Technology Insights
最新のテクノロジー動向とインサイトをお届けします。
Crypto exchange Bitget detected unauthorized transfers from its hot and warm wallets on September 24, 2026. It later revised the loss from $351.6 million to $387.5 million (about ¥60.93 billion). The CEO says the attacker compromised a backend system in the wallet infrastructure, spoofed transaction data, and caused the approval process to move funds out. She has ruled out a private key compromise. Strict key management does not help if nothing independently verifies what is being approved before it is signed. This is a case for auditing the approval path of your own custody and withdrawal systems. A formal root-cause report had not been published as of September 26.
Meter, an EVM-compatible L1, said on September 24, 2026 that an attacker had exploited a "block validation flaw" from 21:14 UTC the previous day. The attacker minted unbacked MTR and MTRG, dumped them on DEXs, and bridged funds out. Mainnet and the Passport bridge are paused. According to Blockaid, about $2.3 million of unbacked wrapped MTRG was minted on BNB Chain in roughly two transactions. The starting point appears to be the source chain accepting an invalid state, not a flaw in the bridge's own code. No detailed post-mortem has been published. Any system that accepts deposits from external chains should decide now how it will handle a source-chain rollback or invalidation reaching its own ledger.
Anza switched consensus from TowerBFT to Alpenglow (Votor) on Solana testnet on September 24, 2026 and on devnet on September 25. The mainnet date remains unannounced, "after our observation period." Alpenglow moves votes out of blocks. As a result, `confirmed` and `finalized` become the same thing, and vote transactions, which made up more than half of daily mainnet transactions, disappear from blocks. A single slot may also carry more than one candidate block. RPC, indexing and analytics teams should now use devnet to test commitment settings, transaction-count baselines and slot-keyed buffering before the mainnet migration.
Avalanche activated the Helicon upgrade on mainnet at 15:00 UTC on September 22, 2026. Helicon bundles six ACPs and made AvalancheGo v1.15.0 mandatory for every mainnet node. At its core is ACP-194. The C-Chain now accepts blocks first and executes and settles them afterwards. Along with this, the meaning of RPC block tags, the minimum gas price, state sync behavior, and validator reward conditions all changed at once. Anyone integrating with the C-Chain should audit now for code that treats `latest` as final and for hard-coded gas price assumptions.
DCENT, the wallet brand of Korea's IoTrust, announced unauthorized transfers from its software "App Wallet" on September 16, 2026. According to XRPL.to, about 11.75 million XRP left 6,678 wallets between September 15 and 20. The company's impact criteria have three parts: the recovery phrase was entered into the App Wallet; the address has a signing history, meaning transfers or approvals; and that signing happened on a version earlier than 8.1.0. The technical cause has not been disclosed. Taken together, the criteria mean that updating the app does not remove the risk to keys already used. The only remedy is to generate new keys from a new recovery phrase and move the assets.
On September 16, 2026, Circle opened the public mainnet of Arc, an EVM-compatible L1 whose native gas asset is USDC. Twelve institutions, including Circle, run the validators, and the Tendermint-derived Malachite BFT provides deterministic finality. USDC on Arc is one balance with two interfaces. The native side counts in 18 decimals; the ERC-20 side (0x3600…0000) counts in 6. There is no WETH-style wrapper. The assumption that "EVM-compatible means existing code just works" breaks most easily in how amounts are handled. Integrators evaluating Arc should confirm three things against live node queries, not documentation tables, before integrating: decimal conversion boundaries, double-counted balances and history, and routing through WETH.
Ethereum core developers have confirmed that Glamsterdam will activate on the Sepolia testnet at 13:53:36 UTC on October 6, 2026 (epoch 353024, timestamp 1791294816). On September 16, Glamsterdam-Devnet-11 completed a fork transition with no drop in participation, the first time this has happened. The "epoch 351232" figure that circulated in coverage belongs to the earlier September 28 proposal. The correct epoch for October 6 is 353024, which resolves the date mismatch this series flagged last time. Organizations running nodes, L2s or indexers on Sepolia should, this week (about nine days before the fork), identify client versions that include the Sepolia schedule on both EL and CL and lock in their upgrade plan. Hoodi and mainnet dates remain unset.
