Ethereum developers have patched a flaw in the planned Glamsterdam upgrade that could have sent ETH meant for new validators to the wrong party.
No losses are reported, and the issue appears only in draft upgrade rules, not on the live Ethereum network that users rely on today.
The fix changes how validator deposits are handled and is now part of Ethereum’s consensus specifications, the shared rulebook that client teams follow when building software.
A researcher known as avsetsin discovered the problem, which emerged during testing of how the network processes deposits that are waiting to be credited.
Glamsterdam separates two jobs that Ethereum currently bundles together. Builders assemble transactions into blocks, while validators stake ETH to confirm them and help secure the network.
Glamsterdam is a major planned overhaul of how Ethereum produces blocks, so even small rule changes attract close scrutiny from client teams and researchers.
That split introduces builder accounts alongside validators, and the bug sits at the point where their deposits meet.
Under the draft rules, an operator could first register as a builder using a specific public key, then wait for a staking service to use the same key.
When the staking service later deposits ETH with that key to activate a validator, the draft rules would credit the funds to the builder instead.
The operator could then withdraw those funds without ever creating a validator, leaving the staking service without the validator it paid to activate.
Avsetsin describes the finding as a conditional code issue rather than a confirmed live exploit, noting that existing checks could block the attack.
The new rules sort deposits by their withdrawal credentials, which keeps validator deposits tied to validators even when a builder reuses the same public key.
The path to the fix is notable. Developers rejected the same change roughly a week earlier, with specification maintainer Justin Traglia saying client support was not yet sufficient.
Client teams must now fold the new rules into their software before Glamsterdam can advance toward a mainnet launch.
Clients are the separate programs that validators run to take part in Ethereum, so coordination across several independent teams will shape the timeline.
Glamsterdam already runs on the Sepolia test network, but the rollout on Hoodi, a second testnet, is delayed with a new date still to be set.
No mainnet release date exists yet, so the upgrade remains in the testing and specification phase for now.
Further testing is expected to follow once client teams finish their implementations and a new Hoodi date is confirmed.
The episode shows the value of that long testing process, since the bug surfaces well before any real ETH is at stake on mainnet.
It also underlines the role of independent researchers, who help catch subtle design problems before upgrades reach production.
Readers following the upgrade should watch for a confirmed Hoodi schedule, which will be the clearest signal of how quickly Glamsterdam moves toward mainnet.
ETH trades near $2,345 on Wednesday, up slightly on the day, as the market focuses mainly on the Federal Reserve’s rate decision.
Bitcoin Core has changed how it handles security flaws, and the trigger is the speed at which AI tools can now dig up bugs. Maintainers merged a revision to the project’s security policy on Thursday that ends the months-long private embargo for any vulnerability a large language model could easily rediscover.
The old system worked on severity. Each reported flaw was graded, and disclosure was scheduled to match. Medium and high-severity issues were commonly kept confidential until the affected versions reached end of life, which in practice could stretch to close to a year. The logic was that node operators upgrade slowly, so a long quiet period gave them time before technical details went public.
That logic has taken a beating. The new policy lets maintainers flag a bug during triage as “easily discoverable,” defined as something that can be found with minimal effort, such as a simple LLM prompt. Flagged fixes are backported to every supported version of Bitcoin Core and pushed out through point releases as soon as possible, alongside a security advisory that carries some of the details. The policy’s own reasoning is blunt: a long embargo achieves little for these bugs, and it only delays the release of a fixed version.
The change follows a summer of AI-driven security scares across the Bitcoin ecosystem. In July, a volunteer group called the Bitcoin Red Team, made up of 16 developers, pointed AI models at roughly 390 Bitcoin-related projects and came back with 4,962 findings in about a day. Eighty-five were rated critical. In August, Core Lightning’s small development team was hit by a wave of AI-generated vulnerability reports, several of which were genuine, and told node operators to upgrade or disconnect from the network. Coldcard, the hardware wallet maker, said it believed attackers had used AI to find a flaw in its firmware, and the Boltz swap service paused operations after saying attackers were finding bugs faster than it could patch them. A group that included Coinbase, Block, BitGo and Blockstream even asked AI labs for early access to their strongest models, arguing Bitcoin developers shouldn’t be locked out of tools attackers can already reach.
The change has critics. Longtime security researcher Antoine Riard argued Core should keep the discretion to ship a fix with no advisory at all and hold details back case by case. There is also a practical tradeoff: patches may go public with less testing time than before. No vulnerability has been placed in the new category yet, so the policy is untested in the real world.
