AI agents help rescue ETH’s Glamsterdam fork, ‘Steal My Bitcoin’ site: Hodler’s Digest

Similar to the Hugging Face hack, Ethereum researchers have set up an AI Agent message board to help rescue the Glamsterdam fork. ‘Steal My Bitcoin’ site successfully hacked. The second and final testnet for Ethereum’s Glamsterdam hard fork was cancelled this week, after ChainSecurity found vulnerabilities in two gas scaling Ethereum Improvement Proposals that could have spelled big trouble for at least 13 DeFi contracts. The bugs were connected to EIP-8037/8038 and resulted in contracts, that rely on the way gas currently behaves, breaking when a call runs out of gas. It’s all fairly technical and complicated, but the upshot is that an attacker may have been able to exploit the resulting vulnerabilities. The hard fork testnet dress rehearsal on Hoodi is not expected to be rescheduled until all the second order effects of the fork have been gamed out properly. In an article on X today, Derek Chiang from >Ethlabs noted the issues were found very late in the process, which is less than ideal, “causing everyone to scramble to deal with the fallout.” Chiang says two researchers from Ethlabs and the Ethereum Foundation had independently spun up a bunch of AI Agents to scan contracts for vulnerabilities. When they realized they were both employing the same strategy they “set up a message board for their agents in the form of a github repo” to coordinate the work. He noted the similarities to the OpenAI <> Hugging Face hack where rogue agents had set up a message board to coordinate the attacks. “Well, turns out the same pattern is useful for the good agents too,” he said. The exercise has been so successful at finding potential problems that a second board has been set up to examine the effects of EIP-8198, aka “Quick Slots”, which has been proposed for the subsequent Hegota hard fork. Updated October 26 12.10am UTC with the result of the challenge. A website that challenged users to “Steal My Bitcoin” by exploiting unpatched PHP2Shell vulnerabilities, was successfully hacked within the space of a day. The site owner hid the key to a Bitcoin wallet worth around $2000 which was accessible to the PHP user account through a binary called print-flag. Source: StealMyBitcoin The site generated a huge amount of interest and went offline periodically offline due to heavy traffic and probing attempts.

It was >solved by KillerBoi who successfully extracted the private key — however in a plot twist, the key could not access the wallet address shown on the site. Challenge organizer

📌 Recommended Exchanges

OKX | Binance | Bybit | Bitget | Gate.io