Ethereum’s Glamsterdam hard fork testnet was cancelled after researchers identified vulnerabilities in two gas-scaling Ethereum Improvement Proposals (EIPs), while AI agents helped coordinate efforts to detect potential problems in smart contracts.

AI agents coordinate review of Glamsterdam risks

The second and final testnet for Ethereum’s Glamsterdam hard fork was cancelled this week after ChainSecurity found vulnerabilities in EIP-8037 and EIP-8038. The issues could have affected at least 13 decentralized finance (DeFi) contracts. Gas is the unit that meters computation across Ethereum, so proposals that change how it is charged can touch a broad surface of deployed code.

The bugs were linked to assumptions about how gas currently behaves. Contracts relying on those assumptions could break when a call runs out of gas, potentially creating vulnerabilities that an attacker might exploit. The technical details are complex, but the central concern was that the proposed changes could produce unexpected second-order effects across existing contracts.

The Hoodi testnet rehearsal is not expected to be rescheduled until the effects of the fork have been examined more thoroughly. Ethereum’s delay was also reported by Cointelegraph: Ethereum delays Glamsterdam testnet fork over gas security risks.

In an article on X, Derek Chiang of Ethlabs said the problems were discovered very late in the process, “causing everyone to scramble to deal with the fallout.”

“In the future, protocol designers would do well to conduct much more thorough analysis of potential breakages that their update might introduce, and to do so much earlier in the process,” Chiang said.

According to Chiang, two researchers from Ethlabs and the Ethereum Foundation had independently created multiple AI agents to scan contracts for vulnerabilities. After discovering that they were using the same strategy, the researchers “set up message board for their agents in the form of a github repo” to coordinate their work.

Chiang compared the arrangement with the OpenAI-Hugging Face hack, in which rogue agents had established a message board to coordinate attacks. “Well, turns out the same pattern is useful for the good agents too,” he said.

The exercise was sufficiently successful in identifying potential problems that a second message board was established to examine EIP-8198, known as “Quick Slots.” The proposal has been put forward for the subsequent Hegota hard fork.

“Steal My Bitcoin” challenge solved within a day

A website challenging users to “Steal My Bitcoin” by exploiting unpatched PHP2Shell vulnerabilities was successfully hacked within a day. The challenge organizer hid the key to a Bitcoin wallet worth approximately $2,000. The key was accessible to the PHP user account through a binary called print-flag.

The site attracted substantial interest and periodically went offline because of heavy traffic and probing attempts. The challenge was solved by KillerBoi, who extracted the private key. However, the key did not provide access to the wallet address displayed on the site. Organizer James Pavur acknowledged that this was a mistake and said the funds would be transferred.

The live challenge and its resolution were documented in the StealMyBitcoin proof-of-concept repository. Pavur also addressed the result on X.

In a post on X, WordFence founder Mark Maunder said that, despite the key being extracted within a day, the challenge demonstrated the difficulty of exploiting PHP2Shell:

“This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing.”

PHP is a programming language widely used to build websites and web applications, including content management systems. That ubiquity is why a flaw in the language’s runtime can force many organizations to patch or take sites offline at once. Government agencies and other organizations in the Netherlands, Australia, Japan, Finland and elsewhere took critical websites offline on Wednesday as a precaution while emergency patches were developed for two related critical vulnerabilities.

The flaws could allow unauthenticated attackers to execute code on affected servers without logging in. Maunder’s comments were published on X, and the related PHP2Shell hashtag also drew attention to the challenge.

Solana’s Alpenglow upgrade goes live

Solana’s first major consensus upgrade, Alpenglow, went live on mainnet at approximately 1:54 p.m. UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard.

Agave developer Anza said the time required for a transaction to become final — the point at which it is considered settled and irreversible — had fallen from approximately 12.8 seconds to about 150 milliseconds. DeFi activity was flat or slightly lower after the upgrade, although the post-upgrade period remained short.

The first phase of the upgrade, Votor, replaces Solana’s existing voting and finalization mechanism with direct validator voting and a certificate-based system. The change is expected to reduce the headline transaction count by approximately 60%.

A later phase will introduce Rotor, a new protocol for distributing block data that is intended to replace Turbine. Cointelegraph also reported on the Alpenglow mainnet launch.

Starknet community backs post-quantum L1 research

Starknet’s community voted to support research into becoming an independent, post-quantum layer-1 blockchain. Post-quantum cryptography refers to methods designed to resist attacks from quantum computers. The seven-day governance vote drew approximately 3,200 votes, with 93.52% of voting power supporting the transition.

The transition itself would require a separate, binding governance vote. Until then, Starknet will continue to operate as an Ethereum layer-2 network. The next checkpoints are the November whitepaper draft and the eventual binding vote.

“We’re beginning work on a whitepaper even before we start the weekend, and hope to release a draft for public scrutiny in November,” StarkWare CEO Eli Ben-Sasson told Cointelegraph.

Starknet recorded the largest decline among the top 100 cryptocurrencies during the week, losing one-quarter of its value. The vote was also covered in Cointelegraph’s report on Starknet’s post-quantum layer-1 research.

