Glamsterdam raised its block gas limit from 60 million to 200 million about an hour after going live on the testnet. Gas measures the computing work required by transactions, so the higher ceiling creates room for more payments, token swaps and other activity in each block.

How that helps Ethereum

A 200 million limit would let Ethereum absorb more activity before users begin outbidding one another for block space, which could make fee spikes less severe when trading surges or a popular token launch clogs the network.

Larger blocks are also harder to check and could leave smaller operators unable to keep up. Glamsterdam is Ethereum’s attempt to gain that extra capacity without making the chain prohibitively expensive to run.

Specialized builders package transactions, while validators check the resulting blocks and secure the chain. Glamsterdam would place that handoff and the accompanying payments inside Ethereum’s own rules, reducing dependence on outside relay services.

The change also extends the time available to spread block data across the network from about two seconds to nine seconds. That gives validators longer to receive and check the larger blocks Glamsterdam is designed to support.

As such, the 200 million limit remains a test setting rather than a commitment for Ethereum’s main network. Devnet-11 was also designed as a controlled rehearsal without deliberate attacks.

State-linked hackers are increasingly using public blockchains as a durable way to “dead drop” malware instructions and infrastructure details, according to a Chainalysis report cited by Cointelegraph. The firm estimates that roughly two-thirds of new quarterly activity involving these techniques is tied to state-aligned operators, while the frequency of such “dead drop” writes has surged dramatically over the past year.

Chainalysis reports that the number of times attackers stored malware-related payload information on public chains rose 420% in the last 12 months. It also highlights cases involving North Korea- and Iran-linked groups, showing how encoded blockchain data can outlast takedowns of domains, servers, or code repositories.

Key takeaways

• Chainalysis attributes about two-thirds of new dead drop blockchain activity per quarter to state-linked threat actors.
• Dead drop payload writes across public blockchains increased 420% year over year, signaling faster scaling of these tactics.
• Chainalysis linked previously unattributed activity across Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.
• Chainalysis also recorded a 440% rise in malicious blockchain writes since July 2025, coinciding with the emergence of higher-capacity open-source AI models.
• Iran-linked actors are suspected to have used Bitcoin to publish encoded command-and-control routing data that infected devices can periodically check.

More “dead drop” payloads on-chain

Chainalysis frames the technique as a way to make malware campaigns harder to disrupt. Instead of relying on websites, domains, or code hosts that can be seized or shut down, attackers encode instructions and infrastructure pointers directly into transactions on public blockchains. The information persists because blockchain data remains accessible even if off-chain components are removed.

In practical terms, the approach improves campaign durability: malware can continue operating as long as it can retrieve updated instructions from the blockchain. Chainalysis notes that in 2025, North Korean hackers used a similar concept—called EtherHiding—to conceal crypto-stealing code inside smart contracts.

North Korea-linked routing across multiple chains

One of Chainalysis’ detailed findings connects activity that previously lacked clear attribution across Tron, Aptos, and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.

Chainalysis reports that encoded pointers embedded in Tron and Aptos transactions directed compromised devices to the same BSC transaction. In the workflow described, Tron functioned as an initial route, while Aptos served as a fallback if the first path did not work as intended.

The BSC transaction, according to Chainalysis, included encrypted server addresses and configuration data. Those encrypted details tied infected devices to off-chain infrastructure used for remote access and data theft—meaning the blockchain acted as the resilient “messaging layer” while the operational work moved outside the chain once instructions were retrieved.

For investors and builders, this multi-chain structure matters because it increases the surface area responders must monitor. Instead of focusing on a single chain or a single contract address type, defenders may need to track how attackers chain together multiple networks to improve reliability.

AI tools may be boosting malicious on-chain output

Chainalysis also links a surge in harmful blockchain behavior to developments in AI capabilities. The firm recorded a 440% increase in malicious blockchain writes since July 2025, a period it associates with when high-capacity open-source Chinese AI models became capable of producing malicious code with limited safeguards.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that the company found a “clear point-in-time association.” However, he emphasized that Chainalysis could not definitively prove that the actors responsible for the malicious transactions and contracts were specifically using those models to increase output.

