Hacktron AI says it managed to hack OpenAI in less than 72 hours. The security research team revealed that it chained two separate vulnerabilities to gain access to ChatGPT and Codex accounts belonging to OpenAI employees. To prove the access was real, the researchers used an employee’s Codex account to open a harmless pull request in OpenAI’s internal monorepo rather than accessing sensitive code. The entire attack started with something that sounds relatively harmless: uploading an image.

Hacktron shared the details in a technical write-up on September 13, while also summarizing the exploit chain on X.

According to the researchers, the chain looked like this:

• HEIF upload → libheif heap overflow → remote code execution → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal repository

Key Takeaways

• Hacktron AI says it compromised OpenAI systems in less than 72 hours.
• The attack began with a HEIF image upload and a vulnerability in libheif.
• An OpenAI SSO flaw allegedly allowed the researchers to move from the compromised forum to employee ChatGPT and Codex accounts.
• A connected GitHub integration provided a path to demonstrate access to OpenAI’s internal repository.
• OpenAI says it fixed its side of the issue about 14 hours after the report and later paid Hacktron a $6,500 bounty.
• The research highlights how AI can accelerate vulnerability research and exploit development, although Hacktron says human guidance was still necessary.

The Hack Started With a Heif Image

Hacktron was looking at the image-upload system used by OpenAI’s community forum, which runs on Discourse. The researchers noticed that HEIC and HEIF images were processed differently from other image formats. Because Discourse’s usual image-checking tool did not support HEIF, those files were passed to ImageMagick for conversion.

That meant the uploaded files eventually reached libheif, an image-processing library responsible for handling the format. Hacktron then discovered a heap buffer overflow in the version of libheif used by the environment.

According to the team, some security fixes had not been backported to the Debian package. This left the library vulnerable to a memory corruption attack that could provide out-of-bounds read and write capabilities. In other words, a specially crafted image could become much more than just an image.

AI Helped Turn the Bug Into an Exploit

This is where the story gets particularly interesting. Hacktron says it used AI models to help investigate and exploit the vulnerability.

The researchers initially worked with Claude Opus 4.8, asking it to examine the installed libheif package for potential security problems. The model helped identify the relevant vulnerability, but getting a reliable exploit working proved difficult when ASLR was enabled.

Then Anthropic released Claude Opus 5. Hacktron says the new model was able to produce a working ARM64 exploit within about three hours. The researchers then had it adapt the exploit to the x86-64 environment and the jemalloc configuration used by Discourse.

By the morning of July 25, the team says it had confirmed remote code execution through an image upload. And that was only the beginning.

The Openai SSO Flaw Changed Everything

Getting code execution on the forum wasn’t enough to reach OpenAI employee accounts. Hacktron discovered that the forum supported “Sign in with OpenAI” through OpenAI’s authentication infrastructure at auth.openai.com. The researchers believed this SSO setup could provide a route from a compromised forum account into other OpenAI services.

According to Hacktron, they were able to confirm that assumption. The researchers said they took over an OpenAI employee’s ChatGPT and Codex accounts. That employee’s Codex account was connected to OpenAI’s GitHub organization.

Rather than digging through OpenAI’s internal source code, Hacktron used the compromised Codex account to create a pull request in OpenAI’s internal monorepo. The team described the pull request as a harmless proof of concept and stopped testing after demonstrating the access.

OpenAI Fixed the Issue Within Hours

Hacktron reported its findings to OpenAI through the Bugcrowd bug bounty program on July 25. According to the team’s timeline, OpenAI confirmed that its side of the issue had been fixed at around 22:49 UTC, roughly 14 hours after the initial report.

The researchers also reported the underlying Discourse vulnerability to Discourse through HackerOne. Discourse responded the next day and had a fix ready by July 27. The company also added sandboxing for ImageMagick as an additional security measure.

OpenAI later awarded Hacktron a $6,500 bounty for the OpenAI-side vulnerability. OpenAI clarified that testing against the Discourse-hosted community forum was outside the scope of its bug bounty program.