The most serious flaws sit outside the standard timetable anyway. Anything that could threaten Bitcoin’s monetary rules or transaction integrity would still get an ad hoc response. Everything else now runs on a simple assumption: if a chatbot can find it, an attacker already has.
The FBI and Japan’s National Police Agency issue a joint warning about North Korea linked hackers running a massive device infection campaign.
Investigators say the hacking group infects more than 30,000 devices across over 100 countries as part of an ongoing operation targeting crypto workers.
The campaign specifically targets employees at cryptocurrency, artificial intelligence, and NFT firms by posing as legitimate recruiters offering attractive job opportunities.
Victims receive fake interview invitations and coding assignments that secretly install malware, granting hackers persistent access to company systems and personal devices.
Authorities report the hackers successfully steal funds from more than 7,000 individual crypto wallets during this extended and coordinated campaign.
Total losses linked to this specific operation reach approximately $10.71 million, according to figures shared by investigators tracking the group’s activity.
This tactic mirrors well documented North Korean cyber strategies. State linked groups routinely pose as recruiters on LinkedIn and other professional networks.
Previous campaigns used similar methods to breach wallet software companies and exchanges, sometimes resulting in losses reaching hundreds of millions of dollars.
Security researchers note that fake job offers remain one of the most effective social engineering tools used by North Korean hacking collectives.
The malware deployed often masquerades as pre-employment coding tests, tricking developers into running malicious scripts on machines with sensitive system access.
United Nations officials have previously stated that North Korea relies heavily on cryptocurrency theft to fund its sanctioned weapons and missile programs.
Crypto companies are urged to strengthen hiring verification processes and train staff to recognize suspicious recruitment outreach before it leads to a breach.
U.S.-listed spot Bitcoin ETFs pulled in $730.9 million in net inflows on Wednesday, their biggest single-day haul since mid-January, as Bitcoin staged a sharp rebound.
BlackRock’s iShares Bitcoin Trust (IBIT) led the way, absorbing $454 million — more than 60% of the day’s total — and pushing its lifetime inflows to nearly $64 billion. ARK Invest and 21Shares’ ARKB brought in a further $138 million, while Fidelity’s FBTC added roughly $74 million and Grayscale’s two Bitcoin products together attracted $57 million. Only VanEck’s HODL and WisdomTree’s BTCW saw money leave, shedding a combined $25 million or so.
The rush of buying coincided with Bitcoin’s price jumping between 5.7% and 5.9% on the day, lifting the combined net assets of the U.S. Bitcoin ETF market to roughly $103.3 billion — equal to just over 6% of Bitcoin’s total market value. Wednesday’s inflow dwarfed anything seen during an 11-day stretch of positive flows in late August, coming in more than three times larger than any single day in that run.
The swing highlights just how choppy demand has been lately. The funds had shed $236 million just two trading days earlier, with IBIT alone accounting for about $201 million of that outflow, before flows flipped positive again and then surged on Wednesday. It’s part of a broader pattern this year: after eight straight negative weeks heading into July, the ETFs have alternated between multi-day buying streaks — including an $853.5 million run in early August and a $2.8 billion streak spanning eight sessions later that month — and sudden bouts of selling, such as the $202 million pulled out on August 28 that snapped a nine-day inflow run.
Analysts at QCP Capital have noted that much of Bitcoin’s recent price strength has been driven by spot buying rather than leveraged futures positions, pointing to a decline in futures open interest even as the price climbed — a sign, they suggest, that the rally has firmer footing than one built purely on leverage.
XRP dips below the $1 mark for the first time since late 2024, rattling holders even as the wider XRP Ledger network keeps functioning normally through the episode.
The move follows a targeted exploit on the Coreum bridge, a cross-chain tool that lets users move XRP between the XRP Ledger and the Coreum blockchain.
An attacker drains close to 200,000 XRP, worth roughly $200,000, from the bridge in just 97 minutes on August 9, according to blockchain analytics tracked through XRPL.to.
The method proves unusually clever. Rather than stealing private keys or breaking a smart contract, the attacker manipulates the bridge’s own deposit verification process using a fake transaction label.
Relayer software fails to confirm that incoming payments actually target the bridge itself, a gap that lets the attacker trick a quorum of signing keys into approving fraudulent withdrawals.