This distinction is important. The data indicates timing alignment, but causality remains unconfirmed. Readers should treat the finding as an early warning about how quickly automated code generation tools could lower the cost of producing and deploying blockchain-based malware—without assuming a direct “AI used” attribution for every case.

Iran-linked actors using Bitcoin as a command channel

Beyond North Korea-linked cases, Chainalysis says it identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain.

Unlike approaches that rely on blockchain activity alone, Chainalysis states its assessment was grounded in a broader set of indicators: the malware family involved, the decoding method, timing patterns, and server infrastructure tied to previously reported Iranian operations.

Chainalysis says attacker-controlled wallets sent small payments to a widely known Bitcoin address with historical ties to Satoshi Nakamoto. The report indicates that this address has no connection to the attackers; rather, it is used as a permanent public location that infected devices could check for updated routing instructions.

According to Chainalysis, the attackers could revise their server infrastructure by publishing another Bitcoin transaction. Once the malware obtained the new instructions, the operation could shift back off-chain, enabling behaviors such as remote access, credential theft, and delivery of additional malware payloads.

From a threat-management perspective, using a familiar and long-lived Bitcoin address complicates takedowns. Even if defenders act against the obvious infrastructure, the blockchain location can remain publicly available and function as a reliable beacon for compromised devices.

Why this trend is likely to keep intensifying

As dead drop techniques spread and as malicious on-chain writes accelerate, the challenge for the ecosystem is not just spotting individual malicious transactions—it’s anticipating how attackers design fallback routes, encrypt payloads, and distribute retrieval logic across chains. The most actionable takeaway for monitoring teams is to focus on behavior patterns around payload writes and encoded routing mechanisms, rather than relying solely on domain or server takedowns.

Going forward, readers should watch whether defenders and analytics firms shift toward cross-chain correlation of encoded instruction flows, and whether future reporting can move beyond “association” to clearer evidence about how AI tooling is operationally integrated into these campaigns.

As the CLARITY Act was rejected with 49 votes in favor and 50 votes against, the bill was not advanced. With substantial outflows from spot ETFs, XRP is facing selling pressure and its price continues to decline.

Investors have reduced their investment in higher-risk assets, causing an overall decline. Against the backdrop of a sluggish cryptocurrency market, more and more XRP investors are beginning to explore cloud mining to earn passive income of up to $10,000 per day.

As U.S. Treasury yields rise, investors have reduced their investment in higher-risk assets, leading to an overall decline. The yield on 10-year U.S. Treasury bonds once exceeded 5%, significantly “increasing the opportunity cost of holding non-yielding assets, including most of the cryptocurrency market.”

At the same time, oil prices exceeding $100 per barrel, geopolitical tensions, and expectations of tighter monetary policy have all intensified pressure on risk assets. “Market volatility may remain elevated,” Masabuni pointed out, as the market faces multiple challenges from monetary policy, regulation, and geopolitical risks.

Ryan Kirkley, Co-Founder and CEO of the Global Settlement Network, also pointed out that the Senate’s failure to advance the CLARITY Act immediately put pressure on the cryptocurrency market, with crypto-related stocks such as Coinbase (Nasdaq: $COIN) and Circle (NYSE: $CRCL) facing pressure.

“The reaction from investors precisely demonstrates how much they value regulatory certainty,” Kirkley told Crypto.news, adding that institutional capital needs to know “who regulates what, how assets are classified, what intermediaries can do, and the scope of responsibilities of the U.S. Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). When the answers to these questions remain unresolved, capital must price this uncertainty into the market.”

A new choice for XRP investors: UE Crypto’s path to growing returns

Given this trend, more and more XRP investors are turning their attention to UE Crypto, exploring more stable and sustainable income models through cloud mining and income aggregation mechanisms.

