Ethereum has called off the second and final testnet rehearsal for its Glamsterdam hard fork after ChainSecurity found a flaw in gas-scaling proposals that could affect at least 13 DeFi contracts. Solana, meanwhile, has deployed its Alpenglow consensus upgrade to mainnet, and Starknet's community has backed research into turning the network into an independent, quantum-resistant Layer 1. Crypto markets edged lower over the week, with bitcoin and ether both down.
Glamsterdam rehearsal paused over contract risk
ChainSecurity's findings involve EIP-8037 and EIP-8038. Some contracts rely on how calls behave when gas runs out under the current rules. The proposals could change that behavior, potentially breaking those contracts and creating an exploitable risk. The Hoodi testnet rehearsal has not been rescheduled; the team first needs to assess the hard fork's possible knock-on effects.
Derek Chiang of Eth Labs said the flaw was found shortly before midnight, leaving little time for the teams involved to address it. He said protocol designers should analyze compatibility risks from upgrades earlier and more thoroughly.
Researchers at Eth Labs and the Ethereum Foundation had each been using AI agents to scan contracts for vulnerabilities. After discovering that they were using similar methods, they set up a message board for the agents through a GitHub repository to coordinate their work. Chiang compared the arrangement with previous cases involving OpenAI and Hugging Face in which agents established their own communication channels, noting that similar collaboration can also support defensive work.
The researchers also created a second agent message board to assess the implications of EIP-8198, known as “Quick Slots,” a proposal for the subsequent Hegota hard fork.
Solana says Alpenglow cuts finality to about 150 milliseconds
Solana's first major consensus upgrade, Alpenglow, went live on mainnet on Wednesday at about 13:54 UTC. Developer Anza said the time needed for transactions to reach finality has fallen from roughly 12.8 seconds to about 150 milliseconds, a reduction of around 99%.
The upgrade has only just been deployed. DeFi activity is currently flat or slightly lower, so there is not yet enough evidence to assess its longer-term effect on network usage.
The first phase, Votor, replaces the existing voting and finality mechanisms with direct validator votes and a certificate-based system. The change is expected to reduce the number of transactions displayed on-chain by about 60%. A later phase, Rotor, is planned to introduce a new protocol for distributing block data in place of Turbine.
Starknet voters back quantum-resistant L1 research
Starknet's community has voted to study whether the network should become an independent, quantum-resistant Layer 1. The seven-day governance vote closed on Thursday, with about 3,200 votes cast. On a voting-power basis, 93.52% supported beginning the research.
The result does not mean Starknet has left Ethereum. The network will continue to operate as an Ethereum Layer 2 unless a separate, binding governance vote approves a transition. StarkWare CEO Eli Ben-Sasson said work on a white paper has begun, with a draft planned for public review in November.
StarkNet was among the worst-performing top-100 crypto assets this week, with its token down about a quarter in value.
PHP vulnerability site puts roughly $2,000 in bitcoin at stake
A website called Steal My Bitcoin has deliberately maintained an environment vulnerable to the unpatched PHP2Shell flaw to test whether it could put a bitcoin wallet at risk. A wallet key for bitcoin worth about $2,000 is placed somewhere accessible to a PHP user account, with access provided through a binary program called print-flag.
About 25 hours after the site went live, no successful breach had been recorded. The site did, however, go offline intermittently under a high volume of traffic and probing requests.
PHP is widely used to build websites and web applications. Two related critical vulnerabilities could allow unauthenticated attackers to execute code on affected servers. On Wednesday, government agencies and organizations in the Netherlands, Australia, Japan, Finland and elsewhere took precautionary steps by temporarily shutting down websites. PHP subsequently released emergency patches.
The wallet test covers only the specific environment on the site; it does not establish the security status of other PHP systems or wallets.
Tether responds to request over marketing contract
A letter addressed to Tether CEO Paolo Ardoino requests company records relating to a marketing contract, including contracts, payments, communications and lobbying materials. The deal was worth $6.3 million and involved a marketing firm co-founded by Bo Hines, a former White House adviser on crypto matters.
The inquiry asks whether the transaction raised issues involving ethics, corruption or lobbying rules. Tether said an external investigation found no evidence of wrongdoing.
Weekly prices: bitcoin down 1.2%, STRK down 24.9%
By the end of the week, bitcoin was down 1.2% at $80,549 and ether had fallen 1.9% to $2,343. XRP gained 0.9% to $1.20. The total crypto market capitalization stood at about $2.68 trillion.
Among the 100 largest crypto assets by market value, MemeCore (M) led the weekly gainers, up 24.4%. Venice Token (VVV) rose 14.8% and Ethena (ENA) gained 14.1%. StarkNet (STRK) was the biggest decliner, down 24.9%, while Aerodrome Finance (AERO) and Sei (SEI) each fell 12.5%.
JPMorgan sees bitcoin returning 10% annually over the next decade
JPMorgan Asset Management's 2027 Long-Term Capital Market Assumptions project an annualized bitcoin return of 10% over the next decade. That compares with 7.5% for large-cap U.S. stocks and 5.5% for gold.
The report also says bitcoin's correlation with other assets is unstable, so it does not currently treat the cryptocurrency as a portfolio diversifier. It describes bitcoin as a speculative asset and a hedge against monetary easing. These are long-term assumptions, not a forecast for near-term prices.
New York seeks $1.37 billion from NovaTech founders
New York's attorney general is asking a court to order the founders of defunct crypto and foreign-exchange trading platform NovaTech, Cynthia Petion and Eddy Petion, and associated companies to pay $1.37 billion. The amount includes about $1.13 billion in investor funds and $232.5 million in interest.
The attorney general's office says more than 11,000 New York residents lost tens of millions of dollars through NovaTech and an earlier crypto-mining venture, AWS Mining. The lawsuit alleges that promoters approached Haitian and other immigrant communities through prayer groups, social media and WhatsApp, promising high returns and recruitment bonuses.
The amounts and alleged conduct are set out in the lawsuit. The case remains subject to further court proceedings.
Bitcoin Core revises vulnerability disclosure policy
Bitcoin Core is changing how it discloses security vulnerabilities. Developer Antoine Poinsot said large language models have made some software flaws easier to find, potentially weakening the protection that longer periods of confidentiality were intended to provide while users upgraded.
Poinsot said that when a flaw is easy to rediscover, delaying the release of a fix for an extended period may have limited value. Bitcoin Core will therefore update its disclosure policy to reflect the changing vulnerability-discovery environment. For users, the change concerns the timing of fixes and public disclosures; it does not announce a new vulnerability.