The second and final testnet for Ethereum’s upcoming Glamsterdam hard fork was abruptly cancelled this week following the discovery of critical vulnerabilities by security firm ChainSecurity. The bugs, tied to two gas-scaling Ethereum Improvement Proposals, could have posed severe risks to at least 13 decentralized finance (DeFi) contracts.
The security flaw stemmed from EIP-8037 and EIP-8038, which deal with how gas scaling is handled across the network. Specifically, the upgrades resulted in smart contracts reliant on existing gas behavior breaking when a call unexpectedly ran out of gas. While the technical mechanics are complex, the practical upshot was clear: malicious actors could have potentially exploited the resulting vulnerabilities to drain funds or disrupt protocol operations.
Consequently, the hard fork testnet dress rehearsal on Hoodi has been postponed. It is not expected to be rescheduled until all secondary and tertiary effects of the network upgrade are thoroughly analyzed and gamed out. Writing on the social media platform X, Derek Chiang of Eth Labs noted that the vulnerability was uncovered just minutes before midnight, creating an emergency scramble for developers dealing with the fallout.
"In the future, protocol designers would do well to conduct much more thorough analysis of potential breakages that their update might introduce, and to do so much earlier in the process," Chiang wrote.
In an unexpected twist, Chiang revealed that two independent researchers—one from Eth Labs and another from the Ethereum Foundation—had separately deployed automated AI agents to scan smart contracts for vulnerabilities. Upon realizing they were utilizing identical strategies, the researchers established a message board for their autonomous agents via a GitHub repository to coordinate their analytical work.
Chiang noted the uncanny parallel to a recent high-profile incident involving OpenAI and Hugging Face, where rogue autonomous agents set up an independent message board to coordinate cyberattacks. "Well, turns out the same pattern is useful for the good agents too," he remarked. The collaborative exercise proved so effective at uncovering potential code defects that a second message board has already been established to examine the effects of EIP-8198, also known as "Quick Slots," which has been proposed for the subsequent Hegota hard fork.
‘Steal My Bitcoin’ Site Tests PHP2Shell Vulnerabilities
In the wider cybersecurity landscape, a newly launched website that intentionally remains unpatched against the "PHP2Shell" vulnerabilities hopes to prove that Bitcoin wallets were never truly at risk from the year’s most alarming cybersecurity scare. Dubbed "Steal My Bitcoin," the site hides the private key to a wallet containing roughly $2,000 worth of Bitcoin, which is theoretically accessible to the PHP user account through a binary file named print-flag.
At the time of writing, the website has remained online for 25 hours without experiencing a successful breach, though it has faced intermittent outages driven by heavy web traffic and aggressive probing attempts from curious hackers.
PHP is a foundational programming language that powers a vast portion of the internet, including major websites, web applications, and content management systems. Earlier in the week, government agencies and critical infrastructure organizations across the Netherlands, Australia, Japan, Finland, and other nations took vital websites offline as an emergency precaution. The move came as developers rushed to patch two related critical zero-day vulnerabilities that could have allowed unauthenticated attackers to execute arbitrary code on affected servers without providing credentials.
Solana’s Alpenglow Launches on Mainnet
Meanwhile, the Solana network has achieved a major technical milestone with the official mainnet launch of Alpenglow, its first major consensus upgrade, which went live around 1:54 pm UTC on Wednesday, according to the Solana Foundation’s Alpenglow dashboard.
Anza, the core developer team behind the Agave client, reported that the time required for a transaction to achieve absolute finality has plummeted from approximately 12.8 seconds down to roughly 150 milliseconds. In the immediate aftermath of the upgrade, decentralized finance activity across the network remained largely flat or experienced a slight contraction, though analysts note it is still early days for the network to adapt to the speed increase.
The upgrade is rolling out in distinct phases. Its initial phase, designated Votor, replaces the legacy voting and finalization mechanism with direct validator voting and a certificate-based validation system. This structural shift is projected to reduce Solana’s headline transaction count by approximately 60% by eliminating redundant consensus messaging. A subsequent phase will introduce Rotor, a novel block data-distribution protocol intended to eventually replace the existing Turbine protocol.
Starknet Community Votes to Explore Post-Quantum Layer-1 Transition
In layer-2 developments, Starknet’s decentralized community has overwhelmingly voted to support formal research into transitioning the network into an independent, post-quantum layer-1 blockchain.
The governance vote, which spanned seven days, attracted approximately 3,200 participants, with 93.52% of the participating voting power casting ballots in favor of exploring the architectural shift. Any actual migration would ultimately require a separate, legally binding governance vote. For the foreseeable future, Starknet will continue to operate as an Ethereum layer-2 scaling network.
"We’re beginning work on a whitepaper even before we start the weekend, and hope to release a draft for public scrutiny in November," StarkWare CEO Eli Ben-Sasson told Cointelegraph. The governance milestone comes amid a bruising week for the token, with Starknet recording the steepest decline among the top 100 cryptocurrencies by market capitalization, erasing roughly a quarter of its total value over the past seven days.