Compared with more volatile futures trading or ETF investments, UE Crypto provides a more straightforward and convenient way to participate in digital assets, helping users improve the efficiency of their digital assets while participating in the development of the XRP ecosystem. For users with a certain amount of capital, this model may offer greater potential for daily returns.

Unlike highly volatile leveraged trading or strategies that rely solely on price appreciation, the Crypto cloud mining platform provides a more convenient way to participate in digital assets. Users do not need to deploy mining machines or maintain hardware; they only need to select a computing-power contract to participate in mining services. This allows them to focus on the long-term prospects of XRP while maximizing the returns of their digital assets.

About UE Crypto

UE Crypto is headquartered in the United Kingdom and operates under European regulatory frameworks such as MiCA and MiFID II, continuously improving its transparency, operational standards, and user protection mechanisms.

The platform adopts a multi-layer security architecture, including:

• Annual financial and security compliance audits conducted by PricewaterhouseCoopers (PwC);
• Digital asset custody insurance provided by Lloyd’s of London;
• Enterprise-level cybersecurity protection from Cloudflare and McAfee® security systems;
• Bank-level data encryption technology and professional security infrastructure, providing multiple layers of protection for user assets and accounts.

UE Crypto supports a variety of mainstream digital assets, including XRP, BTC, ETH, USDT, USDC, DOGE, LTC, and SOL, providing users with a more flexible and convenient digital asset service experience.

How to Join UE Crypto

With just three steps, you can easily start earning daily returns:

1. Register an account

Visit the official UE Crypto website and register using your email address to receive a $20 trial reward.

2. Choose a mining package

According to your personal budget and needs, choose a suitable cloud mining contract and start mining with one click.

3. Start earning

After the contract is activated, the system will automatically allocate computing power, and returns will be automatically settled every 24 hours. Users can withdraw their returns at any time or continue participating according to their needs, achieving long-term compound growth of their assets.

Popular UE Crypto contracts:

BTC (Super Computing System Contract)
Investment Amount: $1,000
Contract Duration: 10 days
Daily Return: $13.10
Total Return at Contract Expiration: $1,000 + $131

LTC (Algorithm-Driven System Contract)
Investment Amount: $5,000
Contract Duration: 25 days
Daily Return: $72
Total Return at Contract Expiration: $5,000 + $1,800

BTC (Quantitative Intelligent System Contract)
Investment Amount: $10,000
Contract Duration: 35 days
Daily Return: $158
Total Return at Contract Expiration: $10,000 + $5,530

For more details about the contract plans, please visit the official UE Crypto website.

Conclusion

UE Crypto was founded in 2015 and is headquartered in London, United Kingdom. It is a globally leading innovative cloud computing platform. We deeply integrate cutting-edge hardware, intelligent core algorithms, and powerful cloud infrastructure to provide global users with high-performance, cost-effective crypto asset solutions. As a pioneer in the fields of cloud computing technology and digital asset services, UE Crypto brings together a team of top experts and adheres to the core values of “green, intelligent, open, and sustainable.” UE Crypto is committed to leading the global blockchain energy revolution. Through innovative cloud computing architecture and decentralized finance (DeFi) technology, we are fully committed to promoting the development of an efficient and low-carbon computing ecosystem. We are reshaping the future of an open and shared digital economy while continuously creating long-term value for global users.

UE Crypto’s cloud mining services provide users with a low-risk alternative for long-term engagement with the digital asset ecosystem, helping investors move away from short-term market noise, focus on the long-term value of their assets, and establish a more resilient and sustainable form of passive income.

For more information, please visit the official UE Crypto website and download the application.

Solana price rose back above $100 after buyers defended the $95–$96 support zone, but technical resistance and concentrated liquidation levels near $102 could determine whether the rebound develops into a wider recovery.