The Bigger Concern Is AI-Assisted Hacking

For Hacktron, this wasn’t just another vulnerability disclosure. The researchers say the experiment shows how AI is changing the amount of time and expertise required to turn vulnerabilities into working exploits.

Hacktron said the OpenAI and Discourse attack took a few days for an AI agent and only a few hours of human effort. Its broader HEIF Heist research reportedly involved three researchers and cost less than $3,000 in AI tokens.

The team is careful to point out that the process wasn’t completely autonomous. Human researchers still provided guidance and made important decisions during the operation. Still, the speed is notable. Hacktron argues that tasks that once required highly specialized security expertise and significant amounts of time can increasingly be accelerated by AI.

The incident also shows why vulnerabilities in seemingly ordinary software can have much wider consequences when that software is connected to authentication systems and other services.

North Korea linked hacking group WaterPlum has compromised more than 30,000 devices across over 100 countries and regions, stealing information from more than 7,000 cryptocurrency wallets while targeting developers through fake recruitment campaigns.

Japan’s National Police Agency said on Sept. 18 that its investigation, conducted with the National Cybersecurity Office, the FBI, the U.S. Department of Defense Cyber Crime Center and agencies in Australia and Germany, uncovered the group’s attack methods and links to North Korean IT workers.

Japanese and U.S. authorities assessed that WaterPlum, which is associated with the threat activity commonly known as Contagious Interview, and some North Korean IT workers operate under Bureau 313 of the Workers’ Party of Korea’s Munitions Industry Department.

Investigators found that more than 30,000 computers were likely infected between around December 2025 and July 2026. The victims were spread across more than 100 countries and regions, including Japan, with web designers, engineers and people working in crypto, blockchain and Web3 among the main targets.

More than 7,000 cryptocurrency wallet records were stolen during the infections, while wallets controlled by WaterPlum received at least 1.7 billion yen, equivalent to roughly $10.7 million based on the exchange rate used by Japanese authorities.

Japan’s Foreign Ministry separately confirmed that authorities from Japan, the United States, Australia and Germany had jointly disclosed WaterPlum’s tactics and the activities of North Korean IT workers involved in foreign currency generation and recruitment schemes.

WaterPlum used fake crypto jobs to spread malware

WaterPlum approached software developers and other IT workers through social media, online job sites, gig platforms and freelance marketplaces, according to the Japanese police report. The attackers posed as legitimate artificial intelligence, cryptocurrency and NFT companies or recruitment services before presenting candidates with apparently attractive job opportunities.

During technical interviews or coding tests, candidates were instructed to download malicious programs hosted on collaborative development platforms and code repositories. Some victims were told that the files were needed to diagnose problems with video conferencing software or complete a coding assignment.

The group placed malware including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle inside malicious NPM packages. Once a device was compromised, attackers could establish backdoors and use remote access tools to retain access and move through affected systems. Information stealing malware was then used to extract confidential data and cryptocurrency.

Stolen information included browser credentials, keystrokes, screenshots and clipboard data. Private keys and seed phrases for cryptocurrency wallets were among the targeted records, along with identity documents such as passports and driver’s licenses stored on affected computers or shared folders.

Security researchers have documented similar recruitment methods in the crypto industry. As crypto.news previously reported,North Korean linked developers had worked inside more than 40 DeFi projects over seven years, according to MetaMask developer and security researcher Taylor Monahan. Investigators described job postings, emails, LinkedIn messages, Zoom calls and interview processes as recurring routes used to approach targets.

North Korean IT workers used laptop farms in Japan

Japanese investigators said they dismantled the first known domestic “laptop farm” connected to North Korean IT workers in the country. Under the arrangement, a local facilitator kept computers at their residence while workers remotely controlled the machines from elsewhere.