The authors of Ethereum L1's EIP-8141 (Frame Transactions) and the Base-led EIP-8130 had been working toward a common standard for both chains. The talks ended in the second week of September 2026, as Ethlabs developer Derek Chiang announced on September 14. The split came from diverging priorities, not a technical dead end. Ethereum prioritizes censorship resistance, privacy and security; Base prioritizes scale, customization and compliance. If both ship as planned, native AA transaction formats will differ between L1 and Base. Wallet, SDK and signing-infrastructure teams should start designing an abstraction layer on the assumption that they will handle two native formats on top of ERC-4337 and EIP-7702.
On 2026-09-11, around 11 users of ether.fi Liquid (liquidETH) lost roughly 15.45 ETH in total, about USD 38,130. `AtomicQueue.solve()` applied no access control to the solver parameter supplied by the caller, so an attacker could craft an AtomicRequest that put already-approved victim addresses in the solver position and consume their remaining ERC-20 allowances via `transferFrom`. The amount is small, but a structurally identical case hit BNB Chain the same week, and the shared lesson is that approvals granted in the past become attack surface whenever a third-party contract fails to validate its address arguments.
On 2026-09-09 Osmosis disclosed that a flaw in Nomic's custom forwarding mechanism allowed nBTC to be double-spent, sending unbacked vouchers into Osmosis over IBC. Of allBTC's backing, 39.84 nBTC — roughly 36.03% — is invalid; a moderation subDAO froze inflows and outflows, and validators ran an emergency upgrade that locked 22.65 BTC at the attacker's address. Neither the Osmosis chain nor IBC was compromised; the defect sits on Nomic's side. Recovery is a two-step plan — seize the frozen coins, top up from the community pool — and both steps need a governance vote.
On 2026-09-06 at 15:53:10 UTC, at Liquid block 4,050,336, a flaw in how Elements caches range-proof verification results was exploited to create roughly 4,000 BTC worth of unbacked L-BTC. The forged L-BTC was then redeemed through the ordinary peg-out path, draining real bitcoin from the federation reserve; no private keys were compromised. Node operators must move to Elements v23.3.4, and any service holding L-BTC should start monitoring issuance against backing rather than watching the reserve balance alone.
On 2026-09-07, Cozy Finance, a DeFi protection protocol on Optimism, lost roughly USD 160,000. The attacker first acquired PTokens in the Aave v2 and Curve protection markets, then submitted a "YES" answer — asserting the covered event had occurred — to UMA's Optimistic Oracle, where it settled unchallenged. Two design gaps made the sequence work: the trigger never independently verified a real incident, and payout eligibility was not tied to a holder snapshot taken before the assertion was proposed.
On 2026-09-07 the Ethereum Foundation's Protocol cluster published a tier list grading every one of the 62 EIPs proposed for Hegotá, alongside a companion post setting out the priorities behind those grades. The change that matters is structural: what used to be per-team opinion posts is now one unified view drawn from 397 grades cast by roughly 60 people across nine teams, and each tier carries a delivery commitment — an S means the schedule bends before the scope does. A hard deadline of December 2029 for a quantum-resistant base layer is what shapes which proposals get pushed.
At All Core Developers Consensus #186 on 2026-09-03, epoch 351232 was agreed as the proposed Glamsterdam activation on Sepolia, with the corresponding time reported as 2026-10-06 13:53 UTC. Computed from Sepolia's beacon genesis, however, epoch 351232 falls on 2026-09-28 at 14:44:48 UTC, and 2026-10-06 13:53 UTC is not an epoch boundary at all. Glamsterdam has still not activated stably on any private devnet, and Devnet-11, launching 2026-09-14, is the next real datapoint.
Base has published plans to bring account abstraction into the protocol itself with EIP-8130 in its next network upgrade, Cobalt. Accounts register who may act for them and how signatures are validated in an onchain system contract, and the chain validates every transaction against that configuration — no alternate mempool, no bundlers, no EntryPoint. Base's published figures put USDC transfer gas at 46,000 against 125,000 under ERC-4337, a 63.2% reduction, with transaction byte size down 83.4%. September is the target, but no date is confirmed and the implementation is explicitly experimental and unaudited.
