After eight years of investment, why did Ethereum abandon Poseidon?
By ChandlerZ, Foresight News
Original title: After eight years in a sharp turn, why did Ethereum suddenly abandon Poseidon?
On August 13, Ethereum researcher Justin Drake wrote on X that the Ethereum Fund decided to abandon the SNARK-friendly hash algorithm Poseidon at the L1 layer and instead use traditional hash functions such as SHA2 or BLAKE2.
Behind this decision is eight years of research, the accumulation of tens of millions of dollars, and a major revision to the post-quantum cryptography roadmap.
Since its launch in 2019, Poseidon has been regarded as an ideal hashing scheme for applications such as zkRollup and zKVM. Its structure makes it cheaper and more efficient than traditional binary-based hash functions in SNARK circuits. But when post-quantum security became a hard requirement for Ethereum, Poseidon's limitations began to be exposed.
Justin Drake said that this shift is due to groundbreaking SNARK design progress, that is, the performance of traditional hash functions in SNARK circuits is comparable to that of Poseidon, which was previously designed specifically for SNARK optimization. A single laptop can verify about 1 million traditional hash calls per second.
According to the article, Poseidon has been the mainstream SNARK-friendly hashing scheme since its launch in 2019, providing security guarantees for applications such as zkRollup and zKVM. Justin Drake said that the plan shows that production-grade LeanVM is expected to be launched in 2027, the relevant deployment of the consensus layer, data layer and execution layer is expected to be completed in 2028, and the quantum team is also accelerating research related to the binary domain after the Ethereum Foundation.
Why now?
Traditional hashes have been difficult to enter SNARK for a long time, and the main obstacle comes from differences in computational languages. SHA2, BLAKE2s, and Keccak make extensive use of Boolean operations such as XOR and shift. Traditional SNARK usually processes arithmetic on large prime numbers, and simulating every bit operation can incur high constraint costs. Poseidon is designed directly around prime field arithmetic, with fewer constraints in exchange for higher proof speed. The cost is that the algorithm has a short history and requires continuous cryptographic analysis.
The binary domain switches the underlying math to the smallest element domain containing only 0 and 1, and uses the binary domain extension to carry larger data. As a result, bit computation can directly enter the proof system. SNARK began to adapt to traditional hashes, and the technical focus changed from designing SNARK-friendly hashes to designing hash-friendly SNARKs.
Binius, proposed by Jim Posen and Benjamin Diamond in 2023, shows the binary tower domain SNARK path. The Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026. Its M4 Max benchmark is that a single core proves 82,000 times of BLAKE3 compression and 42,000 SHA- cycles per second With 256 compression and 30,000 Keccak replacements, the 10-core BLAKE3 has a throughput of over 660,000 times.
According to Drake, the laptop can prove about 1 million traditional hash calls per second, which is about 100 times the cost of native CPU Boolean calculations; SNARK.fast reached 1.8 million BLAKE3 per second on M3 Max a few days ago.
LeanVM in 2027, three-tier deployment in 2028
Another key reason for Poseidon's abandonment is that the post-quantum security timeline is accelerating. “The Quantum Threat to Blockchains - 2026 Report” published by Project Eleven points out that the rapid development of quantum computers is posing a serious threat to blockchain security. Once a “cryptographics-related quantum computer” (CRQC) appears, the Shor algorithm can quickly crack asymmetric cryptography such as ECDSA (used by Bitcoin and most public chains) and RSA. It is expected that Q-Day (quantum decryption day) may arrive from 2030 to 2033, when trillions of dollars of on-chain assets will be at risk.
Since blockchain public keys are static for a long time and cannot be rolled back, migration is extremely difficult. The report suggests immediately starting post-quantum cryptography (PQC) migration, including anti-quantum signature schemes such as lattice and hashing, and gradually transitioning through hybrid schemes to avoid a full outbreak of quantum threats.
