Ethereum L1 drops Poseidon hash after 8-year post-quantum pivot

Ethereum's layer 1 will abandon the Poseidon hash after an eight-year, eight-figure research effort, pivoting to established SHA-2 and BLAKE2s as part of its post-quantum roadmap.

"Goodbye, Poseidon!" Justin Drake, a researcher at the Ethereum Foundation, said in an Aug. 13 post on X, calling the decision the conclusion of an "8-year, 8-figure rabbit hole" in post-quantum cryptography.

The change follows advances in binary-field SNARKs that make conventional hashes dramatically cheaper to prove. Drake said such systems can verify about 1 million traditional hash calls per second on a laptop, with roughly 100 times the overhead of native CPU execution. Research projects Binius and Flock drove the gains; Flock demonstrated 82,000 BLAKE3 compressions per second on a single Apple M4 Max core and proved more than nine times faster than Binius64 for SHA-256.

The decision reverses the design philosophy that produced Poseidon in 2019, when specialized hashes were cheaper to process inside SNARKs than bit-based functions. Instead of building a hash around a proof system's limits, researchers can now build the SNARK around hashes with long security records — a shift that underpins Ethereum's post-quantum plan and its leanVM, a minimal zero-knowledge virtual machine targeting production in 2027 and layer deployments in 2028.

Binary-field SNARKs make standard hashes practical

Poseidon emerged in 2019 as a hash designed for zero-knowledge proof systems, and the Ethereum Foundation has invested in specialized hashes since 2018. It became a common choice across zk-rollups and zkVMs, including systems securing billions of dollars in crypto assets. Drake's announcement concerns Ethereum's future L1 architecture, not an immediate removal of Poseidon from existing applications — rollups and virtual machines already using the function are not required to replace it.

Binary fields, built around characteristic two, map naturally to the bits and XOR operations used by conventional cryptography, unlike the large prime fields of earlier SNARK designs. Drake said the key insight was "not SNARK-friendly hashes, but hash-friendly SNARKs." SNARK.fast, an AI-assisted research project, reached 1.8 million BLAKE3 compressions per second, a 255 percent improvement over its starting benchmark.

Hash-based signatures anchor the quantum plan

Drake linked the decision to Ethereum's post-quantum security program, which is preparing for computers capable of breaking elliptic-curve cryptography. He cited recent setbacks for lattice-based HAWK and isogeny-based SQIsign under AI-assisted cryptanalysis, strengthening the case for hash-based signatures. Such designs use simple, extensively studied assumptions, though individual signatures can be too large for direct use at Ethereum's scale.

SNARK aggregation offers a fix: a proof system can verify many hash-based signatures and compress the result into one smaller proof, also supporting multisignature and k-of-n threshold arrangements. Wallet-level tests are already underway — in June, an Ethereum researcher demonstrated a SPHINCS-based signature verifier requiring about 127,000 gas and a 3,704-byte signature, at roughly $0.07 per account.

The National Institute of Standards and Technology finalized its first three post-quantum standards in August 2024, and a Coinbase advisory board warned in April that replacing vulnerable signatures across networks, wallets, and exchanges could take years, with some quantum-resistant alternatives increasing blockchain data requirements by as much as 38 times. Ethereum's proof aggregation is intended to limit such costs.

The Ethereum Foundation's post-quantum team is working with Binius, Flock, and related binary-field systems on leanVM benchmarks. Drake said the schedule targets a production-grade leanVM in 2027, with consensus, data, and execution-layer deployments planned for 2028, subject to implementation and testing across Ethereum's independent development teams. The timeline sits within the Strawmap, a technical coordination document extending through 2029.

This article is for informational purposes only and does not constitute investment advice.