During September 2026, Ledger's Ethereum device app will drop support for `signEIP712HashedMessage`, the hashed (blind-signing) variant of EIP-712. That removes the last working path for `@ledgerhq/hw-app-eth`, and every LedgerJS package — `hw-app-*` and `hw-transport-*` — is deprecated from the same date. Applications that have not migrated to the Device Management Kit (DMK) by then will be unable to sign typed data on Ledger devices.
On 2026-08-31, Injective mainnet produced no blocks between 16:10:02 UTC and 19:52:14 UTC — three hours, forty-two minutes and twelve seconds — while roughly $4.9 million was extracted through binary-options markets. The attacker is reported to have created a large number of short-lived markets wired to an oracle they controlled, then drawn more than they deposited via the refund path the protocol falls back to when no valid settlement price exists. Injective describes the event as an upgrade rather than a halt; because the emergency release touches core modules, that framing is disputed, and a full post-mortem is still outstanding.
On 2026-08-30, Cronos validators stopped producing blocks in response to a price-manipulation attack on Tectonic, the chain's largest lending protocol, then restarted from a snapshot taken before the exploit. The attacker inflated the price of TONIC, a thinly traded governance token, roughly a hundredfold in about twenty minutes and borrowed against it. The rollback kept most assets in place, but the roughly $6 million that reached Ethereum before the halt did not come back. That asymmetry is the part that matters for anything connected across chains.
SIMD-0296 raises Solana's maximum serialized transaction size from 1,232 bytes to 4,096, and SIMD-0385 defines the v1 format that carries it. The feature gate activated on testnet at epoch 1025 on 2026-09-01, with mainnet scheduled for 2026-09-09. Senders are unaffected unless they opt in, but anything that reads blocks will fail an entire `getBlock` call — not just one transaction — if it has not set `maxSupportedTransactionVersion` and upgraded its SDK.
On 2026-08-28 Cosmos Labs published a post-mortem on GHSA-7g4w-cg88-2cq2, a balance-handling vulnerability in the shared cosmos/evm module. The flaw had been reported through its bug bounty programme on 25 April, but was assessed as posing no risk to funds on live networks and handled as a public patch with no security advisory. The first attack began roughly twenty hours after that patch shipped, and about $5.72 million (roughly ¥910 million at USD/JPY 159, 2026-09-02) was realised across six chains. The substantive issue is not the bug but the disclosure design for shared dependencies.
On 2026-08-28, Avici and Tria — two Solana-based card products sharing the same card-issuing partner, Rain — separately disclosed a vulnerability in Rain's Solana card contract. The exposure was confined to the contract holding balances after a card top-up, not to self-custodial wallets. Avici reported 1,685 users and $500,859; Tria followed on 3 September with 636 users and $431,945. Both pledged full refunds. It is a clean example of shared-component risk: neither company changed a line of its own code, and both became incident owners on the same day.
At the execution-layer All Core Developers call (ACDE) on 2026-08-27, the native account abstraction proposal EIP-8141 (Frame Transactions) was raised from Considered for Inclusion to Scheduled for Inclusion. The decision signals that Ethereum will ship account abstraction in Hegotá; it does not freeze the specification, or even the final EIP number. The rival proposal EIP-8130 is due to go live on Base in September, creating a period in which different account abstraction schemes coexist on L1 and L2.
On 2026-08-22, an attacker drained 2,985,651,403.40 TAC — 28.6% of supply — from the bonded staking pool of TAC, an EVM-compatible L1 connected to the TON ecosystem, in a single transaction. Block production stopped at 23:58:11 UTC with block 24,671,475. The root cause traces upstream to a mismatch between two balance records in Cosmos EVM: the EVM StateDB tracked only spendable tokens while the Cosmos SDK ledger also held locked vesting tokens that could be delegated, so delegating beyond the spendable amount caused an unchecked subtraction to wrap toward 2^256. The fix had been backported into releases on 19 August, three days before the attack.