Workers used identity documents supplied by people living in Japan to impersonate them while seeking contracts. In some cases, payments were directed into bank accounts controlled by facilitators, who then transferred the money onward. North Korean workers connected to the investigations sent cryptocurrency and other assets worth hundreds of millions of yen overseas, according to the agency.

Some workers operated from North Korea, while others were based in China or Russia, with smaller numbers located in Africa and Southeast Asia. Laptop farms and virtual private servers allowed them to disguise where the work was actually being performed while accepting jobs through domestic and overseas crowdsourcing services.

Comparable operations have been prosecuted in the United States. Two U.S. men received 18 month prison sentences in 2026 for helping North Korean workers remotely access company laptops, while the Justice Department said the schemes involved nearly 70 companies and generated more than $1.2 million. The sentences brought the number of laptop farm facilitators sentenced in the United States over a five month period to eight.

U.S. authorities have pursued the proceeds of the employment schemes through cryptocurrency forfeiture cases as well. A federal judge in September ordered the forfeiture of roughly $212,700 in USDC and USDT traced to payment addresses used by North Korean IT workers, part of a Justice Department effort involving more than $7.74 million in digital assets.

Prosecutors said the forfeited wallet had received around 158,123 USDC from at least 10 addresses used to pay workers and 54,574 USDT from at least four other payment addresses. Authorities alleged that workers concealed their identities and locations while taking overseas technology jobs before routing their earnings through cryptocurrency.

bitFlyer caught suspected North Korean applicant

Japan’s investigation identified a separate attempt by a suspected North Korean IT worker to secure an engineering position at cryptocurrency exchange bitFlyer in May 2025.

The applicant submitted a resume under another person’s identity directly through the exchange’s recruitment form and used Gmail as the contact address. Investigators said the person accessed the application system through VPN and proxy services including NETNUT Proxy, Astrill VPN and High Speed Rabbit Proxy.

During an online interview, the applicant claimed to be Malaysian and living in Finland. The resume listed extensive experience across programming languages, blockchain, cryptocurrency and cloud services, along with education at a European university and employment in several European and Asian cities.

The applicant could answer simple questions about the listed skills but gave abstract responses or avoided more detailed questions, according to the agency. Investigators noted repeated checks of another monitor during the interview, occasional voices in the background and interruptions to the video feed. The person resisted relocating to Japan and insisted on receiving salary in cryptocurrency. bitFlyer identified the suspicious behavior and did not hire the applicant, and no damage was reported.

A similar recruitment attempt had previously been detected at Kraken, where an applicant suspected of links to North Korea joined an interview using a name different from the one on the resume and appeared to receive real time assistance during the call. The exchange later connected the applicant’s email address with information previously flagged by industry partners.

Investigators tied WaterPlum activity to the same infrastructure

Japanese authorities found a technical connection between the WaterPlum attacks, the overseas worker operations and the attempted bitFlyer recruitment.

IP addresses used by WaterPlum attackers matched addresses used by North Korean IT workers to connect to laptop farms and crowdsourcing services, according to the National Police Agency. Investigators found that the suspected North Korean worker who applied for the bitFlyer engineering position had used matching infrastructure.

The National Police Agency and FBI assessed that Bureau 313 played a central role in both WaterPlum’s cyberattacks and some of the foreign currency earning operations carried out by North Korean IT workers.

Japanese authorities advised companies to verify applicants’ claimed locations, qualifications and contact information, particularly when candidates insist on remote work or cryptocurrency payments. Employers were urged to check technical skills during interviews and scrutinize cases where a candidate’s stated residence does not correspond with the location of the IP address used to submit an application.

Bitcoin’s longer-term price structure is starting to look more stable, with analyst Willy Woo pointing to a well-known technical setup that historically has aligned with major bear-market endings. Woo argues that Bitcoin’s latest monthly “Fisher Transform” signal marks a new phase of trend reversal—though he also cautions that clean bottoms are not guaranteed and some consolidation is still possible.

Writing in a Friday update on X, Woo highlighted that the Fisher Transform indicator produced a monthly bullish crossover in August—only the fourth time this has happened in Bitcoin’s history—suggesting the market may have already formed its next macro floor.

