โŒ

Normal view

There are new articles available, click to refresh the page.
Today โ€” 29 October 2026Main stream

Ethereum clients patch flaw that could redirect ETH rewards

By: Rony Roy
29 October 2026 at 02:30
Ethereum client developers Teku and Besu have released security updates to address a certificate vulnerability that could allow attackers to impersonate services used by validators and potentially redirect their block rewards. According to security advisories accompanying the releases, the issueโ€ฆ

Yesterday โ€” 28 October 2026Main stream

USDT holder loses $50K in Ethereum address-poisoning attack

28 October 2026 at 14:17
A cryptocurrency user has lost approximately $50,000 in USDT to an address-poisoning attack on Ethereum, according to Scam Sniffer. Scam Sniffer said the fraudulent address matched the intended recipientโ€™s first four and last six characters. The security platform shared theโ€ฆ

ENSv2 launches on Ethereum as NFT claims require name upgrades

28 October 2026 at 11:55
Ethereum Name Service has launched ENSv2 on Ethereum mainnet, introducing individual registries for subnames and an optional commemorative NFT for wallets eligible under a June 1 snapshot. ENS Labs announced the Oct. 27 release alongside a redesigned ENS App andโ€ฆ

Ten EIP-7702 delegates strip their metadata hash. Nine of them publish their source

28 October 2026 at 02:59

Iโ€™d marked them as the likely hidden code. Of the 46 delegates that keep the hash, fewer than half are verified.

The most delegated contract in my EIP-7702 sample ends in these 12 bytes: a164736f6c6343000822000a. Most Solidity contracts built with default settings end in 53. The longer tail is a small CBOR map the compiler appends to the bytecode: an IPFS hash of the contractโ€™s metadata file, the compiler version, and two bytes giving the mapโ€™s length. This one has the version and noย hash.

On 8 September I pulled every EIP-7702 authorization from a 200-block window on Ethereum mainnet, 1,178 of them, and read the bytecode of the 59 contracts they delegated to. Nine of those authorizations pointed at the zero address, which is how an account undelegates, so 1,169 went to real code. When I went back over the 59 on 11 October, ten had the short tail. I left a note beside them: no metadata hash, so maybe nobody meant the source to beย found.

What the 12 bytes stillย say

Read as CBOR, a1 opens a map with one entry, 64 says a four-byte string follows (solc), and 43 says a three-byte value follows: 00 08 22, which is version 0.8.34. The last two bytes, 00 0a, give the length of everything before them, ten. So the compiler version survives. Whatโ€™s gone is the hash that would let anyone fetch the exact metadata file, the one that lists every source fileโ€™s own hash and the compiler settings. In solc thatโ€™s a single setting, metadata.bytecodeHash set to none, and Foundry exposes it as bytecode_hash.

Two byte strips. The upper one, from the second most delegated contract, is 53 bytes: a CBOR map holding an IPFS hash of 34 bytes and the solc version 0.8.35, then the length 0x33. The lower one, from the most delegated contract, is 12 bytes: a map holding only the solc version 0.8.34, then the length 0x0a.
The last bytes of two EIP-7702 delegates. Both record the compiler version; only one carries the metadataย hash.

Checking theย note

Today I asked Blockscoutโ€™s API whether each of the 59 has verified source, and asked Sourcify the same. Nine of the ten stripped contracts are verified on Blockscout. Of the 46 that kept the full hash, 21 are. The other three have no CBOR tail at all, and one of those is verified.

Counting authorizations instead of contracts widens the gap. In that September window, 369 of the 371 authorizations to stripped delegates went to a contract with published source. For the full-hash contracts it was 324 of 774, aboutย 42%.

Two pairs of horizontal bars. By contract, 9 of 10 stripped delegates are verified against 21 of 46 with the full hash. By authorization, 369 of 371 to stripped delegates went to verified code against 324 of 774.
59 delegate contracts from one 200-block window in September, verification read on 27ย October.