Coreum halts bridge operations immediately after discovering the breach, confirms the vulnerability sits in its own code, and says it will file a formal complaint with federal investigators.
Two days after the hack, XRP touches an intraday low near $0.99 before buyers step in hard, pushing the token back above $1 on volume exceeding $2 billion.
That sharp recovery signals genuine demand at the $1 level rather than a controlled slide, with traders treating the psychological floor as worth defending.
Crypto analyst Ali Martinez flags a fresh monthly buy signal on XRP’s chart, noting the same pattern preceded rallies exceeding 1,000% in prior cycles dating back to 2020.
Other forecasters stay far more cautious. Some technical models point toward downside risk as low as $0.62 if support fails to hold through the next few sessions.
Institutional views remain split as well, with at least one major bank maintaining a long-term price target well above $2 despite the current weakness.
XRP now trades more than 70% below its record high set in July 2025, even as on-chain activity and active wallet counts continue climbing through August.
Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong. Take 2 mins to learn more.
WhiteBIT has expanded its product offering with the introduction of two automated spot trading tools — the Spot Grid Bot and Martingale (DCA) Bot — as the company continues to broaden access to trading tools.
The launch comes as demand for automated trading tools continues to grow worldwide. According to Grand View Research, the AI-powered trading platform market is projected to nearly triple in size by 2030. While early adoption of crypto was largely driven by buy-and-hold investing, today’s traders are increasingly seeking tools that allow them to automate execution, manage risk more efficiently, and respond faster to market movements.
The new bots are designed specifically for this shift in behaviour, enabling users to automate trading strategies while retaining the flexibility to adjust settings without interrupting active positions.
Why this is relevant now
The launch reflects the realities of today’s UK crypto market, where regulation shapes how traders approach market participation.
The FCA’s ban on crypto derivatives for retail consumers — covering CFDs, futures, and options — means that spot trading is the only method for retail investors in the UK to access digital assets. As a result, demand is growing for tools that help traders automate strategies while remaining within the spot market. WhiteBIT’s Spot Grid Bot and Martingale (DCA) Bot were developed with this environment in mind.
At the same time, access to automation alone does not solve the underlying challenge traders face. Most bots are difficult to change once deployed — if conditions shift, traders must choose between letting an outdated strategy run or shutting it down entirely. Both of WhiteBIT’s tools are built to stay editable mid-run, giving traders the ability to adjust without starting over.
Designed for Different Strategies
The Spot Grid Bot is designed for sideways or ranging markets — periods where an asset’s price moves within a relatively narrow band rather than trending consistently upward or downward. An AI system analyses historical price behaviour and recommends a starting setup. Traders should be aware that automated strategies carry their own risks: a bot running in fast-moving or unexpected market conditions may execute trades that result in significant losses. Past performance data used in backtesting does not reflect future results. Once live, the range, capital allocation, and risk exposure can be adjusted while the strategy runs without a full restart.
The Martingale (DCA) Bot suits traders with a directional view of the market. It buys more as prices dip, following a structured cycle. This approach increases exposure as prices fall — which can work in a trader’s favour in a recovery, but also means larger positions during prolonged downturns.If the market drops further than expected and the bot pauses, traders can step in manually to intervene. When a cycle closes, they decide what happens next: withdraw, reinvest, or accumulate the asset.
Using these tools does not eliminate the risk of loss and are not suitable for everyone.
Responding to a Maturing Market
The launch comes as the UK crypto market becomes more defined.
According to the FCA’s Cryptoassets Consumer Research 2025, the number of UK crypto holders fell from approximately 7 million to 4.5 million over the past year — but the average value held per investor rose, with the mean holding now sitting at just under $2,500, suggesting a shift toward more established investors.
The use of centralised exchanges remains by far the most common way UK traders access crypto, and that share has grown — up 4% year on year to 73% of all crypto users. The picture the FCA paints is of a market that is becoming more selective, more cautious, and more focused on credibility.
For WhiteBIT, trading bots represent the next step in expanding its UK offering.
South Korean police escalate an investigation into former Incheon Mayor Yoo Jeong-bok, carrying out search and seizure operations at his home and city hall offices.
Investigators from the Incheon Metropolitan Police Agency’s Anti-Corruption and Economic Crime Investigation Unit conducted the searches, collecting mobile phones, computers, and other evidence.
The probe centers on allegations that Yoo and his wife failed to disclose approximately 21,000 units of cryptocurrency during South Korea’s June 3 local elections.
