AI Agents Step In to Rescue Ethereum's Glamsterdam Fork as 'Steal My Bitcoin' Challenge Falls to Hackers

AI Agents Coordinate the Glamsterdam Fork Rescue

Ethereum's second and final testnet for the upcoming Glamsterdam hard fork was scrapped earlier this week after ChainSecurity identified critical vulnerabilities in two gas-scaling Ethereum Improvement Proposals. The flaws, tied to EIP-8037 and EIP-8038, meant that any contract dependent on current gas behavior could break the moment a call exhausted its gas limit — a condition an attacker could have weaponized against at least 13 decentralized finance contracts.

Derek Chiang of Ethlabs acknowledged on X that the bugs surfaced extremely late in the development cycle, forcing every team involved to scramble to address the fallout. The Hoodi testnet dress rehearsal will not be rescheduled until all second-order effects of the fork have been thoroughly mapped out.

In a striking development, two researchers — one from Ethlabs and one from the Ethereum Foundation — independently launched multiple AI agents to scan smart contracts for vulnerabilities. Upon realizing they were pursuing the same strategy, the pair created a shared message board in the form of a GitHub repository so their agents could coordinate their work. Chiang drew a parallel to the recent OpenAI–Hugging Face incident, in which rogue agents had similarly set up a message board to orchestrate attacks. "Well, turns out the same pattern is useful for the good agents too," he observed.

The exercise proved so effective at uncovering potential problems that a second coordination board was spun up to examine the implications of EIP-8198, nicknamed "Quick Slots," which has been proposed for the subsequent Hegota hard fork.

'Steal My Bitcoin' Challenge and the PHP2Shell Wake-Up Call

A separate cybersecurity event dominated the week: a website offering a Bitcoin prize in a challenge tied to the year's biggest software scare was successfully breached. The 'Steal My Bitcoin' site hid the private key to a wallet worth roughly $2,000, accessible through a binary called print-flag via the PHP user account. The site had not been patched for the PHP2Shell vulnerabilities and drew enormous traffic, periodically crashing under the weight of probing attempts.

User KillerBoi ultimately extracted the private key, only to discover it did not correspond to the wallet address displayed on the site. Organizer James Pavur acknowledged the oversight and confirmed the funds would be transferred to the solver.

Mark Maunder, founder of WordFence, lauded the exploit as the clearest demonstration yet of how difficult PHP2Shell is to weaponize. He noted the attacker had to trigger a precise memory-corruption condition, leak internal memory addresses, bypass ASLR, reverse-engineer PHP's internal memory structures, forge structures to hijack execution flow, and account for differences across PHP builds, worker behavior, and timing. "With all the BS around it, it's nice to see something concrete that moves the art forward," Maunder said.

The broader impact was significant: government agencies and organizations in the Netherlands, Australia, Japan, Finland, and other nations took critical websites offline on Wednesday as a precaution while emergency patches were developed for two related critical vulnerabilities. The flaws allowed unauthenticated attackers to execute arbitrary code on affected servers without logging in. PHP remains a widely used language underpinning websites, web applications, and content management systems worldwide.

Solana's Alpenglow Upgrade and Starknet's Post-Quantum Push

Solana's first major consensus overhaul, Alpenglow, went live on mainnet at approximately 1:54 pm UTC on Wednesday, according to the Solana Foundation's dashboard. Anza, the Agave developer, reported that transaction finality time dropped from roughly 12.8 seconds to about 150 milliseconds. DeFi activity in the immediate aftermath was flat or marginally lower, though it is still too early to draw conclusions.

Alpenglow's first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system, which is expected to reduce the headline transaction count by around 60 percent. A later phase will introduce Rotor, a new block data-distribution protocol designed to replace Turbine.

Meanwhile, Starknet's community voted to back research into becoming an independent, post-quantum layer-1 blockchain. A seven-day governance poll drew approximately 3,200 votes, with 93.52 percent of voting power in favor. The actual transition would require a separate binding governance vote, and for now Starknet continues operating as an Ethereum layer-2 network. StarkWare CEO Eli Ben-Sasson told Cointelegraph that work on a whitepaper was already underway and a draft was expected for public scrutiny in November. Starknet recorded the steepest decline among the top 100 coins this week, erasing a quarter of its value.

Regulatory, Market, and Industry Headlines

Senator Richard Blumenthal, the top Democrat on the Senate's investigations subcommittee, sent a letter on Thursday demanding records and information from Tether CEO Paolo Ardoino regarding contracts, payments, communications, and lobbying tied to a $6.3 million marketing deal with a firm co-founded by former White House crypto adviser Bo Hines. Blumenthal believes the arrangement may violate ethics, corruption, and lobbying rules. Tether has stated that an external investigation found no evidence of wrongdoing.

In other regulatory news, New York Attorney General Letitia James asked a court to order the founders of defunct crypto and forex platform NovaTech, Cynthia and Eddy Petion, and their related companies to pay $1.37 billion over a Ponzi scheme. More than 11,000 New Yorkers lost tens of millions of dollars through NovaTech and an earlier crypto mining scheme called AWS Mining. The complaint alleged the promoters targeted Haitian and other immigrant communities via prayer groups, social media, and WhatsApp, promising high returns and recruitment bonuses.

Bitcoin Core is also revising its vulnerability-disclosure policy. Developer Antoine Poinsot explained that large language models have made certain software flaws so easy to rediscover that lengthy disclosure embargoes no longer offer meaningful protection. "The embargo period achieves little but it delays the availability of a fixed release," he said, noting the project is updating its policy accordingly.

On the macro side, JPMorgan Asset Management published its 2027 Long-Term Capital Market Assumptions report on Monday, projecting a 10 percent annualized return for Bitcoin over the next decade — ahead of 7.5 percent for large-cap US equities and 5.5 percent for gold. The firm cautioned, however, that Bitcoin's unstable market correlations make it unsuitable as a portfolio diversifier at present, describing it as a speculative asset and a hedge against monetary easing.

By week's end, Bitcoin traded at $80,549 (down 1.2 percent), Ethereum at $2,343 (down 1.9 percent), and XRP at $1.20 (up 0.9 percent). Total crypto market capitalization stood at $2.68 trillion per CoinMarketCap. Among the top 100 coins, the week's top altcoin gainers were MemeCore (M) at +24.4 percent, Venice Token (VVV) at +14.8 percent, and Ethena (ENA) at +14.1 percent. The biggest losers were Starknet (STRK) at -24.9 percent, followed by Aerodrome Finance (AERO) and Sei (SEI), both down 12.5 percent.