The one stripped contract with no source, 0xbaa66503..., drew two authorizations. The second most delegated contract in the whole sample, 0x67b743f3... with 144, carries a full IPFS hash and has no verified source on either service. Neither does 0x912518c2... with 96. Three unverified contracts of 2,140 bytes each carry the same IPFS hash, so theyโ€™re one build deployed threeย times.

Who stripsย it

The nine verified ones carry six contract names: Uniswapโ€™s CaliburEntry at three addresses, Alchemyโ€™s SemiModularAccount7702 at two, two TokenPocket delegators, UniversalGaslessDelegate, and the most delegated contract of all, with 308 of the windowโ€™s authorizations, whose verified source names it Poisoner.

A table of ten rows, one per stripped delegate, giving the address prefix, the verified contract name, the solc version read from the tail, authorizations in the window, Blockscout status and Sourcify status. Nine rows are verified; none is an exact match on Sourcify.
The ten stripped delegates. Blockscout and Sourcify read 27 October; authorizations from the 8 September window.

Caliburโ€™s foundry.toml and the one in Alchemyโ€™s modular-account repository both set bytecode_hash = "none" as the project default. Neither file says why. Five of the ten addresses look mined: two start with eight zeros, one with 0x0000fb7702, one with 0x69007702, and one starts 0x77021100 and ends 0000. The metadata hash changes whenever a comment or a file path changes, even when the compiled code doesnโ€™t, and an address found by searching CREATE2 salts depends on the exact bytecode. Dropping the hash ties the bytecode to the code alone. Thatโ€™s my reading of the reason, not something either projectย says.

What Sourcify makes ofย them

Sourcify answered for eight of the stripped contracts, and all eight came back as match, none as exact_match. Of the full-hash contracts it has, 13 of 17 are exact. Sourcifyโ€™s docs say an exact match rests on the metadata hash in the deployed code agreeing with the recompiled one, which is how it proves the source files are byte for byte the ones the author compiled. With no hash in the bytecode thereโ€™s nothing for that check to hold on to, so Iโ€™d expect every stripped contract to stop at match, whoever wroteย it.

What this doesnโ€™tย show

The authorization counts come from one 200-block window in September, so they say which delegates were busy then. Verified means Blockscoutโ€™s flag and Sourcifyโ€™s record as I read them on 27 October. I didnโ€™t check Etherscan, which wants an API key, and a contract could be verified there and nowhere else. I also tried two public IPFS gateways for the hashes on the unverified contracts and both refused the requests, so I canโ€™t say whether any of those metadata files exist somewhere.


Ten EIP-7702 delegates strip their metadata hash. Nine of them publish their source was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

JPM Coin Expands to Ethereum for Approved Institutional Clients

28 October 2026 at 03:00

TL;DR: J.P. The next evidence is transaction activity from approved institutions, additional supported use cases, integration with tokenised collateral and disclosures about outages and compliance controls.

The latest development in JPMโ€™s corner of the digital-asset market is worth examining beyond the headline. A 2026-10-19 announcement describes a concrete change, but the investment consequences will depend on how it works in practice. The original record is available in the original company statement; here is what it establishes, why the distinction matters and what remains unproven.

What the source actually says

J.P. Morgan said on October 19 that its JPM Coin deposit token, ticker JPMD, had been brought to Ethereum. The bank describes the service as available to eligible institutional clients, extending a token representing dollar deposits at J.P. Morgan to another public blockchain. It is not an open retail dollar coin anyone can mint or redeem freely. The important development is a major bank connecting its own deposit liabilities with blockchain-based institutional workflows rather than issuing an unrelated speculative crypto asset.

A deposit token and an independently issued payment stablecoin can look similar in a wallet interface, but the legal claims and eligible users may be very different. JPM Coin represents money deposited with the bank, subject to its programme terms and access controls. J.P. Morgan has also used the Base network, another Ethereum-compatible environment. The Ethereum expansion therefore increases where approved institutions can move the token without necessarily changing who is permitted to hold it.

