switching from Poseidon to SHA2/BLAKE2, Ethereum has actually opted for a more mature and widely validated cryptographic primitive in the post-quantum era.

Original Article Link