Key takeaways

• Willy Woo says Bitcoin’s Fisher Transform produced a monthly bullish crossover in August—only the fourth such event on record.
• Woo links prior monthly crossovers to bear-market bottoms, citing late 2022 as an example when the indicator reached about -3.83.
• A weekly bullish divergence in Fisher continues to develop, echoing the pattern seen during the final six months of Bitcoin’s 2022 bear market.
• Woo notes the signal tends to be more reliable near bear-market bottoms because speculative churn is typically lower than during bull phases.

Why the Fisher Transform matters for market timing

Woo used the Fisher Transform, a trend-strength indicator developed in 2002, to assess whether Bitcoin’s broader trajectory has shifted. The Fisher Transform works by smoothing price action into a form that is easier to interpret as trend conditions change.

The method applies a log-based transform to correct for the way raw price tends to linger near extreme values. In practice, the Fisher Transform is plotted as two lines: the Fisher line and a trigger line derived from it, delayed by one period. Both lines oscillate around a central zero line, with crossovers between the Fisher and trigger lines typically interpreted as a signal of regime change.

According to Woo, when these two trend lines cross upward on monthly time frames, the occurrence has repeatedly coincided with bear-market bottoms—events that historically precede larger macro uptrends.

August’s monthly crossover: “3 for 3” with a fourth added

In Woo’s read-through, the key development is the timing and frequency of Bitcoin’s monthly Fisher bullish crossover. He states that a sharp upward reversal—where the Fisher and trigger lines intersect—has matched bear-market bottoming phases on monthly charts, and that the latest August cross appears to extend this track record.

Woo specifically points to the crossover occurring during July at around -2.26 on the Fisher Transform scale, stating that it would represent the fourth recorded bullish monthly crossover if it plays out as history suggests. He also frames the pattern as “3 for 3 without fake out,” before adding the newest event as a potential extension rather than a one-off.

Importantly, Woo does not claim that the crossover automatically prevents additional volatility. He notes that even when the indicator turns, price can still consolidate and potentially test lower levels before a more durable macro advance takes hold. He compares this to other cycles where Fisher showed a bearish crossover during bull markets—followed later by a fresh bullish signal—implying that the macro signal can precede full directional confirmation.

Bear-market signals may be “cleaner” than bull-market ones

Woo’s reasoning goes beyond chart math. He argues that the reliability of the Fisher Transform’s reversal timing depends on market participants. In his view, long-term bull phases often include more speculative activity—traders reacting aggressively to short-term swings—creating choppier conditions and increasing the odds of “fake out” signals.

By contrast, in bear-market bottom zones, he says speculative participation is largely reduced. When buy pressure returns because value buyers step in, the price reversal becomes less noisy, which can make trend signals such as Fisher crossovers easier to interpret.

That distinction is central to how Woo frames the current setup: even if the indicator has turned, investors should still expect that a bottom can involve time-consuming stabilization rather than an immediate straight-line recovery.

Weekly bullish divergence mirrors 2022’s late-stage pattern

Alongside the monthly crossover, Woo also emphasized a bullish divergence developing on weekly time frames. In this setup, Fisher continues to form higher lows while Bitcoin’s price prints lower lows—an often-cited sign that downward momentum is weakening even as the market remains trapped in a drawdown.

Woo says Fisher hit a swing low near -2.85 at the end of December last year, when BTC/USD was around the $90,000 area. Since then, he reports that Fisher has produced a series of higher lows while price has not followed suit. The divergence matters because it suggests deterioration in selling pressure may be occurring underneath the surface.

Critically, Woo links this current divergence structure to what was seen during Bitcoin’s 2022 bear market. He notes that a similar Fisher bullish divergence appeared as the prior bear market moved into its final months—then proceeded to coincide with the eventual transition out of the downtrend.

