Ethereum Foundation researcher Justin Drake wrote on X on August 13, 2026, that “the Ethereum Foundation is abandoning Poseidon for L1, pivoting to SHA or BLAKE,” two established families of hash functions. L1 is Ethereum’s base layer. On August 1, the foundation’s Poseidon Cryptanalysis Initiative paused its Poseidon1 Collision Prize, a set of bounties worth up to $992,000 in total that had been scheduled to run until January 1, 2029.
The Poseidon hash was part of a post-quantum design that Ethereum has not yet deployed on its base layer. Drake wrote that the foundation’s draft schedule, the “strawmap,” now points to a production-grade leanVM, the proving engine the design depends on, in 2027 and to deployments across Ethereum’s consensus, data, and execution layers in 2028.
Hash-based signatures are the foundation’s planned replacement for the BLS signatures used today by Ethereum’s validators, the participants that propose and attest to blocks. A change of signature scheme would have to pass through Ethereum’s protocol upgrade process, which the foundation does not control alone. BLS signatures “rely on elliptic curve pairings, which a quantum computer could break,” according to ethereum.org, the project’s community-edited website.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is an advisor to Project Eleven, which works on post-quantum security for digital assets.
Why the plan used the Poseidon hash
Drake set out the design in July 2025 under the name lean Ethereum. He proposed hash-based aggregate signatures in place of BLS and hash-based commitments in place of KZG, a pairing-based commitment scheme that Ethereum uses for blob data, the large data packets that rollups post to Ethereum. He also proposed zero-knowledge virtual machines, or zkVMs, that prove each block’s execution so that nodes need not re-execute it.
The hash-based signatures proposed for Ethereum are large, roughly 3,000 bytes against 96 for BLS, according to ethereum.org. The foundation planned to aggregate them with SNARKs, short proofs that a computation was carried out correctly, so every hash needed to verify those signatures adds work for the prover that builds the proof.
Five cryptographers, among them Lorenzo Grassi and Dmitry Khovratovich, designed Poseidon in 2019 for zero-knowledge proof systems, building it from arithmetic over the same prime fields that many of those systems use. A 2026 planning document for lean consensus posted on HackMD said the design “exclusively uses the Poseidon2 hash function,” a faster version published in 2023.
What changed
Drake wrote that “breakthrough SNARK designs show that SNARK-friendly hashes aren’t necessary after all.” He added that Poseidon had become the dominant SNARK-friendly hash, “securing billions via zkrollups and zkVMs.” In June, Benedikt Bünz and William Wang of New York University and Ron Rothblum of Succinct posted Flock, a preprint describing a proof system for batches of standard hash computations.
On one core of an Apple M4 Max, their prototype proved about 82,100 BLAKE3 and 42,100 SHA-256 compressions and 30,700 Keccak permutations per second, at less than 250 times the cost of computing the hashes natively, Rothblum wrote in Succinct’s announcement. On 10 cores, it exceeded 660,000 BLAKE3 compressions per second.
Drake cited “1M traditional hash calls proven per second, on a laptop,” at “100x overhead vs native CPU boolean compute.” He wrote that SNARK.fast, an AI-assisted effort to optimize proving code, had “crossed 1.8M BLAKE3/sec proven on an M3 Max.” Drake cited no paper for either figure.
In Succinct’s announcement, Rothblum wrote that Flock proves batches of a single fixed Boolean circuit such as a hash function and does not handle arbitrary programs. He called it “a research prototype” and wrote that the authors “do not recommend it for production use yet.” The implementation was “co-designed by coding agents,” the authors wrote in the preprint.
Rothblum, a member of the Poseidon initiative’s unpaid advisory board, also argued against SNARK-friendly hashes in the announcement. “A SNARK-friendly hash is cheap to prove only inside a proof system built over the one field it was designed for,” he wrote.
Such hashes are “far less battle-tested than SHA-256, Keccak, or BLAKE3,” Rothblum wrote. Their “heavy algebraic structure has repeatedly opened the door to attacks,” he wrote.
Poseidon hash cryptanalysis before the pause
The foundation set up the Poseidon Cryptanalysis Initiative to decide whether there is sufficient evidence that Poseidon is secure for high-value uses on Ethereum, according to the initiative’s website. The initiative’s foundation team consists of George Kadianakis, Antonio Sanso, and Khovratovich, one of Poseidon’s designers.
The foundation offered the collision prize for finding two different inputs whose full Poseidon1 hashes, computed over a 31-bit prime field called KoalaBear, match on their first q output elements. Awards ranged from $32,000 for q=3 to $512,000 for q=7. Only the q=3 tier was claimed, on April 6, 2026.
Between April and July 2026, the initiative verified six solutions to smaller challenges on Poseidon versions with fewer rounds, and it listed three more claims in July. Papers competing for its $90,000 attack-paper fund must be public on the IACR ePrint archive by the end of 2026, the end of the initiative’s second phase.
Update, November 12, 2026: On September 7, the Ethereum Foundation said it aims for quantum resistance on Ethereum’s base layer “across all three layers” by December 2029. At Devcon in Mumbai on November 3, Drake said he hoped to finish the transition by December 2028, Cointelegraph reported. The collision prize remains paused.
