AI Agents Rescue ETH’s Glamsterdam Fork, ‘Steal My Bitcoin’ Site: Hodler’s Digest
Ecosystem
- English
- News
- Markets
- Features
- Research
- Opinion
- Podcasts
- Newsletters
- Commissioned
- About
Cryptocurrency Prices
- DOGE: $0.07690 (+0.03%)
- TRX: $0.3302 (+0.47%)
- LINK: $11.39 (+0.12%)
- ZEC: $1,206.91 (+0.75%)
- ADA: $0.2030 (+1.07%)
- XRP: $1.28 (+0.89%)
- ETH: $2,318.22 (+1.25%)
- BTC: $80,048.55 (+0.63%)
- XMR: $588.41 (+3.27%)
- BNB: $740.25 (+0.46%)
- XLM: $0.1686 (+0.75%)
- SOL: $101.02 (+0.67%)
- HYPE: $76.49 (+0.51%)
Article Content
Ethereum researchers have, similar to the Hugging Face hack, established an AI Agent message board to aid in the rescue of the Glamsterdam fork's second and final testnet, canceled due to vulnerabilities in EIP-8037/8038 discovered by ChainSecurity. These bugs could have compromised 13 DeFi contracts.
The message board was initiated by researchers from Ethlabs and the Ethereum Foundation who used AI Agents to scan contracts for vulnerabilities. Inspired by the OpenAI <> Hugging Face hack, they created a GitHub repo for their agents to coordinate efforts.
Meanwhile, a website challenging users to "Steal My Bitcoin" by exploiting unpatched PHP2Shell vulnerabilities was successfully hacked within a day. The site's owner hid a Bitcoin wallet key accessible through a binary called print-flag. High traffic and probing attempts caused the site to go offline periodically. The key was extracted by KillerBoi, though it couldn't access the displayed wallet address, leading to a correction by challenge organizer James Pavur.
Mark Maunder from WordFence commended the hack, noting the difficulty of exploiting #php2shell:
"This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass ASLR, reverse engineer PHP’s internal memory structures, forge structures to hijack execution, and account for PHP."