What remains uncertain: July’s $57,000 area and buyer behavior

Even with the technical backdrop improving, Woo and other onchain-driven observations leave room for doubt. The article points to ongoing uncertainty about whether recent lows near $57,000 on July 1 truly marked a full cycle bottom. Earlier onchain analysis referenced in the coverage suggested that while some metrics have produced bear-market reversal signals, there may not yet be consistent confirmation from traditional “buyer interest” behavior.

Woo himself previously flagged a “lack of typical buyer interest” at those lows, arguing that accumulation appeared dominated by a smaller set of large-volume investors rather than broad-based demand. That matters for how traders interpret reversals: a market can bounce on limited buying, but more durable cycle transitions usually require sustained participation across the market.

For now, the key question is whether the monthly Fisher crossover will translate into a macro uptrend rather than only a temporary turn. Readers should watch whether Fisher continues to confirm on higher time frames and whether price action starts to align with the divergence signals on weekly charts—especially if Bitcoin tests deeper support before any sustained break higher.

Banks are rapidly expanding their presence in Europe’s regulated crypto market, with traditional lenders now accounting for nearly one in four providers listed under the European Union’s Markets in Crypto-Assets framework (MiCA).

The number of banks on the EU’s MiCA crypto provider list doubled to about 80 from roughly 40 between June 26 and Sept. 16, according to a Cointelegraph analysis of MiCA register data from the European Securities and Markets Authority (ESMA).

The overall number of listed crypto-asset service providers (CASPs) rose from 243 to 349 over the period, but non-bank providers lost ground in relative terms, with their share falling from about 84% to 77%.

While non-bank providers still dominate the register and grew in absolute numbers, banks expanded much faster, increasing their share from around 17% in late June to nearly 23% in September.

German banks pile into crypto

Germany drove much of the banking expansion, with dozens of cooperative and commercial banks appearing on ESMA’s MiCA register.

New names include Deutsche Bank, Germany’s largest lender, which on Wednesday announced plans to launch digital asset custody services for institutional and corporate clients in Europe. A Deutsche Bank spokesperson told Cointelegraph that the bank expects to receive regulatory approval for the offering under MiCA in October.

Related: Binance brushes off Lagarde MiCA speculation, reaffirms Europe commitment

The trend extends beyond Europe’s biggest banking groups. Germany’s additions include numerous Volksbank, Raiffeisenbank and VR Bank institutions, showing that regulated crypto services are spreading into the country’s regional cooperative banking network rather than remaining limited to large international banks.

Banks have a different route into MiCA

Unlike crypto companies that must apply for CASP authorization, banks can provide crypto services under MiCA through a separate notification procedure.

Under Article 60 of MiCA, a credit institution may provide crypto-asset services if it submits the required information to its home regulator at least 40 working days before providing those services for the first time.

The notification route gives banks a way to expand into crypto without going through the standard CASP authorization process.

Magazine: Is there any chance left to save the CLARITY Act?

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Crypto’s post-Fed hike bid extended into Friday, with decentralized finance (DeFi) and layer-2 tokens taking over from privacy and haven assets that led Thursday’s gains, a rotation that demonstrates a return to risk-on trading.

Bitcoin rose above $78,000 during the European morning, adding 2.1% since midnght UTC and 1.9% over the past 24 hours. It’s still 5% below the Sept. 4 monthly high of $82,284 after two weeks of range-bound price action.

While all but two CoinDesk 100 constituents were higher on the day, the focus is on the DeFi Select Index (DFX). That accelerated the fastest, surging by 8.3% since midnight and 16% over the past 24 hours.

Market gains follow a more conducive macro backdrop. The 10-year Treasury yield slipped back under 5% and Brent crude eased below $103 after trading as high as $109 earlier in the week, taking some of the heat out of the inflation scare that followed the rate increase.

Equity index futures also showed strength, with S&P 500 and Nasdaq 100 futures rising 0.3% and 0.6%, respectively, while gold and silver added 1.1% and 2.8% apiece.

