On October 9, 2025, Charles Hoskinson published a reply longer than most whitepapers. The target was Vitalik Buterin's warning that lattice-based cryptography might be more fragile than the industry assumes. Buterin had suggested, almost casually, that engineers should multiply their lattice parameter sizes by ten. No attack. No proof of concept. Just a precaution, framed as a lesson from history.
Hoskinson's counter was blunt: name one credible lattice break. The Cardano founder pointed out that lattice schemes have survived four decades of cryptanalysis — from the LLL algorithm in 1982 through the modern lattice sieve refinements — and that the NIST-standardized ML-KEM and ML-DSA already fold those attacks into their parameter selection. Hash functions, he reminded everyone, have actually fallen: MD5, SHA-1. Structure is not a synonym for weakness.
Here is the number neither man put on the table. It is the number that decides whether this debate matters for blockchains at all.
SLH-DSA, the hash-based signature standard, produces signatures between 7.8 and 49 kilobytes. ML-DSA, the lattice standard, produces signatures between 2.4 and 4.6 kilobytes. ECDSA — the thing every wallet on Earth uses today — produces 64 bytes.
That is not a rounding error. That is a roughly 12,000x expansion over the status quo for the hash-based path. And it sits at the exact center of a fight that almost everyone is describing as a question of cryptographic philosophy.
It is not philosophy. It is bandwidth, storage, and gas. Code doesn't grade on principle.
The Context Everyone Skips
Let me set the board before I start moving pieces. In August 2024, NIST finalized three post-quantum standards: FIPS 203 (ML-KEM, key encapsulation), FIPS 204 (ML-DSA, digital signatures), and FIPS 205 (SLH-DSA, stateless hash-based signatures). These are not laboratory curiosities. They are engineered, reviewed, and shipping. When two founders argue about post-quantum cryptography in late 2025, they are arguing about migration strategy, not about whether the math exists.
The two standards rest on fundamentally different assumptions, and that difference is the entire debate.
Lattice cryptography — ML-KEM, ML-DSA — builds its security on structured mathematical problems: Learning With Errors (LWE), the Shortest Vector Problem (SVP), and their relatives. The word to circle is structured. The hardness of these problems is believed to be high, but the security argument leans on the difficulty of solving a specific algebraic geometry problem with a specific amount of lattice reduction.
Hash-based signatures — SLH-DSA, and the older SPHINCS+ lineage — build their security on nothing but the collision resistance and preimage resistance of a hash function. No algebraic structure. No trapdoors. No number-theoretic assumptions that could one day develop a shortcut. The assumption set is minimal. That minimalism is the whole pitch.
Buterin's argument, reconstructed from his posts, runs like this. First, an analogy: integer factorization was once thought to be exponentially hard, but the General Number Field Sieve (GNFS) made it far more tractable than early estimates suggested — and RSA's parameter recommendations had to be revised upward repeatedly as a result. Second, an inference: AI-assisted mathematical progress could discover an analogous shortcut for lattice problems, forcing a drastic upward revision of parameters. Third, a recommendation: multiply lattice key sizes by ten, preemptively. Fourth, a preference: Ethereum's lean roadmap should lean toward hash-only signatures — WOTS, SPHINCS+ — because they do not depend on algebraic structure that an adversary might exploit.
Hoskinson's argument, reconstructed from his reply, runs in the opposite direction. First, a demand for evidence: Buterin has not produced a single credible lattice attack. Second, a record: lattice cryptography has been under active attack research for decades — LLL in 1982, the BKZ block-reduction refinements, the lattice sieve algorithms — and ML-KEM and ML-DSA were parameterized with those attacks in mind. Third, a tu quoque: hash functions have genuinely been broken — MD5 and SHA-1 are the receipts — and Ethereum's own zero-knowledge research leans on Poseidon and Poseidon2, which are algebraic hashes built from exactly the kind of structured operations that lattice critics fear. Fourth, a methodological objection: SHA-256's security is not a proven theorem. It is a bet that no one has found a break yet. Fifth, a prescription: parameters should be set by computing the concrete cost of specific attacks, not by applying a hypothetical multiplier to a hypothetical breakthrough.
Both men are technically literate. Both have skin in the game. And both are, in different ways, correct — which is what makes the fight useful and the commentary around it so bad.
