Ethereum L1 drops Poseidon in post-quantum move

Ethereum Foundation researcher Justin Drake has said the network’s layer 1 will leave Poseidon after an eight-year, eight-figure research effort and pursue established hash functions such as SHA-2 or BLAKE2s.

Ethereum L1 turns away from Poseidon

Justin Drake said in an Aug. 13 X post that the Ethereum Foundation is abandoning Poseidon for its L1 roadmap and moving toward traditional options such as SHA or BLAKE.

“Goodbye, Poseidon!” Drake wrote, describing the decision as the result of an “8-year, 8-figure rabbit hole” in post-quantum cryptography.

Goodbye, Poseidon!

An epic 8-year, 8-figure rabbit hole in post-quantum cryptography reaches its dream conclusion. The Ethereum Foundation is abandoning Poseidon for L1, pivoting to SHA or BLAKE. This milestone unlocks ultimate security for lean Ethereum and foreshadows a golden…

— Justin Drake (@drakefjustin) August 13, 2026

Poseidon emerged in 2019 as a hash function designed for zero-knowledge proof systems. Its structure made it less costly to process inside Succinct Non-Interactive Arguments of Knowledge, commonly known as SNARKs, than traditional hash functions built around binary operations.

Since 2018, the Ethereum Foundation has invested in specialized hashes as part of its work on zero-knowledge technology. Poseidon later became a common choice across zk-rollups and zkVMs, including systems that secure billions of dollars in crypto assets.

Drake’s announcement concerns Ethereum’s future L1 architecture, rather than an immediate removal of Poseidon from existing applications. Rollups, virtual machines, and other projects that already use the function are not required to replace it because of the roadmap decision.

Advances in proof-system design have now changed the trade-off that initially favored Poseidon. According to Drake, established functions such as SHA-2 and BLAKE2s can match its performance when paired with SNARKs designed around binary computation.

“In hindsight the key was not SNARK-friendly hashes, but hash-friendly SNARKs.”

Binary-field SNARKs make traditional hashes practical

Binary fields allow proof systems to process the Boolean logic used by standard hash functions more naturally. Earlier SNARK designs often relied on large prime fields, where bit-based operations such as XOR could be costly to represent.

Working over the smallest prime number, two, allows binary-field systems to align their calculations with the zeros and ones used in conventional computing. Drake said the resulting designs can prove about 1 million traditional hash calls per second on a laptop, with an overhead of roughly 100 times compared with native CPU execution.

Research projects including Binius and Flock contributed to the performance gains, according to the post. Binius applies binary-field arithmetic to zero-knowledge proofs, while Flock focuses on proving large batches of Boolean calculations, including computations involving SHA-256, Keccak, and BLAKE3.

Drake also pointed to SNARK.fast, an open automated research project that uses artificial intelligence to improve proving code. Its strongest result reached 1.8 million BLAKE3 compressions per second, representing a 255% improvement over its starting benchmark.

Using established hashes could reduce Ethereum’s reliance on specialized cryptographic functions that require years of separate analysis. SHA and BLAKE have already received extensive study outside zero-knowledge systems, although their implementation inside Ethereum would still require research, audits and testing.

The decision also changes the relationship between Ethereum’s hash functions and its proof infrastructure. Instead of designing a new hash around the limits of a SNARK, researchers can build the SNARK around hash functions that already have long security records.

Ethereum post-quantum work favors hash-based signatures

Drake linked the decision to Ethereum’s post-quantum security program, which is preparing the protocol for computers capable of breaking elliptic-curve cryptography. Ethereum currently relies on such systems for user accounts and parts of its consensus and data infrastructure.

As crypto.news reported in August, co-founder Vitalik Buterin has moved quantum security higher in Ethereum’s updated roadmap. The plan also covers native privacy, formal verification, post-quantum scaling, and possible replacements for parts of the Ethereum Virtual Machine.

Drake said recent advances in AI-assisted cryptanalysis have created setbacks for more complex post-quantum systems. He specifically cited HAWK, a lattice-based signature design, and SQIsign, which relies on isogeny-based cryptography.

According to his assessment, the problems strengthen the case for hash-based signatures on blockchains. Such designs use relatively simple and extensively studied assumptions, although individual signatures can be too large for direct use at Ethereum’s present scale.

SNARK aggregation offers one way to address the size problem. A proof system can verify many hash-based signatures and compress the result into one smaller proof for the network, rather than requiring every signature to be placed and checked separately.

The same method could support multisignature arrangements and k-of-n threshold signatures, in which a transaction needs approval from a set number of participants. Drake said the flexibility comes from using the SNARK to prove the authorization rules without placing all the underlying signature data onchain.

Wallet-level preparations are already being tested. In June, an Ethereum researcher demonstrated account protection using a SPHINCS-based signature verifier, with one optimized version requiring about 127,000 gas and carrying a 3,704-byte signature. The researcher estimated the verification cost at roughly $0.07 per account at the time.

U.S. standards add pressure for early preparation

For U.S. investors and businesses using Ethereum, the roadmap addresses a security risk that federal standards agencies have already begun treating as a migration issue. The National Institute of Standards and Technology finalized its first three post-quantum cryptography standards in August 2024 and encouraged system administrators to begin integrating them.

NIST’s standards do not direct Ethereum’s protocol choices, and the agency’s selected algorithms do not make the network quantum-safe by themselves. Its migration work shows, however, that American institutions are preparing before cryptographically relevant quantum computers become available.

A Coinbase independent advisory board reached a similar position in a 50-page paper published in April. Its members included Drake, Stanford cryptographer Dan Boneh, EigenLayer founder Sreeram Kannan, Coinbase cryptography head Yehuda Lindell, and distributed-systems researcher Dahlia Malkhi.

The board concluded that current blockchains remain secure from quantum attacks but warned that replacing vulnerable signatures across networks, wallets, and exchanges could take years. According to the advisory paper, some quantum-resistant alternatives could increase blockchain data requirements by as much as 38 times.

Ethereum’s use of proof aggregation is intended to limit such costs while replacing vulnerable cryptography. Drake said hash-based SNARKs could compress an arbitrary number of post-quantum signatures into a compact proof suitable for inclusion in a block.

LeanVM targets production deployment in 2027

The Ethereum Foundation’s post-quantum team is working on binary-field infrastructure as part of leanVM, a minimal zero-knowledge virtual machine intended to verify and aggregate cryptographic proofs.

Drake said the current schedule calls for a production-grade leanVM in 2027. Deployments involving Ethereum’s consensus, data, and execution layers are planned for 2028, though each protocol change will still require implementation, testing, and agreement among Ethereum’s independent development teams.

The schedule sits within Ethereum’s Strawmap, a technical coordination document extending through 2029 rather than a finalized activation calendar. Earlier Strawmap coverage described seven proposed forks covering faster slots, shorter finality, post-quantum cryptography, privacy, and higher network capacity.

Ethereum’s post-quantum team is now working with Binius, Flock, and related binary-field systems while developing leanVM benchmarks. Drake said the planned 2028 work would apply the resulting proof technology separately across the consensus layer, data layer, and execution layer.

Source