Authorities allege the couple transferred the crypto holdings to an overseas exchange before submitting mandatory asset disclosures required of all public election candidates.
Election officials had previously flagged that Yoo’s reported assets appeared understated by roughly 78 million won compared to his actual holdings at the time.
Police have already questioned Yoo, his wife, identified only by her surname Choi, and individuals connected to the original complaint against the couple.
The complaint reportedly originated from someone linked to a rival campaign during the local election cycle, adding a political dimension to the investigation.
No formal charges have been filed so far in the crypto disclosure matter, which remains an active police investigation without a set timeline for resolution.
Under South Korea’s Public Official Election Act, a conviction carrying a fine above a certain threshold can strip an elected official of their seat.
That legal consequence is part of why cases involving asset disclosure violations draw such close scrutiny from both regulators and the public in Korea.
The case highlights a persistent gap in South Korea’s financial transparency rules, since holdings on foreign crypto exchanges are harder for regulators to trace.
Domestic, real-name-verified crypto platforms already give South Korean authorities clearer visibility into asset movements than exchanges based outside the country’s jurisdiction.
Seoul has been working to narrow that blind spot, pulling cross-border crypto transfers under closer Bank of Korea monitoring through a revised Foreign Exchange Transactions Act.
Regulators are also tightening disclosure obligations for individuals and firms that actively promote cryptocurrency investments to the public across South Korea.
The Yoo case now stands as a concrete test of how effectively these new oversight measures can close the offshore visibility gap going forward.
Legal observers say the outcome could shape how aggressively Korean authorities pursue similar disclosure cases involving public officials and undisclosed foreign crypto holdings.
The Digital Chamber, one of the largest crypto lobbying groups in Washington, files suit against Illinois this week. The organization wants to block the state’s new digital asset tax before it starts.
Illinois lawmakers passed the 0.2% levy last month as part of a $55.9 billion budget package. Governor JB Pritzker signed the measure into law in June, and it takes effect at the start of 2027.
The complaint lands in the Circuit Court of Sangamon County and names the state’s Department of Revenue and Attorney General as defendants. It runs more than 30 pages and targets the Digital Asset Tax Act directly.
Unlike a capital gains tax, the new rule does not care whether a transaction produces profit. It calculates charges from the value of the asset itself during any covered blockchain activity.
The lawsuit argues the tax breaches the uniformity and due process clauses in the Illinois constitution. It also claims violations of the Commerce Clause and the federal Internet Tax Freedom Act.
According to the filing, the law does not distinguish between gains and losses, between profitable and unprofitable transactions, between realized and unrealized appreciation, or between transfers that change ownership and transfers that do not. Instead it separates blockchain infrastructure from every other kind of financial system.
Federal law treats what an asset represents separately from the technology used to record its ownership, the complaint states. No other area of law draws a line based purely on recordkeeping method.
The Digital Chamber counts more than 250 companies among its members, including Anchorage Digital, Chainlink Labs, and Intercontinental Exchange, the parent company behind the New York Stock Exchange.
CEO Cody Carbone says the tax provision entered the budget the night before final consideration, leaving little room for scrutiny of its fairness or its compliance demands on smaller firms.
Before Pritzker signed the budget, The Digital Chamber and the Illinois Blockchain Association jointly asked officials to strip the tax out entirely rather than fold it into unrelated budget legislation.
The Crypto Council for Innovation separately urged the governor to use a line-item veto against the crypto provision, but that request went nowhere before the signing.
The group compares the approach to charging extra postage simply because a letter arrives by email instead of the mail, arguing the technology itself should not change the tax outcome.
Beyond blocking enforcement, the lawsuit asks a judge to award The Digital Chamber its legal fees and costs, plus a formal declaration that the statute cannot stand.
The Digital Chamber warns that letting Illinois proceed could invite other states to copy the model, potentially expanding similar treatment to AI systems or cloud based payment platforms next.
Ethereum treasury firm Sharplink has acquired 5,000 ETH at a cost of approximately $7.85 million, representing the company’s first ether purchase in eight months. The move is drawing attention as a sign of renewed corporate demand for the asset during a period of sustained selling pressure.
The purchase is particularly notable given the timing. Crypto equities and digital asset treasury companies have faced persistent headwinds through the second quarter of 2026, making fresh balance sheet buying a more deliberate signal than it might otherwise appear.
