daily ai × crypto news in 5 minutes. no hype, just what matters.
evening. yesterday we flagged a $2,000 bitcoin dare sitting on an unpatched php server. a few hours later, it fell. that's the big one. also: india's biggest exchange absorbed a $16m loss after calling it a "false alarm," a solana trading bot lost ~$950k from 49 wallets, ethereum's ai agents got a shared message board to save a hard fork, and a hardware-wallet maker is destroying 18,835 devices after an authentication key was stolen.
the big one
the dare. after the ai-found cves that became known as php2shell (#009), security researcher james pavur put a bitcoin key on a deliberately unpatched server — php 8.4.26, from before the oct 21 fixes — and dared anyone to take it. the prize started at ~$502 (0.00625104 btc). strangers topped it up until the pot held 0.02511679 btc ($2,021.22). first person to make the server's print-flag program spit out the key kept the wallet. (stealmybitcoin.com, cybernews, mempool.space)
it fell in 19.28 hours. a researcher called killaboi won on oct 25 at 15:47 utc (16:47 copenhagen). the site still says so. but cybernews notes a usable php page was only added about 3 hours before the win, so the real attack window was much shorter than the headline clock. killaboi's public write-up says the exploit chain — a heap leak, a code leak, then a forged structure that makes php call system — needs at most 20 http requests, no looping, no retries. (stealmybitcoin.com, cybernews, github: killaboi/stealmybitcoin-poc)
the twist: the stolen key opened nothing. pavur says he "screwed up which key went on the server." the recovered key didn't unlock the advertised funds. he verified the breach in his logs and paid the prize himself. on-chain, the prize wallet (bc1qlnu50…cxqy) later emptied in two transactions on oct 25 at 22:59 and 23:17 utc — after the win was already declared. headlines that say "bitcoin stolen" are wrong. the server was breached. the bitcoin was paid by the organizer. (cybernews, mempool.space)
why it matters. this is the first public, live, money-on-the-table test of the php2shell class that ai models helped find (openai's gpt-5.6 sol and gemini 4 argon both show up in that research trail — see #009). it does not prove "ai agents are emptying every server." it proves the opposite of complacency: an unpatched stack falls in hours once there's a real target. patch. or don't leave a key next to it. more: bitcoin · crypto
crypto
ceo called it a "false alarm." four days later: $16m gone. india's largest exchange by volume, coindcx, saw ~16m usdt leave old wallets. ceo sumit gupta replied on x: "coindcx wallets are not breached… this sounds like a false alarm." zachxbt showed one "retired" address was still sweeping user deposits to the current hot wallet in april–may 2026. on sunday coindcx admitted a loss of 15.99 million usdt, which it absorbed. cause per the exchange: an automated "sweeping" service failed for a period, so deposits piled up in a wallet compromised in the july 2025 hack (that one cost ~$44m). the biggest single transfer was 15,819,002 usdt, routed toward binance, okx and gate deposit addresses. the blog post still doesn't say who took the money. (coindesk, the block)
a solana trading bot got drained: ~$950k from 49 wallets. bloom trading, a cross-chain trading-automation platform (chrome extension + manager), lost about 9,408 sol (~$947k–$954k depending on the print) from nine users' 49 wallets. bloom blames a remote-code-execution bug in a third-party module, says private keys weren't leaked, took systems offline and promised a full refund. usdc balances were left untouched. "keys not leaked" is cold comfort: a bot that can sign for you doesn't need your key stolen to empty you. the risk is the permission you gave it. (tokenpost, the crypto times)
ethereum's ai agents got a message board to save a hard fork. ethereum postponed the glamsterdam rehearsal on the hoodi testnet after chainsecurity found two gas-scaling proposals (eip-8037/8038) could break existing contracts' failure handling — at least 13 defi contracts were at risk. researchers from ethlabs and the ethereum foundation independently spun up ai agents to scan contracts, then set up a github repo as a shared "message board" for the agents. a second board now reviews eip-8198 "quick slots" for the next fork (hegota). the same coordination pattern rogue agents used in the openai × hugging face hack — this time for the defenders. (ethereum foundation, cointelegraph)
quick hits
keystone will destroy 18,835 hardware wallets after a website breach that exposed 25,964 buyer records (names, contact, shipping) and stole a device-authentication key that could let counterfeits pass authenticity checks. private keys and recovery phrases were not compromised; shipments are paused. (crypto.news, the crypto times)
markets in 30 seconds
as of ~17:40 cet, oct 26 (coingecko):
btc: ~$79,725 (-0.9% 24h)
eth: ~$2,307 (-1.4%)
sol: ~$100.8 (-0.4%)
quiet monday into the fed's oct 27–28 meeting. more by topic: markets
tool of the day
slither: trail of bits' open-source static analyzer for solidity and vyper. it finds common smart-contract bugs (reentrancy, bad access control, dangerous low-level calls) before you deploy, and it plugs into ci. free (agpl-3.0); actively maintained (6,300+ github stars). for developers and auditors who want a free first pass before a paid review. more picks in the gweiwire tools catalog.
one thing to watch
the next "steal my bitcoin" round. pavur hinted there may be more challenges. if a usable page is live from minute one, the clock will tell us how long a real unpatched stack lasts when the target isn't theoretical.
that's the wire. unpatched means gone in hours. back tomorrow. — gweiwire
forward this to a friend who still hasn't patched. new here? subscribe at gweiwire.com.