The Ethereum Foundation on August 13, 2026 announced it is abandoning the Poseidon hash function for its Layer 1 roadmap, ending an eight-year research effort that consumed tens of millions of dollars. The foundation will instead adopt SHA-2 or BLAKE2s — conventional hash functions with decades o...
The Ethereum Foundation on August 13, 2026 announced it is abandoning the Poseidon hash function for its Layer 1 roadmap, ending an eight-year research effort that consumed tens of millions of dollars. The foundation will instead adopt SHA-2 or BLAKE2s — conventional hash functions with decades of cryptanalytic scrutiny — for its post-quantum security architecture.
The reversal was not triggered by a security breach in Poseidon. Rather, advances in binary-field proof systems, specifically the Binius (2023) and Flock (2024) constructions, eliminated the performance advantage that had justified Poseidon's existence. These systems can now prove approximately 1 million conventional hash computations per second on a standard laptop, making specialized "SNARK-friendly" hashes unnecessary. As Drake stated: "In hindsight the key was not SNARK-friendly hashes, but hash-friendly SNARKs."
The decision carries implications beyond Ethereum L1. Nearly every major zkVM and zkEVM in production — including systems securing billions in assets across zk-rollups — relies on Poseidon or its successor Poseidon2. While no migration order has been issued, the shift signals that the broader zero-knowledge ecosystem may eventually follow.
Poseidon was introduced in 2019 as a hash function purpose-built for zero-knowledge proof systems. Traditional hash functions like SHA-256 and Keccak rely on bitwise operations — AND, XOR, modular addition, rotation on 32-bit words — that are efficient on CPUs but expensive to represent inside SNARKs and STARKs. These proof systems typically operate over large prime fields, where encoding Boolean logic introduces substantial overhead.
Poseidon addressed this by designing its internal structure around arithmetic operations native to prime fields, reducing the number of constraints required when hashing inside a proof circuit. The performance differential was significant: Poseidon could be orders of magnitude cheaper to prove than SHA-256 in early proof systems.
The hash function quickly became foundational infrastructure. According to ZKM's technical analysis, "nearly every major zkVM and zkEVM in production today runs on Poseidon2," including systems underpinning zk-rollups that collectively secure billions of dollars in crypto assets. The Ethereum Foundation invested what Drake described as "8-figure" sums into Poseidon research, integration planning, and associated cryptanalytic validation.
The Ethereum Foundation launched a Poseidon Cryptanalysis Initiative in January 2026, offering up to $1 million in bounties — including a $992,000 collision prize — to stress-test the hash function's security margins. By August 2026, researchers had claimed $66,000 by breaking 24-bit and 28-bit security challenges on Poseidon-31 instances. The program is set to continue through December 2026.
The cost calculus that justified Poseidon rested on a specific technical constraint: SNARKs operated over large prime fields, where representing bitwise operations was expensive. Two research advances removed that constraint.
Binius (2023). Developed by Irreducible, Binius is a SNARK architecture that operates over towers of binary fields rather than prime fields. Binary fields represent data as 0s and 1s — the same representation used by conventional hash functions. This eliminates the encoding overhead that made SHA-256 and Keccak costly inside earlier proof systems. According to benchmark data, Binius is 50x more efficient than plonky2 at committing 1-bit elements.
Flock (2024). Published on July 29, Flock extended binary-field techniques to large batches of standard hash computations, further closing the gap between native execution speed and proof generation speed.
The combined result: systems like BinarySpartan can now prove BLAKE3 at 410,000 hashes per second and SHA-256 at 219,000 hashes per second on a MacBook Pro M4 Max. Aggregate throughput reaches approximately 1 million conventional hash computations per second — roughly 100x slower than native CPU execution, but practically viable for SNARK deployment.
This performance level means SHA-2 and BLAKE2s can enter Ethereum's L1 design without carrying their former proving penalty. The tradeoff that created Poseidon no longer exists.
The shift is not merely about performance parity. It reflects a fundamental difference in cryptographic confidence between the two approaches.
SHA-2 has been in production since 2001. It has undergone 25 years of public cryptanalysis by government agencies, academic institutions, and the private sector. No practical collision or preimage attack has been found. NIST standardized SHA-2 and it remains a cornerstone of global financial infrastructure.
BLAKE2s/BLAKE3 descend from the BLAKE hash family, a SHA-3 competition finalist. BLAKE3 was released in 2020 and has been adopted across systems requiring high-throughput hashing. Both are well-studied under conventional and post-quantum security models.
Poseidon, by contrast, was introduced in 2019 and operates on algebraic assumptions that have received comparatively limited scrutiny. The Ethereum Foundation's own cryptanalysis bounty program highlights ongoing uncertainty: researchers are actively probing whether Gröbner basis attacks, interpolation methods, or resultant-based algebraic techniques can compromise specific round configurations. Resultant-based attacks have already proven effective against related constructions including Anemoi, Jarvis, and Rescue-Prime.