Sharplink operates as one of a small group of listed companies that hold Ethereum as a primary treasury asset, mirroring the strategy that Strategy popularised with Bitcoin. The company’s decision to resume accumulation suggests internal conviction that current price levels represent value.
Ethereum has traded around the $1,560 to $1,580 range in recent sessions, well below peaks seen in prior cycles. Open interest in ETH derivatives has fallen nearly 30 percent over the past 30 days, reflecting broad deleveraging and a market that has been shedding leveraged long positions.
The Fear and Greed Index for the crypto market sat at 17 at the time of the purchase, firmly in extreme fear territory. Contrarian buyers have historically viewed such readings as potential entry points, though the current macro environment has complicated that playbook.
Liquidation data from the past 24 hours showed Ethereum longs absorbing particularly heavy losses, with more than 82 percent of ETH liquidations on the long side. Against that backdrop, Sharplink’s purchase signals a willingness to take a contrary position in a market shedding risk.
The company has not publicly stated a price target or accumulation schedule. However, the resumption of buying after an eight-month gap suggests a strategy that is responsive to price levels rather than operating on a fixed time-based buying programme.
Corporate Ethereum treasury strategies remain far less common than their Bitcoin equivalents. Sharplink is among the few public companies to have built its identity around ETH accumulation, and its return to buying will be tracked by others in the sector watching whether institutional appetite for the asset is returning.
The purchase adds approximately 5,000 ETH to Sharplink’s holdings at a moment when the broader market remains under pressure. Whether the move marks a turning point or simply reflects one company’s assessment of value at current levels will depend heavily on how Ethereum trades in the weeks ahead.
Bitcoin broke above $72,000 on Thursday morning for the first time since March 18, with the cryptocurrency reaching an intraday high of $72,865 before a wave of selling pressure pulled it back toward $71,500. The move represented a five percent gain in 24 hours and lifted the total cryptocurrency market capitalisation to $2.51 trillion, its strongest reading in several weeks.
The catalyst was the same one driving equities: the ceasefire announced by President Trump less than two hours before his 8 p.m. Tuesday deadline for Iran to reopen the Strait of Hormuz. Bitcoin had been trading in a narrow $65,000 to $73,000 war range for weeks, with upside persistently capped by oil-driven inflation fears and investor preference for safer assets during the escalatory phase.
The short squeeze component of the rally was significant. According to CoinGlass data, $254 million in bearish bitcoin short positions were wiped out in 24 hours, the largest single-day short liquidation since March 4. Across the broader crypto derivatives market, the total figure reached nearly $600 million in forced liquidations, the majority from shorts. This kind of mechanical unwinding amplifies price moves well beyond what spot demand alone would generate.
Ethereum had the stronger percentage gain, rising approximately 6 to 7 percent to above $2,200, its highest level since March 18. Solana, XRP and a range of altcoins all posted moves of 5 percent or more. The CoinDesk 20 index, a measure of broader crypto market performance, outpaced Bitcoin’s gain, which is a typical pattern when sentiment shifts from risk-off to risk-on.
Crypto-related stocks also responded sharply. Circle and Galaxy Digital advanced more than 7 percent in premarket trading. Robinhood rose 8 percent. Coinbase gained 5 percent. Strategy and Bitmine Immersion Technologies both climbed 6 percent or more. These companies serve as leveraged proxies for crypto sentiment in traditional equity markets, and their moves reflect how quickly institutional positioning can shift when macro conditions change.
Morgan Stanley’s Bitcoin ETF, MSBT, debuted on NYSE Arca on Wednesday under its ticker, coinciding with the ceasefire rally and providing additional institutional access to Bitcoin exposure through a familiar product structure. The ETF’s 0.14 percent annual fee positions it competitively within the growing universe of institutional Bitcoin products.
Analysts remain cautious about the sustainability of the move. Bitfinex margin long positions remain elevated at above 80,000 BTC, near multi-year highs, which historically functions as a contrarian indicator. The physical situation in the Strait of Hormuz remains complicated, with Iran continuing strikes on Gulf states after the ceasefire announcement and the Hormuz corridor not yet operating freely.
Gracy Chen, one analyst commenting on the outlook, offered a clear framework. “With stronger spot demand in place and higher onchain activity, bitcoin may finally get enough strength to break above $75,000 and move toward $80,000,” she said. “On the flip side, if the market fails to hold $68,000, downside pressure may persist, opening the way to $60,000 first.”