Why Did Ethereum Suddenly Abandon Poseidon After Eight Years of Investment?

Original Title: "Why Did Ethereum Suddenly Abandon Poseidon After Eight Years of Investment?"
Original Author: ChandlerZ, Foresight News

On August 13, Ethereum researcher Justin Drake announced on X that the Ethereum Foundation has decided to abandon the SNARK-friendly hash algorithm Poseidon at the L1 layer, opting instead for traditional hash functions like SHA2 or BLAKE2.
This decision is the result of eight years of research and tens of millions of dollars in investment, as well as a significant revision of the post-quantum cryptography roadmap.
Since its launch in 2019, Poseidon has been regarded as an ideal hash solution for applications such as zkRollup and zkVM, as its structure makes it cheaper and more efficient in SNARK circuits compared to traditional binary operation-based hash functions. However, as post-quantum security became a stringent requirement for Ethereum, the limitations of Poseidon began to surface.
Justin Drake stated that this shift is made possible by groundbreaking advancements in SNARK design, which allow traditional hash functions to achieve performance in SNARK circuits comparable to Poseidon, which was previously optimized specifically for SNARK. A single laptop can now perform approximately 1 million traditional hash calls per second.
The article notes that Poseidon has been the mainstream SNARK-friendly hash solution since its launch in 2019, providing security for applications like zkRollup and zkVM. Justin Drake mentioned that plans indicate that a production-grade leanVM is expected to be launched in 2027, with related deployments for the consensus layer, data layer, and execution layer expected to be completed in 2028. The Ethereum Foundation's post-quantum team is also accelerating research related to binary fields.
### Why Now?
Traditional hashes have long struggled to enter SNARK due to differences in computational languages. SHA2, BLAKE2s, and Keccak heavily utilize Boolean operations such as XOR and shifts, while traditional SNARK typically handles arithmetic over large prime fields, leading to high constraint costs when simulating each bit operation. Poseidon was designed directly around arithmetic in prime fields, trading fewer constraints for higher proof speeds, but at the cost of a shorter algorithm history that requires ongoing cryptanalysis.
Binary fields switch the underlying mathematics to the smallest prime field containing only 0 and 1, using binary extension fields to carry larger data. Bit operations can thus directly enter the proof system, allowing SNARK to adapt to traditional hashes, shifting the technical focus from designing SNARK-friendly hashes to designing hash-friendly SNARK.
The Binius path proposed by Jim Posen and Benjamin Diamond in 2023 demonstrates the binary tower field SNARK approach, while the Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026, showing an M4 Max benchmark of 82,000 BLAKE3 compressions, 42,000 SHA-256 compressions, and 30,000 Keccak permutations per second on a single core, with a throughput of over 660,000 for BLAKE3 on 10 cores.
Drake noted that a laptop can prove about 1 million traditional hash calls per second, at a cost approximately 100 times that of native CPU Boolean computations; SNARK.fast recently achieved 1.8 million BLAKE3 calls per second on an M3 Max.
### 2027 LeanVM, 2028 Three-Layer Deployment
Another key reason for abandoning Poseidon is that the timeline for post-quantum security is accelerating. The "The Quantum Threat to Blockchains - 2026 Report" published by Project Eleven points out that the rapid development of quantum computers poses a serious threat to blockchain security. Once "cryptographically relevant quantum computers" (CRQC) emerge, Shor's algorithm could quickly break ECDSA (used by Bitcoin and most public chains) and RSA asymmetric encryption. Q-Day (Quantum Decryption Day) is expected to arrive between 2030 and 2033, at which point trillions of dollars in on-chain assets will be at risk.
Due to the long-term static nature of blockchain public keys and the difficulty of rollback, migration is extremely challenging. The report recommends immediate initiation of post-quantum cryptography (PQC) migration, including lattice-based, hash-based, and other quantum-resistant signature schemes, and a gradual transition through hybrid schemes to avoid a full-blown quantum threat.
Justin Drake warned that the enhanced capabilities of AI in cryptanalysis have already put lattice-based schemes like HAWK and its derivatives SQIsign under pressure. This has forced the Ethereum Foundation to bet on hash-based schemes, which are considered to have stronger resistance to quantum attacks.
Previously, Ethereum had announced its post-quantum roadmap, including the deployment of a production-grade leanVM in 2027 and the completion of deployments in the consensus layer, execution layer, and data availability layer in 2028. LeanVM is a minimized zero-knowledge virtual machine specifically designed for post-quantum signature aggregation and is seen as a core component of the entire strategy.
In March 2026, the Ethereum Foundation launched pq.ethereum.org as a resource center for post-quantum security, with over 10 client teams beginning to run a post-quantum interoperability development network weekly. The Foundation has also established a $1 million Poseidon Prize and an equivalent Proximity Prize to advance post-quantum cryptography research. Vitalik Buterin himself has repeatedly emphasized that post-quantum security is a necessary condition for Ethereum's "walkaway test"—it cannot be "frozen" unless Ethereum achieves quantum security.
The switch of hash functions will not change the overall structure of Ethereum's post-quantum roadmap. The BLS signatures currently used by validators rely on elliptic curves, while future solutions will still be based on hash signatures like leanXMSS, which will then be compressed by leanVM into a small proof for each block. The comparison previously provided on Ethereum's official page indicated that leanXMSS signatures are about 3,000 bytes, BLS signatures are only 96 bytes, and leanVM's data compression target is about 250 times.
SHA2 or BLAKE2s have a longer history of public analysis, allowing the EF to reduce the time spent waiting for Poseidon parameters to undergo years of cryptanalysis. Drake's strawmap points to the production-grade leanVM in 2027, and the deployment of the consensus layer, data layer, and execution layer in 2028.
### Competitive Race, Solana Chooses Falcon
Ethereum is not the only mainstream public chain preparing for the post-quantum era. The Solana Foundation released its post-quantum security roadmap in April 2026, with its core developer teams Anza and Jump Crypto's Firedancer independently selecting the same post-quantum signature scheme, Falcon.
Falcon is one of the post-quantum signature schemes standardized by NIST, known for its compact signatures, making it suitable for high-throughput blockchain environments like Solana.
The two major validator client development teams, Anza and Firedancer, have independently selected the post-quantum digital signature scheme Falcon and have publicly released preliminary implementation code on GitHub. The current roadmap is divided into three steps: continuous evaluation of Falcon and alternative schemes; adopting post-quantum solutions for new wallets when quantum threats materialize; and ultimately migrating existing wallets as a whole. Additionally, Blueshift's Solana Winternitz Vault has been running in the ecosystem for over two years and was cited earlier this year in a Google Quantum AI white paper as a cutting-edge industry case.
The Solana Foundation stated that while quantum computing poses a substantial threat, it will take several years to materialize, and there is no immediate need for migration. However, research, infrastructure, and ecosystem coordination are all ready to be quickly initiated once the timing is right, with no significant impact expected on network performance.
Starknet is currently the closest comparison to EF's new direction. StarkWare announced its roadmap on June 30, which will be carried out in three phases. The first phase will replace the Pedersen hash algorithm with BLAKE2 for state commitments, contract addresses, and network configurations, while also introducing post-quantum consensus signatures, such as Falcon-512; the second phase will focus on migration tools for traditional contracts, and the final phase will address remaining external dependencies related to Ethereum, including bridge system calls and blob data availability; the third phase will depend on Ethereum's own migration path.
Compared to other public chains, Ethereum has chosen a path of "setting standards first, then moving code." Abandoning Poseidon in favor of SHA2/BLAKE2 is essentially opting for more mature and widely validated cryptographic primitives in the post-quantum era.
> Original Link