US senator requests information from Tether

Senator Richard Blumenthal, the senior Democrat on the Senate’s investigations subcommittee, requested information from Tether CEO Paolo Ardoino after The Wall Street Journal reported that the stablecoin company had signed a $6.3 million agreement with a marketing company co-founded by Bo Hines, a former White House crypto adviser. Tether is the issuer of USDT, the largest stablecoin by market value.

In a letter to Ardoino on Thursday, the Connecticut senator said the Senate Permanent Subcommittee on Investigations was seeking “records and information related to contracts, payments, communications, and lobbying” connected with the agreement.

Blumenthal said the arrangement might conflict with rules concerning ethics, corruption and lobbying. Tether said an external investigation “found no evidence of wrongdoing.” The subcommittee’s letter is available as a PDF, and Cointelegraph reported on the Senate inquiry into the reported Tether deal.

Winners and losers

At the end of the week, Bitcoin (BTC) was down 1.2% at $80,549, while Ethereum (ETH) had fallen 1.9% to $2,343. XRP (XRP) was up 0.9% at $1.20. The total cryptocurrency market capitalization stood at $2.68 trillion, according to CoinMarketCap.

Among the 100 largest cryptocurrencies, the three biggest weekly altcoin gainers were MemeCore (M), up 24.4%; Venice Token (VVV), up 14.8%; and Ethena (ENA), up 14.1%.

The three largest weekly altcoin decliners were Starknet (STRK), down 249%; Aerodrome Finance (AERO), down 12.5%; and Sei (SEI), down 12.5%.

Prediction of the week: JPMorgan forecasts Bitcoin outperformance

JPMorgan Asset Management projected that Bitcoin (BTC) would outperform US stocks and gold over the next decade, while cautioning that the cryptocurrency’s volatility currently makes it unsuitable as a portfolio diversifier.

On Monday, JPMorgan published its 2027 Long-Term Capital Market Assumptions report. The report projected an annualized return of 10% for Bitcoin, compared with 7.5% for large-cap US stocks and 5.5% for gold.

“At the moment, we do not make a case for Bitcoin as a diversifier in portfolios due to its unstable market correlations,” the report said. “We see Bitcoin as a speculative asset and a hedge against monetary easing.” Cointelegraph also reported on the JPMorgan Bitcoin forecast.

Top FUD of the week

New York attorney general seeks $1.37 billion from NovaTech founders

New York Attorney General Letitia James asked a court to order the founders of the defunct crypto and foreign-exchange trading platform NovaTech, Cynthia and Eddy Petion, along with related companies, to pay $1.37 billion over an alleged Ponzi scheme.

The attorney general’s office said more than 11,000 New Yorkers lost tens of millions of dollars through NovaTech and an earlier crypto mining scheme known as AWS Mining. The complaint alleged that promoters targeted Haitian and other immigrant communities through prayer groups, social media and WhatsApp, promising high returns and recruitment bonuses.

The case was detailed in Cointelegraph’s report on the New York attorney general’s action against NovaTech.

Bitcoin Core revises security policy as AI speeds up bug discovery

Bitcoin Core is changing its approach to security vulnerabilities because large language models can uncover software flaws more quickly. The same dynamic surfaced on Ethereum this week, where researchers from Ethlabs and the Ethereum Foundation deployed coordinated AI agents to scan contracts for vulnerabilities.

Bitcoin Core developer Antoine Poinsot said vulnerabilities had generally been kept under lengthy disclosure embargoes in the past, giving users time to upgrade before technical details became public. However, he said LLMs had made some flaws easy to rediscover, reducing the protection provided by delaying disclosure. Disclosure embargoes have long been standard practice across the software industry.

“The embargo period achieves little but it delays the availability of a fixed release,” Poinsot said. “We are therefore updating our policy disclosure to accommodate those.” The discussion is available in the Bitcoin development mailing-list thread, and Cointelegraph covered the Bitcoin Core policy change.

Pentagon bars personnel from using military information to bet

US Defense Secretary Pete Hegseth barred Pentagon personnel from using undisclosed information to place wagers on upcoming military action, including through prediction-market platforms such as Kalshi and Polymarket, which let users take financial positions on the outcomes of real-world events.

In a memo sent to senior Pentagon officials and defense agencies on Tuesday, Hegseth said all Department of War personnel were prohibited from engaging in financial transactions using nonpublic information. The restriction applies to both classified and unclassified information.

The memo is available here, while Cointelegraph reported on the Pentagon’s prediction-market restriction.

Top magazine features of the week

Five alternatives to Ledger for storing Bitcoin

Hardware wallets are not the only way to protect cryptocurrency. Exchange-traded funds, passkeys and multisignature accounts are among the alternatives, each with its own risks and trade-offs. The full feature is available at 5 alternatives to Ledger to store your Bitcoin.

AI agents can trade around the clock, but access may be lost

Animoca Brands Chairman Yat Siu said AI agents can execute trades while users sleep, but users need to plan for the possibility that they could lose access to the bots. The feature is available at Agents can trade 24/7 — but Yat Siu warns you could lose access at any time.