Derivative positioning

• Futures market signals positional trading revival: The crypto futures market is signaling a revival in positional trading. This shift is underscored by a nearly 5% expansion in cumulative open interest (OI) to $141.2 billion, which contrasts with a 3% dip in daily trading volume to $95 billion. The taker buy-sell volume remains balanced, suggesting capital is entering the market structurally rather than through aggressive momentum chasing.
• Bitcoin open interest builds as the price gains: OI in bitcoin futures ticked up to 680K BTC from 670K BTC since midnight UTC, a slight increase alongside BTC’s advance. This combination is typically taken to represent a build-up of long, or bullish, positions. However, the increase is quite small, and the OI tally remains well below the peak of 800K BTC hit early this year. In other words, overall positioning remains light.
• Binance trader ratios show institutional conviction: Binance’s top trader long-short accounts ratio has pulled back to 1.52, still bullish, but lower than Wednesday’s high of nearly 2. Meanwhile, the long-short positions ratio remains elevated at 2.36. That means fewer individual “whales,” or large holders, are leaning long, but the ones who are have greatly increased their bet sizes, indicating strong institutional conviction.
• UNI futures open interest surges to near record: Among altcoins, open interest (OI) in futures tied to Uniswap’s UNI surged to 86.61 million tokens — flirting with an all-time high, up from 76.89 million tokens yesterday. This expansion highlights substantial capital inflows, which are moving in tandem with a 30% explosion in the token’s spot price. This renewed appetite for major DeFi altcoins stems from mounting market optimism surrounding friendly, coordinated crypto regulations from the SEC and CFTC.
• Bullish momentum dominates major tokens’ volume delta: The bullish mood is also reflected in the 24-hour OI-adjusted cumulative volume delta, which is positive for most major tokens, excluding GRAM, SHIB, HBAR and BNB. A positive reading means bulls are being more aggressive by trading longs at market orders rather than passive limit orders.
• Implied volatility drops to May’s lows: With major events such as the Clarity Act vote, and the Fed and Bank of Japan interest-rate meetings out of the way, bitcoin’s annualized 30-day implied volatility index, BVIV, dropped to 36%. That level has been a floor since May. The decline points to expectations for near-term market calm.
• Options skew turns short-term bullish for BTC and ETH: In options listed on Deribit, BTC’s one-week put-call skew has turned positive, pointing to relative richness of calls, or bullish bets, over puts. However, one- and two-month skews still show a slight put bias. ETH’s one-week skew also shows bullishness. The 24-hour volume rankings, however, show a mixed sentiment, with both BTC call and puts featuring in the most active list.

Token talk

• The DeFi Select Index’s advance on Friday rested largely on uniswap (UNI), up 13% since midnight UTC and 25% over the past 24 hours, with ethena (ENA) gaining 9.6% and liquid-staking token lido adding 6.6%.
• Layer-2 tokens matched DeFi’s strength, led by starknet STRK$71.83 at 18% on the day and 21% over 24 hours, with arbitrum up 17% and 25%, stacks up 9.2% and optimism up 8.9%. STRK is now at its highest since June 19 while ARB, at 20.9 cents, hasn’t been this pricey since January.
• Solana (SOL) added 4.5% to $106.14, but the sharper move sat in its ecosystem, where solana-based DEX token raydium rose 16% to $1.71 and liquid-staking token jito lagged at 1.6%, a split that points at DEX volume rather than a blanket bid for the chain.
• Thursday’s leader stalled. Zcash (ZEC) traded at $1,490.10 for a gain of 1.6% on the day against 7.6% over 24 hours, meaning almost all of the advance took place on Thursday. Rival privacy token dash was one of only two CoinDesk 100 constituents in the red, losing 0.53%, alongside world liberty financial , which fell 0.31%.
• CoinMarketCap’s “Altcoin Season” index is now at 44/100 have risen from Tuesday’s low of 32/100, a sign that speculation is the overarching theme on Friday.