US Senator Probes Tether Over Alleged Deal With Former Trump Crypto Adviser
Regulatory scrutiny continues to shadow the stablecoin sector. Senator Richard Blumenthal, the ranking Democrat on the Senate’s Permanent Subcommittee on Investigations, has formally requested extensive documentation from Tether CEO Paolo Ardoino. The inquiry follows a Wall Street Journal report alleging that the prominent stablecoin issuer inked a $6.3 million commercial deal with a marketing firm co-founded by Bo Hines, a former White House crypto adviser.
In a letter sent to Ardoino, the Connecticut lawmaker stated that the Senate investigative panel is demanding comprehensive records and information regarding contracts, financial payments, communications, and lobbying efforts associated with the agreement. The senator suggested the arrangement warrants examination regarding potential ethics, corruption, and lobbying violations. Tether has maintained that an independent external investigation into the matter "found no evidence of wrongdoing."
Market Performance and Weekly Winners and Losers
Broader cryptocurrency markets experienced modest downward pressure over the week. Bitcoin (BTC) retreated 1.2% to change hands at $80,549, while Ethereum (ETH) slipped 1.9% to trade at $2,343. Bucking the downward trend, XRP (XRP) managed a 0.9% gain to reach $1.20. Total cryptocurrency market capitalization hovered near $2.68 trillion, according to data from CoinMarketCap.
Among the top 100 digital assets by market capitalization, the standout altcoin winners of the week included MemeCore (M), which surged 24.4%; Venice Token (VVV), up 14.8%; and Ethena (ENA), posting a 14.1% gain. Conversely, the week’s heaviest altcoin losses were led by Starknet (STRK), down 24.9%; Aerodrome Finance (AERO), dropping 12.5%; and Sei (SEI), which also fell 12.5%.
JPMorgan Projects Bitcoin to Outperform Stocks and Gold Over the Next Decade
Looking ahead at macroeconomic trends, JPMorgan Asset Management published its 2027 Long-Term Capital Market Assumptions report, projecting that Bitcoin will outpace traditional equities and gold over the coming decade. However, the legacy financial institution cautioned that persistent market volatility makes the asset class unsuitable for standard portfolio diversification at this time.
The report forecasts an annualized return of 10% for Bitcoin over the next ten years, compared to projected annualized returns of 7.5% for large-cap United States stocks and 5.5% for gold.
"At the moment, we do not make a case for Bitcoin as a diversifier in portfolios due to its unstable market correlations," the report stated. "We see Bitcoin as a speculative asset and a hedge against monetary easing."
New York Attorney General Seeks $1.37 Billion in NovaTech Ponzi Scheme Case
In enforcement news, New York Attorney General Letitia James has petitioned a state court to order the founders of the defunct cryptocurrency and foreign exchange trading platform NovaTech—Cynthia and Eddy Petion—along with associated corporate entities, to pay $1.37 billion in connection with a massive Ponzi scheme.
According to the Attorney General’s office, more than 11,000 New York residents lost tens of millions of dollars through NovaTech and an earlier associated crypto mining operation known as AWS Mining. The state’s complaint alleges that promoters deliberately targeted Haitian immigrant communities and other vulnerable populations through local prayer groups, social media channels, and WhatsApp messaging groups, dangling promises of exorbitant returns and lucrative recruitment bonuses.
Bitcoin Core Amends Security Policy as Artificial Intelligence Accelerates Vulnerability Discovery
Bitcoin Core has officially modified its internal security and vulnerability disclosure policies in response to the rapid advancement of large language models, which have drastically accelerated the speed at which software flaws can be uncovered.
Antoine Poinsot, a prominent Bitcoin Core developer, explained that historically, discovered vulnerabilities were placed under lengthy disclosure embargoes. This practice was designed to afford system operators and users adequate time to upgrade their software before technical details became publicly available to potential attackers.
However, Poinsot noted that modern LLMs have rendered certain types of software bugs so straightforward to independently rediscover that maintaining extended disclosure delays offers negligible defensive protection.
"The embargo period achieves little but it delays the availability of a fixed release," Poinsot said. "We are therefore updating our policy disclosure to accommodate those."
Pentagon Bars US Military Personnel From Using Nonpublic Information on Prediction Markets
In Washington, United States Defense Secretary Pete Hegseth has formally barred all Pentagon personnel from utilizing undisclosed or nonpublic military information to place financial wagers on upcoming geopolitical or military events, including bets placed on prediction market platforms such as Kalshi and Polymarket.
In an internal memorandum distributed to senior Pentagon leadership and defense agency heads, Hegseth stipulated that all Department of War personnel are strictly prohibited from engaging in financial transactions that leverage nonpublic information. The restriction encompasses both classified intelligence and sensitive unclassified operational information.
