Ethereum has decided to drop the SNARK-friendly hash function Poseidon at Layer 1 and move to traditional hash functions such as SHA2 or BLAKE2, according to a post on X by Ethereum researcher Justin Drake on Aug. 13.
The decision marks a major adjustment in Ethereum’s post-quantum cryptography roadmap after eight years of research and tens of millions of dollars in spending. In Drake’s framing, the network is choosing a more conservative path, but one with greater certainty.
Why Ethereum is walking away from Poseidon
Since its launch in 2019, Poseidon has been treated as the leading SNARK-friendly hash design for applications such as zkRollups and zkVMs. Its structure made it cheaper and faster inside SNARK circuits than traditional hash functions built around binary operations.
That advantage weakened once post-quantum security became a hard requirement. Drake said recent advances in SNARK design have made it possible for conventional hash functions to approach the performance once reserved for Poseidon and similar designs.
The change is tied to binary-field computation. In Drake’s description, this approach lets traditional hash functions run inside SNARK circuits in a much more natural way. He said a single laptop can now verify about 1 million conventional hash calls per second.
Poseidon, in other words, is no longer the obvious trade-off if Ethereum wants a post-quantum stack built on primitives with a longer public analysis history. Drake also said a production-grade leanVM is expected in 2027, with deployments tied to the consensus, data, and execution layers expected in 2028. Ethereum Foundation teams focused on post-quantum work are accelerating research tied to binary fields.
How binary fields changed the economics of hash functions in SNARKs
Traditional hash functions struggled for years inside SNARK systems because the underlying computational languages did not match. SHA2, BLAKE2s, and Keccak rely heavily on Boolean operations such as XOR and bit shifts. Classical SNARKs usually work over large prime fields and arithmetic constraints. Emulating bit-level logic inside that environment has been expensive.
Poseidon took the opposite route. It was built around prime-field arithmetic, reducing constraints and speeding up proofs, but at the cost of a shorter track record and an ongoing need for cryptanalysis.
Binary-field systems change that setup. They move the underlying math to the smallest prime field containing only 0 and 1, then use binary extension fields to carry larger data. That allows bit operations to enter the proving system directly. The engineering focus shifts from designing SNARK-friendly hashes to designing hash-friendly SNARKs.
Drake pointed to several milestones. Binius, proposed in 2023 by Jim Posen and Benjamin Diamond, outlined a route based on binary tower fields. The Flock paper by Benedikt Bünz, Ron Rothblum, and William Wang was uploaded to arXiv on July 29, 2026. Its M4 Max benchmarks showed single-core proving throughput of 82,000 BLAKE3 compressions per second, 42,000 SHA-256 compressions per second, and 30,000 Keccak permutations per second. With 10 cores, BLAKE3 throughput exceeded 660,000.
Drake added that a laptop can prove about 1 million conventional hash calls per second at a cost around 100x native CPU Boolean computation. He also said SNARK.fast reached 1.8 million BLAKE3 operations per second on an M3 Max a few days ago.
The post-quantum timeline is speeding up
A second reason for abandoning Poseidon is the pace of the post-quantum timeline. Project Eleven’s report, The Quantum Threat to Blockchains - 2026 Report, said fast progress in quantum computing is creating a serious threat to blockchain security.
According to the report, once a cryptographically relevant quantum computer, or CRQC, becomes available, Shor’s algorithm could quickly break asymmetric cryptography schemes such as ECDSA and RSA. ECDSA is used by Bitcoin and most public blockchains. The report estimated that Q-Day could arrive between 2030 and 2033, putting trillions of dollars in onchain assets at risk.
Because blockchain public keys are long-lived and cannot be rolled back, migration is difficult. The report recommended starting post-quantum cryptography migration immediately, including lattice-based and hash-based signature schemes, while using hybrid approaches during the transition.
Drake also warned that stronger AI-assisted cryptanalysis has already hit the lattice-based scheme HAWK and the isogeny-based scheme SQIsign. That has pushed the Ethereum Foundation toward hash-based approaches, which are regarded as more resilient against quantum attacks.
leanVM remains the center of Ethereum’s plan
The hash-function switch does not alter the basic structure of Ethereum’s post-quantum roadmap. Ethereum has already outlined a plan to deploy a production-grade leanVM in 2027 and complete deployment across the consensus layer, execution layer, and data availability layer in 2028.
leanVM is a minimal zero-knowledge virtual machine built specifically for post-quantum signature aggregation, and it sits at the center of the strategy. Validators today rely on BLS signatures, which depend on elliptic curves. The future design still points to hash-based signatures such as leanXMSS, with leanVM compressing many signatures into one small proof per block.
Ethereum’s official materials previously compared the formats this way: a leanXMSS signature is about 3,000 bytes, while a BLS signature is only 96 bytes. The data compression target for leanVM is about 250x.
On the implementation side, the Ethereum Foundation launched pq.ethereum.org in March 2026 as a resource hub for post-quantum security. More than 10 client teams have started running a weekly post-quantum interoperability devnet. The Foundation also set up a $1 million Poseidon Prize and a second $1 million Proximity Prize to support research in post-quantum cryptography.
Vitalik Buterin has repeatedly said post-quantum security is a requirement for Ethereum to pass the “walkaway test.” In his framing, Ethereum cannot ossify unless it becomes quantum-safe.
Moving to SHA2 or BLAKE2s also gives Ethereum access to primitives with a much longer public analysis history. That reduces the time the Foundation would otherwise spend waiting for Poseidon parameters to undergo more years of cryptanalysis. Drake’s strawmap still points to a production-grade leanVM in 2027 and deployments across the consensus, data, and execution layers in 2028.
Peers are moving too: Solana picked Falcon, Starknet is shifting to BLAKE2
Ethereum is not alone among major blockchains preparing for a post-quantum environment. In April 2026, the Solana Foundation released its own post-quantum security roadmap. Its two core validator client teams, Anza and Jump Crypto’s Firedancer, independently reached the same conclusion and selected Falcon as their post-quantum signature scheme.
Falcon is one of the NIST-standardized post-quantum signature schemes, with compact signatures that fit a high-throughput chain such as Solana. Anza and Firedancer have each published early implementation code on GitHub.
Solana’s roadmap has three steps:
- continue evaluating Falcon and alternative schemes;
- adopt a post-quantum scheme for new wallets once the quantum threat becomes real;
- eventually migrate existing wallets in full.
Blueshift’s Solana Winternitz Vault has already been running in the ecosystem for more than two years and was cited earlier this year in a Google Quantum AI white paper as a frontier example. The Solana Foundation said a quantum threat with real-world impact is still years away, so no immediate migration is needed, but research, infrastructure, and ecosystem coordination are already in place. It expects no significant hit to network performance once migration begins.
Starknet offers another close comparison with Ethereum’s newer direction. On June 30, StarkWare published a three-phase roadmap. In phase one, BLAKE2 will replace the Pedersen hash for state commitments, contract addresses, and network configuration, while Falcon-512 and other post-quantum consensus signatures are introduced. Phase two focuses on migration tools for legacy contracts. The final phase targets external dependencies that still connect back to Ethereum, including bridge syscalls and blob data availability. That last stage depends on Ethereum’s own migration path.
Compared with other chains, Ethereum is taking a standards-first approach before changing production code. Dropping Poseidon in favor of SHA2 and BLAKE2 reflects a choice for more mature cryptographic primitives with a broader public validation history in the post-quantum era.