Solana price rebounds from $96 support

Solana (SOL) price traded near $100.50 after recovering from a 24-hour low of $96.23, according to the daily chart. The rebound followed a sharp sell-off linked to the US Senate’s failed procedural vote on the CLARITY Act and the Federal Reserve’s 25-basis-point rate increase.

The daily chart shows that SOL briefly moved below $100 before buyers entered around the $95–$96 area. The recovery carried the price back to the Murrey Math major support and resistance pivot at $100.

Holding that pivot would improve the short-term structure following the decline from the late-August peak near $110. However, the asset has not yet cleared the lower highs formed during September, leaving its broader recovery incomplete.

Crypto analyst Ella identified $95–$96 as the level Solana needed to defend. She said SOL fell to $96.13 around the Fed decision before bouncing to $98.72 and outperforming Bitcoin and Ethereum during the initial recovery.

“Get back above it and yesterday’s damage starts to look repairable,” Ella wrote, referring to the $100 level.

The analyst warned that another loss of $96 could cause the rebound to fade quickly. SOL’s recovery above $100 therefore needs confirmation through sustained closes rather than a brief intraday move.

Momentum improves, but Supertrend remains bearish

The daily Aroon indicator favors buyers after the rebound. Aroon Up stood at 85.71%, compared with an Aroon Down reading of 21.43%. The gap suggests that a recent high carries more weight than the latest low within the indicator’s 14-day lookback period.

SOL must continue holding $100 for that momentum signal to remain constructive. The next daily resistance appears at $106.25, marked as the top of the current Murrey Math trading range.

A daily close above $106.25 would strengthen the case for a return toward $110 and the next major pivot at $112.50. Higher resistance sits at $118.75 and $125, although SOL would first need to break its September sequence of lower highs.

The 4-hour chart remains less supportive. SOL traded below the Supertrend level of approximately $102.80, keeping the indicator’s short-term signal bearish. Price must reclaim that level before buyers can argue that the latest correction has ended.

The Awesome Oscillator also remained slightly below zero at about -0.76. Its negative bars were contracting, however, suggesting that bearish momentum was losing strength as SOL recovered from $96.

A move above the zero line would confirm improving 4-hour momentum. Failure to do so could leave the latest advance vulnerable to another rejection between $101 and $103.

SOL liquidation map puts $102 in focus

The three-day CoinGlass liquidation heatmap shows a dense concentration of leveraged positions immediately above the current price. The brightest nearby bands sit around $101.30 and $101.80–$102, making that zone a potential target during an upward move.

A push into those levels could liquidate short positions and help SOL test the 4-hour Supertrend resistance at $102.80. Additional liquidity appears around $105 and $105.70, close to the upper end of the $101–$106 resistance region visible on the price charts.

Liquidity also remains below the market. The clearest downside concentrations appear near $99, $96, and $95.50. Losing $99 could therefore pull the price back toward the defended $95–$96 zone as leveraged long positions come under pressure.

The heatmap does not establish price direction on its own. It instead identifies areas where forced position closures could add speed to an existing move. With sizable liquidity on both sides, a break from the $96–$103 range may produce a sharper move than the recent consolidation suggests.

Solana bulls face resistance between $102 and $106

The immediate bullish case depends on SOL holding the $100 pivot and breaking $102.80. Clearing the 4-hour Supertrend could open a move toward $105 and the daily resistance at $106.25.

Rand Group said Solana continued to defend horizontal support while pressing against a local downtrend. Its shared chart showed the asset compressing beneath descending resistance after recovering from its midyear lows, a structure the firm described as a possible breakout setup.

S&P Global has agreed to acquire OpenZeppelin, the blockchain security firm known for its open-source smart contract tooling and professional security reviews. The move is designed to strengthen S&P Global’s digital asset capabilities—particularly around risk assessment and onchain technology analysis—at a time when financial institutions are increasingly looking to tokenized markets.

The acquisition was announced on Thursday in a press release by S&P Global. Financial terms were not disclosed, and the transaction remains subject to customary closing conditions.

