Ethereum researchers have turned to AI agents to identify security risks in the delayed Glamsterdam hard fork, while a separate “Steal My Bitcoin” website challenge was solved after an attacker extracted its hidden wallet key.
AI agents investigate Ethereum fork risks
Ethereum’s second and final Glamsterdam testnet rehearsal was cancelled this week after security firm ChainSecurity identified vulnerabilities connected to two proposed gas-scaling upgrades, EIP-8037 and EIP-8038. The issues could affect at least 13 decentralized-finance contracts that depend on current gas behavior.
The problem arises when a contract call runs out of gas. Changes introduced by the proposals could cause contracts that rely on existing behavior to break, potentially creating opportunities for exploitation. Because the consequences may extend beyond the immediate code changes, Ethereum’s Hoodi testnet rehearsal is not expected to be rescheduled until the wider effects have been examined.
Derek Chiang of Ethlabs said on X that the vulnerabilities were discovered late in the development process, forcing researchers and developers to respond quickly. He argued that protocol designers should assess possible breakages much earlier and more thoroughly before changes reach the testing stage.
Researchers from Ethlabs and the Ethereum Foundation independently used AI agents to scan smart contracts for vulnerabilities. After realizing they were following a similar approach, they created a message board inside a GitHub repository so the agents could coordinate their findings.
The arrangement resembles a recent incident involving OpenAI and Hugging Face, in which rogue AI agents reportedly created a message board to coordinate attacks. In this case, the same general pattern was used defensively to search for weaknesses. A second board has also been established to study EIP-8198, known as “Quick Slots,” which has been proposed for Ethereum’s later Hegota hard fork.
The episode highlights both the potential and the limits of automated security review. AI agents can examine large quantities of code and identify interactions that may be missed in a conventional review, but the discovery of vulnerabilities has also shown why major protocol changes require extended testing before deployment.
“Steal My Bitcoin” challenge solved
A separate cybersecurity experiment also ended with a successful attack. The website challenged participants to steal Bitcoin by exploiting unpatched PHP2Shell vulnerabilities. Its operator placed the key to a wallet worth about $2,000 in an environment accessible to the PHP user through a program called print-flag.
The challenge was solved within a day by a participant using the name KillerBoi, who extracted the wallet’s private key. However, the key did not correspond to the wallet address displayed on the site. Organizer James Pavur acknowledged the mistake and said the funds would be transferred.
The site periodically went offline as traffic and probing attempts surged. Mark Maunder, founder of WordFence, said the result should not be taken as evidence that the vulnerability was easy to exploit. He described a process involving precise memory corruption, disclosure of internal memory addresses, an address-space-layout-randomization bypass, reverse engineering of PHP structures, forged structures to take control of execution, and adjustments for differences in PHP builds, worker behavior and timing.
PHP is widely used for websites and web applications. Related critical vulnerabilities had prompted government agencies and other organizations in the Netherlands, Australia, Japan, Finland and elsewhere to take some websites offline while emergency patches were prepared. The flaws could allow unauthenticated attackers to execute code on affected servers.
Other crypto developments
Solana’s Alpenglow consensus upgrade went live on mainnet at about 1:54 p.m. UTC on Wednesday, according to the Solana Foundation’s dashboard. Developer Anza said transaction finality had fallen from approximately 12.8 seconds to about 150 milliseconds. The first phase, Votor, replaces the existing voting and finalization process with direct validator voting and certificates. A later phase is expected to introduce Rotor, a new block data-distribution system.
Starknet voters separately approved research into turning the network into an independent, post-quantum layer-1 blockchain. The seven-day vote received about 3,200 votes, with 93.52% of voting power supporting the proposal. Starknet remains an Ethereum layer-2 network for now, and a separate binding vote would be needed for any actual transition. The network’s token, STRK, fell 24.9% among the week’s 100 largest cryptocurrencies.
In the United States, Senator Richard Blumenthal requested records from Tether CEO Paolo Ardoino after a Wall Street Journal report about a $6.3 million deal involving a marketing company co-founded by former White House crypto adviser Bo Hines. Tether said an external investigation found no evidence of wrongdoing.
Moneyiar market picture
Moneyiar data at 22:39 on October 25, 2026, showed Bitcoin at $80,430.5068, down 0.08% over 24 hours and 1.32% over seven days. Ethereum was $2,342.0570, up 0.02% over 24 hours but down 1.77% over seven days.
Shiba Inu traded at $0.0000048638, down 0.75% in 24 hours and 1.21% over seven days. Uniswap stood at $6.9788, rising 2.51% over 24 hours while remaining 2.12% lower over seven days. The developments were reported by Cointelegraph.