Both SHA-256 and BLAKE3 are considered more straightforward to evaluate under post-quantum threat models. Their mathematical foundations — based on Boolean operations and bitwise manipulation — align with well-understood security assumptions. Poseidon's algebraic structure introduces additional variables into post-quantum security analysis that remain under active investigation.
The hash function decision is embedded in Ethereum's broader post-quantum security roadmap. Expert estimates for when cryptographically relevant quantum computers could break ECDSA-256 range from 2028 to the early 2030s, according to multiple researchers cited in a 2026 arXiv survey. Google published research on March 31, 2026 indicating that future quantum computers may break elliptic curve cryptography with fewer qubits than previously estimated.
NIST standardized three post-quantum cryptographic algorithms in August 2024: CRYSTALS-Kyber (key encapsulation), CRYSTALS-Dilithium (digital signatures), and SPHINCS+ (stateless hash-based signatures). Additional hybrid cryptography standards are expected from NIST in 2026.
The Ethereum Foundation's approved timeline proceeds in stages:
| Milestone | Target | Description | |-----------|--------|-------------| | I* fork | TBD | Post-quantum key registry | | J* fork | TBD | Post-quantum signature verification precompiles | | leanVM production | 2027 | Production-grade zero-knowledge virtual machine using SHA/BLAKE | | L* fork | 2028 | Real-time consensus-layer proofs, post-quantum attestations |
The leanVM — a lightweight zero-knowledge virtual machine — is the linchpin of this strategy. Its selection of SHA-2 or BLAKE2s as the base hash function determines the cryptographic assumptions underpinning Ethereum's entire post-quantum security layer. Drake's announcement effectively sets the cryptographic foundation for the next decade of Ethereum development.
The Ethereum Foundation's decision applies only to L1. Drake issued no migration order for existing systems, and Poseidon remains unbroken. However, the ripple effects are substantial.
zk-Rollups. Major zk-rollup networks including zkSync, StarkNet, Polygon zkEVM, and Scroll use Poseidon or Poseidon2 as core hashing infrastructure. These systems are not required to change. But as binary-field proof systems mature, the performance rationale for Poseidon weakens for L2 operators as well. Migration pressure will likely build over 2027–2028 as leanVM deployment approaches.
zkVMs. General-purpose zero-knowledge virtual machines — the compute layer for privacy and scaling applications — face a similar calculus. ZKM noted in its analysis that its own zkVM, Ziren, runs on Poseidon2, and the question of whether to migrate is now actively under discussion. Other zkVM projects face the same strategic assessment.
Economic cost. The transition is not free. Systems that have optimized circuits, precompiles, and verification logic around Poseidon's algebraic structure face non-trivial engineering costs to adopt conventional hash functions. The cost scales with circuit complexity and the degree of hash-function coupling in existing designs.
Interoperability. A fragmented hash-function landscape — some systems on Poseidon, others on SHA-2 or BLAKE — could complicate cross-chain proof verification and composability. Standardization around conventional hashes would simplify interoperability but requires coordinated migration across multiple independent projects.
Adam Back, Hashcash creator and Blockstream CEO, publicly endorsed the decision. According to reporting by U.Today, Back stated the industry should have abandoned experimental algorithms in favor of time-tested security standards earlier, questioning the wisdom of deploying custom, less-studied algorithms that had received "insufficient scrutiny from the global cryptography community."
Back's position carries weight: he is cited in the Bitcoin whitepaper and is credited with creating the proof-of-work system that influenced Bitcoin's design. His endorsement signals that Bitcoin-aligned cryptographers view the shift as overdue rather than premature.
The broader ZK research community has responded with measured approval. The consensus among researchers, as reflected in Ethereum Research forum discussions, is that binary-field proof systems represent a genuine paradigm shift — not an incremental optimization — that restructures how the industry should think about hash function selection for proof systems.
The Ethereum Foundation's decision to abandon Poseidon is a case study in how fundamental research can invalidate its own premises. The eight-year, eight-figure investment in SNARK-friendly hashes was not wasted — it defined the design space that binary-field proof systems ultimately transcended. But the practical outcome is clear: the industry's most resource-intensive cryptographic research program has concluded that conventional hash functions, available since 2001, are the correct choice for post-quantum blockchain security.
The implications extend to every project in the zero-knowledge ecosystem that adopted Poseidon as foundational infrastructure. While no immediate action is required, the long-term trajectory points toward SHA-2 and BLAKE becoming the standard cryptographic primitives for proof systems across L1s, L2s, and zkVMs.
The question is no longer whether this transition will happen, but how quickly ecosystem participants can re-architect their circuits — and at what cost.