Justin Drake warned that the enhanced ability of AI in cryptographic analysis has caused HAWK, the Grizzly solution, and SQiSign, a homologous solution, to be hit one after another. This has forced the Ethereum Foundation to bet on hash-based solutions, which are considered more resistant to quantum attacks.
Previously, Ethereum had announced its subsequent quantum roadmap, which included deploying production-grade LeanVM in 2027 and completing deployment at the consensus layer, execution layer, and data availability layer in 2028. LeanVM is a minimized zero-knowledge virtual machine dedicated to post-quantum signature aggregation, and is considered a core component of the overall strategy.
In March 2026, the Ethereum Foundation launched pq.ethereum.org as a post-quantum security resource center, and more than 10 client teams have begun running a weekly post-quantum interoperability development network. The Foundation also set up the $1 million Poseidon Prize and the equivalent Proximity Prize to advance post-quantum cryptography research. Vitalik Buterin himself has emphasized many times that post-quantum security is a necessary condition for Ethereum's “walkaway test” (a test where you can leave with confidence), and unless Ethereum achieves quantum security, it cannot be “rigid.”
The hash function switch will not change the overall structure of Ethereum's post-quantum path. The BLS signatures currently used by the validators rely on elliptic curves. Future solutions are still based on hash signatures such as LeanXMSS, and then LeanVM compresses a large number of signatures into a small certificate for each block. The comparison previously given on the official Ethereum page is that the LeanXMSS signature is about 3000 bytes, the BLS signature is only 96 bytes, and LeanVM's data compression target is about 250 times.
SHA2 or BLAKE2s have a longer history of open analysis, and EF can reduce the time it takes to wait for Poseidon parameters to undergo years of cryptographic analysis. Drake's strawmap points to 2027 production-grade LeanVM, and 2028 consensus layer, data layer, and execution layer deployments.
Peer racing, Solana picks Falcon
Ethereum is not the only mainstream public chain preparing for the post-quantum era. The Solana Foundation released a post-quantum security roadmap in April 2026, and its core developer team, Anza and Jump Crypto's Firedancer, both chose Falcon, the same post-quantum signature scheme after independent research.
Falcon is one of NIST's standardized post-quantum signature schemes. Its signature is compact and suitable for high-throughput blockchain environments such as Solana.
The two major validator client development teams, Anza and FireDancer, have unanimously selected Falcon, a post-quantum digital signature scheme after independent research, and have each published the initial implementation code on GitHub. The current roadmap consists of three steps: continuously evaluating Falcon and alternatives; adopting a post-quantum solution for new wallets when the quantum threat becomes a reality; and finally migrating the entire existing wallet. Additionally, Blueshift's Solana Winternitz Vault has been running in the ecosystem for over two years and was cited as an industry-leading case in Google's quantum AI white paper earlier this year.
The Solana Foundation said that quantum computing still poses a real threat for several years, and there is currently no need for immediate migration, but research, infrastructure and ecological coordination are all in place. Once the time is right, it can be launched quickly, and it is not expected to have a significant impact on network performance.
Starknet is currently the closest contrast to EF's new direction. StarkWare announced its roadmap on June 30. The first phase will replace the Pedersen hashing algorithm with BLAKE2 for state promises, contract addresses, and network configurations, and will also introduce post-quantum consensus signatures, such as Falcon-512; the second phase will focus on migration tools for traditional contracts, while the final phase will focus on addressing external dependencies still associated with Ethereum, including bridging system calls and blob data availability; the third phase will depend on Ethereum's own migration path.
Compared to other public chains, Ethereum has chosen a “standard first, code later” path. Abandoning Poseidon and moving to SHA2/BLAKE2 is actually choosing more mature and widely verified cryptographic primitives in the post-quantum era.
Twitter:https://twitter.com/BitpushNewsCN
Compare the TG exchange group:https://t.me/BitPushCommunity
Compare TG subscriptions:https://t.me/bitpush