The bank pointed to Ethereumโ€™s liquidity and existing tokenised-asset activity as a reason for the integration. Large financial institutions are interested in placing cash next to securities on shared infrastructure so that trading, payments and collateral operations can be coordinated. Onchain cash legs may shorten operational handoffs, but legal settlement arrangements and counterparty exposure still matter. An Ethereum transfer being final at the protocol level is not a complete description of a regulated financial transaction.

For cryptocurrency investors, the central point is to distinguish an announced milestone from an immediate change in asset value. The underlying development can strengthen a companyโ€™s product, legal position or operating capacity without determining what a token will trade for tomorrow. The linked source establishes what was disclosed; the valuation question requires a separate assessment of customers, costs, execution and market conditions. That gap between a confirmed fact and a forecast is where much of the investment risk sits.

What matters for the market next

Running a bank-backed instrument on public networks introduces a deliberate mix of openness and permissioning. Validators and infrastructure may be widely distributed, yet the asset itself can restrict eligible holders and transfer paths. That hybrid design is often more realistic for regulated institutions than assuming all treasury assets must be freely transferable. It also complicates claims that public-chain adoption automatically means universal decentralised access for users.

The next evidence is transaction activity from approved institutions, additional supported use cases, integration with tokenised collateral and disclosures about outages and compliance controls. The announcement confirms an Ethereum deployment but does not prove mainstream adoption by every banking customer. It shows how finance is experimenting with common blockchain infrastructure while preserving many of the boundaries and responsibilities of the conventional banking system.

Market watchers should also avoid treating a companyโ€™s or regulatorโ€™s headline as a substitute for terms and conditions. Tokens, shares and regulated service agreements create different rights, even when they coexist in one wallet or platform. A reliable follow-up should ask which entity is responsible, what a holder can actually redeem or transfer, and whether the claimed advantages appear in live activity. Those questions are more informative than an unsupported price target or an assumption that adoption is inevitable.

Primary source: original company statement (2026-10-19).

Written by the News Desk and edited by Samuel Rae.

Before yesterdayMain stream

Ethereum Foundation backs default wallet privacy as Kohaku work advances

26 October 2026 at 12:54
The Ethereum Foundation has backed default privacy in wallets by sharing an update on Kohaku, a software development kit integrating three privacy protocols, and arguing that attackers should have less access to usersโ€™ onchain histories. In its Oct. 26 Xโ€ฆ

Lido Puts Liquidity Buffers At The Center Of Ethereum ETP Yield Debate

25 October 2026 at 17:00

An Ethereum investment product can advertise staking exposure without putting every unit of its ETH to work. Lidoโ€™s October 23 comparison of European exchange-traded products brings attention to the cash-management choices behind the reward figures investors see.

TL;DR
  • Lido argues that staking allocation, fees and liquidity management shape ETP rewards.
  • Native staking withdrawals depend on network processes and queues.
  • A transferable staking token adds a market exit route, with its own execution risks.

The reward rate applies to the capital actually earning it

In its new institutional note, Lido says products holding an unstaked liquidity buffer may earn rewards on less than their full ETH exposure. It promotes liquid staking as an alternative and uses WisdomTreeโ€™s stETH-backed product as an example. Lido has a commercial interest in that comparison.

The arithmetic is straightforward even without ranking any funds. In an illustrative product with 100 ETH, a 20 ETH unstaked buffer would leave 80 ETH generating staking rewards. If the staked portion earned 3% over a year, it would produce 2.4 ETH before fees and other adjustments. Those are hypothetical inputs, not a forecast or a quoted product return.

A buffer is not necessarily wasted capital. It can provide liquidity when redemptions arrive or when other processes take time. The useful question is what operational benefit the buffer buys and how much reward the product gives up in exchange.

Ethereumโ€™s withdrawal documentation explains that exiting validators pass through network processes and that demand can affect the timeline. A fundโ€™s need to meet a commercial deadline does not accelerate the underlying protocol queue.

Liquid staking replaces one constraint with another market

A transferable claim on staked ETH can be sold without waiting for every underlying validator to exit. But a sale needs buyers at an acceptable price. Transferability does not guarantee that a large transaction will execute at the value used in a fundโ€™s accounting.