Public blockchains create a privacy problem. Paying from a visible address can expose its balance, previous transactions and links to other addresses. A shielded Zcash payment hides the sender, recipient and amount from the public record, allowing a customer to pay without handing the merchant or anyone watching the blockchain a searchable trail into their finances.

Zcash block times

Blocks are batches of transactions that miners add to a blockchain, and a payment receives its first confirmation when it appears in one. Cutting Zcash’s target block time would let an exchange or bridge that waits for a fixed number of confirmations release ZEC in about one-third the time.

At a shop counter, it would still be slower than tapping a card, but the shorter wait makes a direct private payment more practical, in the view of Zcash’s developers.

Producing three times as many blocks would not create three times as much ZEC, however. The proposal divides the reward paid with each block by three and extends the halving interval from 1.68 million blocks to 5.04 million, leaving issuance over time largely unchanged.

NU7 would also introduce Zcash’s Network Sustainability Mechanism.

Roughly 60% of transaction fees would be temporarily removed from circulation, rather than paid to miners, under ZIP-235. Those coins are intended to return through block rewards beginning in February 2031, adding to miner income as Zcash’s regular issuance falls through successive halvings.

Ethereum-related non-profit Ethereum Institutional has publicly backed Ethlabs’ push to make the network faster by reducing block times. In a Friday post on X, the group argued that shorter blocks will help Ethereum keep up as more institutional activity continues to move on-chain.

The proposal at the center of the debate is EIP-8198, also referred to by supporters as “Quick Slots.” Ethlabs says it is working to align the proposal’s specifications with Ethereum’s main codebase and assess downstream dependencies so the change can fit into the upcoming Hegotá upgrade cycle.

Key takeaways

• Ethereum Institutional backed EIP-8198’s “Quick Slots” concept, citing growing on-chain institutional usage.
• EIP-8198 targets reducing Ethereum block times from 12 seconds to an initial 10 seconds.
• Ethlabs says it is merging the proposal into the main codebase and investigating dependencies to qualify for Hegotá.
• Other networks—such as Zcash and Solana—have already moved toward faster block/slot timing, highlighting competitive pressure.

Why EIP-8198 is back in the spotlight

Ethlabs’ effort focuses on a straightforward performance lever: reduce the time between Ethereum blocks. Ethereum Institutional’s support reinforces that framing. According to the organization’s X post, the motivation is not only technical improvement but also timing relevance—“more institutional activity moves onchain,” and therefore the network’s responsiveness matters.

Support for the change is also being presented as broad-based within DeFi. Ethlabs published an article quoting 20 decentralized finance founders who said they support EIP-8198. Their message is consistent with the idea that faster block production can improve the user experience and potentially reduce the friction created by slower transaction finality dynamics.

The next question for investors and ecosystem participants is what “faster” means in practice. EIP-8198’s specific initial target is to bring Ethereum’s block time down to 10 seconds from 12 seconds. That is a measurable shift, but whether it materially changes higher-level outcomes—such as execution quality, latency-sensitive trading, or DeFi responsiveness—will depend on implementation details and how other protocol components behave alongside block timing.

From proposal to Hegotá: what Ethlabs says it is doing

EIP-8198 was authored in March and was proposed for inclusion in the Hegotá upgrade at an Ethereum core developers meeting on Aug. 6. The proposal is now associated with a concrete implementation pathway through Ethlabs’ work.

Ethlabs stated that it is merging the proposal’s specifications with Ethereum’s main codebase and investigating potential downstream dependencies. That wording matters: reducing block times is not simply a parameter change. Dependencies can include how other parts of the client and protocol schedule operate, which can affect performance stability and compatibility as the network approaches Hegotá.

If everything aligns, Ethereum developers could begin implementing Hegotá in late 2026 after Glamsterdam. While the exact sequencing and final scope of any upgrade always depend on ongoing engineering review, the timeline provides a framework for how quickly stakeholders may see this debate translate into code.