I have audited enough cryptographic systems to know that when two experts disagree this cleanly, the interesting information is usually in the constraint neither wants to name. I spent eight months in 2021 manually verifying the soundness of early zk-SNARK proofs for a Layer-2 solution. I found a consistency error in the constraint system — a place where the circuit accepted a witness it should have rejected. That bug had nothing to do with the security of the underlying elliptic curve. It was an engineering defect. And it would have drained funds.
The lesson I carried out of that work is the one I bring here: the failure mode of a cryptographic system is almost never the one the theorists are arguing about.
Deconstructing the Argument Chains
Let me take the two positions apart at the level where they can actually be checked.
Buterin's GNFS analogy deserves scrutiny because it is doing a lot of work. The claim is that factorization was thought to be harder than it turned out to be, therefore lattice problems might also be easier than we think. The historical fact is real. Early RSA keys were shorter than they should have been, and the field revised its estimates as algorithms improved. The inference, though, is weaker than the analogy implies.
Here is why. Lattice cryptography is not entering the field naive about algorithm advances. It is entering the field after the algorithm advances. The entire design philosophy of ML-KEM and ML-DSA assumes an adversary with access to the best known reduction algorithms. The parameter sets were chosen by cryptographers who read the LLL and BKZ literature. The GNFS analogy would bite if lattice schemes had been designed in ignorance of lattice reduction. They were not. They were designed in its shadow.
That does not make Buterin wrong. It makes his claim precautionary rather than evidentiary. He is not saying lattice schemes are broken. He is saying the tail risk — an AI-discovered structural shortcut — is severe enough to justify cheap insurance. Multiply the parameters by ten. The cost of being wrong in the safe direction is small; the cost of being wrong in the unsafe direction is catastrophic.
That is a defensible risk-management position. It is also, as I will argue, not the position that matters most for blockchains.
Hoskinson's counter is stronger on facts and weaker on framing. His factual points are largely correct. Lattice cryptography has been attacked for decades and survived. MD5 and SHA-1 did fall, which proves that hash-based security is not absolute. Poseidon is genuinely an algebraic construction and genuinely subject to algebraic cryptanalysis in a way that SHA-256 is not. All of that is true.
Where Hoskinson's framing gets slippery is in the implied conclusion that because no credible lattice attack exists today, the concern is unfounded. Absence of evidence is not evidence of absence in cryptography — it is the default state. Every cryptographic primitive lives under an unfalsifiable cloud of potential future breaks. SHA-256 has no proof of security either. The honest position is not "lattice is safe" versus "lattice is risky." The honest position is "both are bets, and the bets have different shapes."
The shape of the lattice bet: high confidence under current cryptanalysis, contingent on the hardness of structured problems that no one has yet shortcut.
The shape of the hash bet: lower confidence that any particular hash survives, but no structural dependency — if SHA-256 falls, you swap in SHA-3 and the scheme's security assumption is unchanged.
That difference is real, and it is the reason Buterin's preference is not naive. It is the reason hash-based signatures are the belt-and-suspenders option. But it is also the reason they are enormous, and that is the part of the story that keeps getting dropped.
Let me put a number on it, because numbers are the only argument that survives contact with a mainnet.
A single ML-DSA signature is roughly 2.4 to 4.6 kilobytes depending on the parameter set. A single SLH-DSA signature is roughly 7.8 to 49 kilobytes. An ECDSA signature is 64 bytes. A transaction that verifies one signature on Ethereum today carries about 64 bytes of signature payload. Under a hash-only post-quantum regime, that same transaction carries — conservatively — 8 kilobytes of signature, and under the heavier SLH-DSA parameter sets, up to 49 kilobytes.
On a chain where calldata is priced by the byte, this is not a design detail. It is a cost structure. Every wallet migration, every bridge message, every ZK proof that anchors to an L1 signature — all of it multiplies.
I have run this kind of cost model before. In 2024, I integrated Celestia's blob-sidecar into a personal testnet and spent roughly 200 hours tuning data availability sampling parameters. I benchmarked throughput against Ethereum and found a 40% finality improvement for specific use cases — but only after I stopped treating blob size as free. The moment you price data honestly, the architecture changes. Post-quantum migration is the same lesson at a larger scale. The cryptographic debate is downstream of a data-cost debate, and the data-cost debate is being conducted by no one.
That is the first thing I would tell an institutional client asking me whether to care about this fight. The fight is real. The metric that decides the winner is not.
The Structure Is the Point
There is a deeper technical thread here that both founders gesture at but neither pulls all the way through. It is the question of what "structure" buys you and what it costs you.