Key takeaways

• S&P Global’s planned purchase of OpenZeppelin targets expanded onchain smart contract and technology risk assessment capabilities.
• OpenZeppelin’s open-source contracts library is expected to remain free and publicly maintained on GitHub after the deal.
• The transaction is structured so OpenZeppelin will operate as a separate S&P Global business unit.
• Deal completion depends on closing conditions; investors should watch for regulatory and transaction approvals.

Why S&P Global wants OpenZeppelin

In its announcement, S&P Global framed the acquisition as a complement to its existing efforts in risk assessment and ecosystem development for the digital asset market. The company said the goal is to bring “trusted data, benchmarks and transparent risk assessment” to markets as activity moves onchain.

Yann Le Pallec, S&P Global’s ratings president, said the acquisition will help expand the firm’s smart contract and onchain technology risk assessment capabilities. For S&P Global, this is a strategic fit: ratings and risk frameworks typically rely on standardized methodologies, while OpenZeppelin’s offerings center on security evaluation for smart contracts and related blockchain systems.

That matters for investors and market participants because, in tokenized environments, security failures can quickly translate into financial losses. As more traditional finance workflows connect to smart contract infrastructure, the demand for repeatable, auditable security assessments is likely to grow.

What OpenZeppelin brings to the table

OpenZeppelin, founded in 2015, develops open-source smart contract software and conducts security assessments for both blockchain projects and financial institutions, according to the deal announcement. The company also highlighted its track record: its smart contracts have supported more than $37 trillion in value transferred, and it has completed over 900 security engagements.

Those numbers point to scale and adoption, but they also underscore a key differentiator in this space—OpenZeppelin is not only a services provider; it also maintains widely used reusable contract components. That dual model (public tooling plus professional security work) is often valuable to enterprises because it can reduce the friction between building securely and validating security expectations.

How the acquisition is structured

OpenZeppelin said its contracts library and other open-source applications will remain free and publicly maintained on GitHub. The announcement also states that the platform will be operated as a separate S&P Global business unit, with Demian Brener continuing as CEO and reporting to Le Pallec.

Operational independence can be important for maintaining trust in security tooling, especially where developers and institutions rely on consistent standards over time. By stating that its open-source artifacts will remain publicly maintained, OpenZeppelin also aimed to reassure builders that the acquisition is not intended to lock critical components behind proprietary access.

Part of a broader push into tokenized markets

This agreement comes shortly after S&P Global pursued additional exposure to crypto market infrastructure. Earlier this week, S&P Global led a strategic investment in Kaiko, the Paris-based crypto market data provider, extending Kaiko’s Series B funding to $110 million as it expands data infrastructure for tokenized financial markets—coverage of that round was reported by Cointelegraph in a separate piece.

Read together, the S&P Global–OpenZeppelin deal and the Kaiko investment suggest a broader strategy: pairing market data and benchmarks with stronger onchain security and risk assessment. For institutional participants trying to operationalize tokenized assets, this combination can be critical—data helps monitor markets, while security assessment helps address the risks embedded in smart contract systems.

Still, the timeline for any tangible impact will depend on deal closing. Until the acquisition completes, readers should treat the operational outcomes—such as integration plans and any changes to service delivery—as uncertain.

With S&P Global and OpenZeppelin now linked under a pending transaction, the next thing to watch is whether closing conditions are met promptly and how the new business unit evolves—especially in how it applies OpenZeppelin’s security expertise to S&P Global’s benchmarks and risk frameworks across tokenized markets.

Attackers claiming responsibility for Revolut’s data breach say they want $3 million in Monero from the banking firm, or they’ll sell the stolen customer data to other criminals.

That’s according to the Financial Times, which reports that the group, going by the name “iamnotavillain,” is making its demands for the first time. 

Its ransom website was launched this week, but negotiations haven’t yet begun with Revolut.

Reuters also reports that Revolut has had no contact with, or received any demands from, the attackers.