A broader industry trend: faster slots and blocks

Ethereum’s push is happening amid comparable efforts across other networks. The motivation is widely shared: lower timing intervals can improve latency and confirmation speeds, which tends to matter for both retail users and institutions that require more predictable execution.

On Monday, Cointelegraph previously reported that the majority of Zcash token holders backed a move to cut the network’s target block time to 25 seconds, down from 75 seconds. In August, Cointelegraph noted that Solana reduced its slot time from 400 milliseconds to 350 milliseconds. Earlier, in June, the Solana Foundation shared plans to reduce slot times further—from 400 ms to 200 ms—arguing that this change would improve latency and accelerate confirmations.

These initiatives illustrate a market-wide dynamic: networks are competing not only on features, but on how quickly users can get from submission to confirmation. For Ethereum, which often emphasizes long-term stability and careful upgrade coordination, the question is how to deliver speed without undermining reliability.

What to watch as implementation approaches

Support from Ethereum Institutional and DeFi founders may help generate ecosystem momentum, but the timeline still hinges on engineering. Readers should focus on whether Ethlabs’ dependency work confirms the path to inclusion in Hegotá, and whether implementation begins in late 2026 as expected after Glamsterdam.

As the industry continues to compress block and slot timing, Ethereum’s next milestone will be translating EIP-8198 from advocacy into dependable client behavior—where the benefits of “Quick Slots” can be measured against any trade-offs that emerge during testing and upgrade planning.

“We are actively working toward becoming MiCA-authorised and view this as an important step in providing users with a consistent, regulated, and trusted service across the European market,” the spokesperson said.

Binance withdrew its Greek application in mid-June and began winding down operations after officials at the Hellenic Capital Market Commission (HCMC) decided not to approve Binance’s MiCA license request at the last minute.

Gillian Lynch, Binance’s head of Europe, told CoinDesk in early July that the exchange had met all of the HCMC’s requirements.

“We were deemed to have a complete application,” Lynch said. “Nothing was missing, nothing material was outstanding.”

The WSJ also reported ESMA privately advised national financial regulators to reject Binance’s MiCA applications over concerns with the exchange’s past compliance issues.

Changpeng “CZ” Zhao, the founder of Binance, pleaded guilty in the U.S. in 2023 to violating the Bank Secrecy Act (BSA) and agreed to pay $4.3 billion in fines. He served a four-month prison sentence in California in 2024 and was pardoned by President Donald Trump in October 2025.

An ECB spokesperson declined to comment when contacted by CoinDesk. The ECB has no institutional role in authorizing crypto-asset service providers (CASPs), they said. That remains the jurisdiction of national competent authorities, in this case, the Hellenic Capital Market Commission (HCMC).

Predictive-policing is wrong, but it stems from the long-time surveillance of the American people. It is these various surveillance mechanisms that have empowered the state to target anyone for anything, even before they commit a crime — if they were going to commit a crime at all. Thus, DHS should end PITT’s use of financial information and other data for predictive-policing. Congress should direct the Government Accountability Office (GAO) to independently audit the DHS’s data sources, targeting criteria, retention practices, false-positive rates, and information-sharing, and assess the program’s compliance with the Fourth Amendment and other applicable laws. The GAO should be required to publish its findings for further action.

Congress must ensure that federal agencies cannot circumvent any Fourth Amendment protections by using secret profiles to manufacture suspicion. Judicial authorization should be required before the DHS can use sensitive financial records in an investigation of a specific suspected crime, and full disclosure whenever federal data analysis triggers a traffic stop.

Surveillance places all of us at the judgment and mercy of the state, where our activities, associations, or beliefs can easily be deemed criminal — or potentially criminal — and we have no way of defending ourselves. This is deeply un-American. The state should not be leveraging information to decide whether or not you may be a criminal and then tipping local law enforcement based on their judgment. The American people should be free to live authentically and with dignity without fear of wrongful prosecution. It is within our constitutional rights, and it is time the federal government be reminded of the