Lattice cryptography is efficient because it is structured. The algebraic structure of ideal lattices and module lattices is what lets you build compact keys, compact signatures, and fast verification. Structure is the source of the performance advantage. It is also the source of Buterin's anxiety. If the structure has a flaw — a way to exploit the algebraic relationships that make the scheme efficient — then the efficiency is borrowed against a security assumption that could be called in.
Hash-based cryptography is inefficient because it is unstructured. There is nothing to exploit but the hash itself. There is also nothing to optimize. The signature is large because it has to carry enough authentication path data to convince a verifier without any algebraic shortcut. That is the trade: no exploitable structure, no compact encoding.
This is the cleanest way I have found to state the whole debate. Buterin is willing to pay in bytes to buy assumption minimalism. Hoskinson is willing to accept structured assumptions to keep the bytes small. Both are making a rational trade. They are simply pricing different risks.
Now bring in the AI variable, because it is the thing that makes 2025 different from 2015.
Buterin's specific concern is that AI-assisted mathematics could discover a shortcut in lattice problems — a new reduction algorithm, a new structural weakness — the way GNFS discovered a shortcut in factorization. This is a genuine tail risk. AI systems are already being used to search mathematical structures, and the search space for lattice reduction algorithms is enormous and under-explored relative to its importance.
But here is the counter that Hoskinson implies and that I will state directly. The same AI capability that could find a lattice shortcut could also find a hash break. An AI that is good at discovering structural weaknesses in algebraic objects is, by construction, also good at finding collision attacks against structured hash constructions. And here is where Ethereum's own choices become interesting.
Poseidon and Poseidon2 — the algebraic hashes used across Ethereum's ZK ecosystem — are not SHA-256. They are built from field arithmetic. They are designed to be efficient inside arithmetic circuits, which is exactly why ZK-rollups love them. And that design choice means their security rests on algebraic assumptions, not on the minimal assumptions of a traditional hash. Poseidon is closer to lattice cryptography in its security philosophy than it is to SHA-256. It is a structured primitive.
So when Ethereum says "we prefer hash-based signatures for minimal assumptions," the fine print matters. The hash-based signature schemes (WOTS, SPHINCS+) may rest on traditional hash assumptions, but the broader ZK stack Ethereum is betting on leans heavily on algebraic hashes whose assumptions are structurally similar to the lattice assumptions Buterin is warning about. The minimalism is real at the signature layer. It is not obviously real one layer up.
Code doesn't care which layer you call minimal.
This is the kind of internal inconsistency I look for when I audit a system. Not a bug, exactly. A coherence gap. A place where the stated principle and the engineering reality point in different directions. Ethereum's ZK roadmap and its hash-signature preference are not obviously pulling on the same rope.
The Blind Spot Both Sides Share
Now the contrarian part, which is the part I actually care about.
The loudest version of this debate frames it as a security question: which primitive is safer? That framing is a trap, because it makes the byte-cost dimension invisible. And on a blockchain, the byte-cost dimension is not a secondary concern. It is the primary constraint.
Here is the uncomfortable arithmetic. Hash-based signatures are more conservative in their assumptions and larger in their output by one to two orders of magnitude. Lattice signatures are less minimal in their assumptions and dramatically smaller. On a chain, the smaller signature wins on every operational metric that a user actually feels: transaction cost, block space, throughput, state growth, sync time.
The result is a hidden inversion. The "safer" primitive is the one that forces you to put 8 to 49 kilobytes of signature data on-chain for every authenticated action. The "riskier" primitive is the one that keeps transactions economically viable. If you are optimizing for the probability that the cryptography is theoretically sound, you pick hash. If you are optimizing for the probability that the network remains usable under load, you pick lattice — or you pick a hybrid and accept the complexity.
Neither founder has engaged this directly, and I suspect I know why. If Buterin concedes that hash signatures are operationally brutal, his lean roadmap looks expensive. If Hoskinson concedes that lattice assumptions carry tail risk, his evidence-based confidence looks like complacency. So the byte question — the one that a wallet engineer will actually have to solve — goes unmentioned. It is the elephant that both camps have agreed not to weigh.
There is a second blind spot, and it is subtler. Buterin's advice, buried in the discussion, was that people should not rush to move funds out of ECDSA wallets. Read that again. The man who is worried about cryptographic fragility is telling people not to panic-migrate. That tells you what he actually considers the urgent threat.
It is not lattice cryptography. It is Shor's algorithm against ECDSA.