During ordinary trading, market makers may bridge that gap efficiently. Under stress, the amount of available liquidity and the cost of absorbing an order become more important. A structure that supports full staking can still face a difficult execution decision when many holders seek liquidity together.

The broader point echoes Bitcoin products using options for downside management: the underlying assetโ€™s name cannot fully describe the investorโ€™s payout.

Likewise, the process examined in CoinSharesโ€™ fund liquidation shows why redemption rules deserve attention before a deadline arrives. Trading a share and withdrawing its underlying exposure are distinct operations.

NewsBTCโ€™s coverage of corporate Ethereum staking adds another comparison: an equity holder owns a company with financing and management decisions, rather than a simple balance of staked coins.

Lidoโ€™s note is therefore most useful as a prompt to examine the complete structure. Allocation, net reward sharing, liquidity arrangements and market depth must be read together before two headline staking rates can be meaningfully compared.

Written by the News Desk and edited by Samuel Rae.

Lido Opens Higher-Balance Ethereum Validators With A Deliberately Small Start

25 October 2026 at 16:00

Lido has opened a permissionless route to Ethereum validators that can hold much larger effective balances, but the first allocation is deliberately limited. Its October 23 launch of 0x02 Community Staking Module separates gaining access from receiving the full amount of stake a validator could eventually support.

TL;DR
  • Lido says its new 0x02 CSM is live.
  • Operators supply a bond while protocol allocations arrive in stages.
  • Existing 0x01 operators can continue without switching modules.

A larger validator is funded through two queues

The launch announcement sets the bond at 32 ETH for the first key and 30 ETH for each additional key. Lido supplies the allocated stake. New keys first receive a 32 ETH seed deposit; further deposits follow after activation through a separate top-up queue.

The module starts with a 0.01% share limit of Lido Coreโ€™s total value locked and 32 top-up seats. Further capacity increases depend on a staged governance process and sufficient protocol inflows. A maximum balance is therefore a technical ceiling, not an immediate allocation promise to every operator.

The Ethereum change underneath this is EIP-7251, which allows a validatorโ€™s effective balance to rise to 2,048 ETH while retaining a lower activation requirement. More stake can consequently be represented by fewer validator keys.

For an operator, fewer keys can simplify parts of administration. It also makes the amount controlled by each operational setup more consequential. Key count alone becomes a weaker way to judge how broadly stake is distributed.

That distinction fits the concentration questions examined in NewsBTCโ€™s network-resilience coverage. Independent operators, infrastructure diversity and correlated failures all matter alongside the number of validators.

The entry bond is only one part of the operating decision

An operatorโ€™s experience depends on how long a key waits for activation, how quickly additional stake arrives and how reliably the validator performs. A favorable projection at full allocation cannot describe the whole period between posting a bond and reaching that allocation.

The comparison with solo staking also requires care. A bonded operator receiving protocol stake and a solo staker providing all the capital are taking different roles. The same percentage headline can conceal different denominators, duties and sources of reward.

Large corporate ETH treasuries illustrate how staking decisions can involve substantial balances. The new CSM route instead concerns how independent operators can service stake allocated through Lido.

It is separate, too, from Ethereumโ€™s execution-capacity tests. Supporting larger validators does not by itself raise the volume of application transactions a block can carry.

The staged launch gives the market concrete milestones to observe: activated keys, completed top-ups and approved capacity increases. Those measurements will show whether the permissionless route is expanding in practice, beyond the largest balance allowed by its design.

Written by the News Desk and edited by Samuel Rae.

Ethereum whales sell as outflows hit four-month high of 169,770 ETH

24 October 2026 at 02:27
Ethereumโ€™s early investors have reportedly sold another 4,000 ETH across two wallets as Santiment has recorded the networkโ€™s largest daily net exchange outflow in more than four months. Lookonchain identified the transactions in separate posts on Oct. 23 and Oct.โ€ฆ

โŒ
โŒ