On 2026-08-21 Solana reduced mainnet slot time for the first time since genesis, moving from 400 to 350 milliseconds. This is the first of four 50ms decrements defined by SIMD-0525; the per-block compute unit ceiling drops proportionally from 100M to 87.5M, and epoch length shortens from about 48 hours to about 42. Throughput does not increase, but every constant defined in blocks now means something different in wall-clock time — so the impact lands on applications more than on validator operations.
On 2026-08-20, a compromised maintainer account on crates.io was used to publish malicious releases of arrayref, internment and append-only-vec. Each added a dependency on proc-macro1, an attacker-controlled typosquat whose build script fetched and executed a remote payload at compile time. Because the code lived in a build script, nothing had to be called for it to fire — building was enough. Teams shipping Rust tooling around Solana or Ethereum should assess this on whether they built during the exposure window, not on the fact that the releases are now gone.
At ACDC #185 on 2026-08-20, consensus-layer client teams proposed activating Glamsterdam on Sepolia at epoch 351232 / slot 11239424, 2026-09-28 14:44:48 UTC. No objections were raised, but the same line in the minutes records that the decision was deferred to the next ACDC, so the date is not settled. Hoodi follows on 26 October, and mainnet remains a Q4 2026 target with no date at all. Circulating the proposed stage internally as if it were confirmed is how schedule credibility gets spent.
The Ethereum Foundation announced the Glamsterdam-specific public testnet Platåberget on 2026-08-17 and forked it to Glamsterdam rules on 2026-08-20. Alongside ePBS (EIP-7732) and Block-Level Access Lists (EIP-7928), EIP-8037 pulls state-creation cost out of ordinary execution gas, which means any code that treats intrinsic gas as a constant will stop working. Mainnet is targeted for Q4 2026 with no date fixed, but the real deadline for tooling is the Sepolia fork, which arrives sooner.
On 2026-08-19 the Ethereum client firm Nethermind announced it had migrated away from LayerZero DVN operations and joined the Chainlink Network as a node operator and strategic technology provider, helping run CCIP and Data Feeds. It identified no technical flaw at LayerZero and has not published the "extensive review" behind the decision. This is reportedly the first public case of a DVN operator leaving of its own accord. The substance is that in a configurable-security model, the composition of the verifier set can change without any of it being visible to downstream contracts.
On 2026-08-18 a single MsgDeposit transaction carrying 23 messages was submitted to MAYAChain mainnet, chaining six defects across theft detection, slash compensation, pool accounting and outbound handling. Compensation logic fired in error and credited roughly 49.45 million CACAO to a thin pool without reference to the reserve's actual balance; the transfer failed, but the inflated balance alone was persisted. The attacker realised about $1.65 million (roughly ¥260 million at USD/JPY 159, 2026-09-02). The substance is not a single bug but a missing rollback on the failure path.
On 2026-08-17, alongside the launch of the Platåberget testnet, Ethereum Foundation's Protocol DevOps team stated plainly that Glamsterdam carries breaking changes for application developers. At the centre is EIP-8037, which introduces a separate state gas dimension: operations that create new state are metered at a fixed cost per state byte and charged at runtime. As a result a plain ETH transfer is no longer always 21,000 gas, and any wallet, indexer or gas estimator that hardcodes a maximum gas limit will stop working unless updated.
On 2026-08-13, Ethereum Foundation researcher Justin Drake announced that Ethereum is abandoning Poseidon for L1 and pivoting to conventional hash functions such as SHA or BLAKE. Poseidon arrived in 2019 as a "ZK-friendly" hash designed to be cheap to evaluate inside SNARK circuits, and the EF has spent eight years and an eight-figure budget on the surrounding research. The pivot follows progress on leanVM, which works over binary fields where conventional hashes are the cheaper option. Teams whose ZK designs assume Poseidon should revisit the reasoning behind that choice.
The Agave v4.3 release schedule maintained by Anza lists 2026-09-28 as the date mainnet feature activation begins. v4.3 carries Alpenglow, which replaces Tower BFT and Proof of History with Votor and Rotor; activation on testnet and devnet completed on 19 and 24 August respectively. The operationally significant detail is not the eventual 150ms finality but the handover: Firedancer is not implementing the live migration window, so operators are expected to run Agave for that period and switch back afterwards.