ECDSA is broken by a sufficiently large quantum computer. That is not a speculation about AI-discovered shortcuts. It is a mathematical fact about the relationship between Shor's algorithm and the discrete logarithm problem. Lattice cryptography is quantum-resistant by design. So is hash-based cryptography. The entire post-quantum migration exists because the current signature scheme — the one in every wallet — is the one with a known quantum vulnerability.
And yet the headline fight is about whether lattice cryptography might one day be weakened by AI, not about the fact that ECDSA is already dead the moment a quantum computer of sufficient scale exists. The debate has drifted from the near-certain structural threat to a speculative one. That is a classic narrative substitution, and it is worth naming: the industry is arguing about the second-order risk while the first-order risk sits unaddressed in every wallet.
Code doesn't negotiate with the timeline you'd prefer.
The Migration Nobody Is Modeling
The real story, if you follow the engineering rather than the rhetoric, is not "which primitive wins." It is the coordination problem of moving the entire industry off ECDSA — and the fact that the primitive choice is downstream of it.
Consider what a post-quantum migration actually requires. Every wallet must change its signature scheme. Every hardware wallet must be re-flashed or replaced, because the secure elements are built around ECDSA and secp256k1. Every bridge must update its verification logic. Every exchange custody system must support new signature formats. Every smart contract that verifies a signature — and there are thousands — must be updated or replaced. Every multi-sig, every threshold signature scheme, every MPC custody arrangement.
The cryptographic primitive is the easy part. The coordination is the hard part. And the coordination cost scales with the size of the signatures, because larger signatures mean larger transactions, higher fees, and more state growth across the entire ecosystem simultaneously.
This is where the lattice-versus-hash choice actually gets decided, and it is not decided by cryptographers. It is decided by whoever has to ship the migration. A wallet team that has to add 8 kilobytes to every transaction is going to fight for the compact primitive. A security team that has to sign off on the assumption set is going to fight for the conservative one. The compromise — a hybrid scheme that carries both a lattice and a hash signature — is the technically correct answer and the operationally worst one, because it pays both costs at once.
I have seen this pattern before, in the 2022 collapse. During that period I was auditing 300+ lines of failing DeFi code a day, focused on liquidity-crunch scenarios. I reverse-engineered the exploit mechanism of a lending platform and found that its impermanent-loss calculations were flawed under extreme volatility — not in the math, but in the assumptions about how fast positions would be liquidated. The contract was correct in the regime it was tested in and wrong in the regime it met. Post-quantum migration has the same shape. The primitive is correct in the regime the cryptographers test. The migration is what happens in the regime nobody tests, which is the regime where everything changes at once.
The most underrated risk in this entire debate is not that lattice cryptography gets broken. It is that the migration never completes cleanly — that millions of wallets migrate in a staggered, partial, error-prone way, and that the transition period becomes the most exploitable moment in blockchain history. Cross-chain bridges, which are already the highest-severity attack surface in the industry, will be re-plumbing their verification logic. That is precisely when they are most fragile.
What I'd Actually Forecast
Strip away the personalities and here is where I land.
The Buterin–Hoskinson fight is not a disagreement about facts. It is a disagreement about which risk to price. Buterin prices the tail risk of a structural lattice break, and he is willing to pay in bytes and complexity to hedge it. Hoskinson prices the cost of over-engineering, and he is willing to accept structured assumptions to keep the system lean. Both are coherent. Neither is complete.
The technical reality is narrower than the debate suggests. Lattice cryptography has survived decades of cryptanalysis and is standardized with known attacks already priced in. Hash-based cryptography has genuinely minimal assumptions and genuinely brutal size costs. The choice between them for any given chain will be made by engineering constraints — signature size, verification cost, migration burden — long before it is made by philosophy.
And the threat that actually matters is not the one being argued. ECDSA dies to Shor's algorithm on a timeline nobody can yet pin down. That is the clock. The lattice-versus-hash fight is what happens while the industry waits for the clock to matter and avoids the coordination it will eventually be forced to do.
So my forecast is this. Watch the migration tooling, not the manifestos. The primitive that wins will be the one whose migration path is cheapest to ship, not the one whose assumptions are cleanest to defend. Watch whether the hybrid schemes get adopted despite their double cost, because hybrid is the only answer that survives both risks and the only one nobody wants to pay for. And watch the bridges during the transition, because that is where the next nine-figure exploit will come from — not from a broken lattice, but from a half-migrated verifier that was correct in the regime it was tested in.
The cryptography will hold. The question is whether the coordination does. Code doesn't care which of those you were worried about.