Skip to main content

242 posts tagged with "Infrastructure"

Blockchain infrastructure and node services

View all tags

Project Glasswing: How Anthropic's $100M AI Security Cartel Forces Crypto Into a Two-Tier Defense Economy

· 10 min read
Dora Noda
Dora Noda
Software Engineer

On April 7, 2026, Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell pulled the CEOs of Citigroup, Morgan Stanley, Bank of America, Wells Fargo, and Goldman Sachs into an emergency meeting at Treasury headquarters. The subject was not a bank failure, a rate decision, or a sanctions regime. It was a single AI model built by a San Francisco research lab — Anthropic's Claude Mythos Preview — that had quietly found thousands of high-severity vulnerabilities in every major operating system and every major web browser, more than 99% of them still unpatched.

Three days earlier, Anthropic had announced Project Glasswing: a commitment of up to $100M in Mythos usage credits to a closed coalition of twelve technology, security, and financial giants — AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks — plus over 40 critical open-source maintainers. Everyone else, including Coinbase and Binance, was left to negotiate from outside the perimeter.

For crypto, the implications cut deeper than a typical security-tool launch. Glasswing is the first time a private AI lab has effectively defined a two-tier vulnerability-discovery economy, and the crypto industry — which lost over $3B to exploits in H1 2025 alone — has to decide whether it belongs on the inside or the outside of that perimeter.

What Mythos Actually Does​

Anthropic's own framing is unusually stark. In internal tests, Mythos identified a 27-year-old bug in OpenBSD that no human auditor had ever surfaced, then chained consecutive vulnerabilities to break out of modern browser sandboxes. Traditional smart contract audits take weeks. Mythos generates effective attack paths in seconds.

That asymmetry is the story. The model does not just flag candidate bugs; it auto-generates working exploit code and orchestrates multi-stage attack chains. Anthropic deemed the capability "super dangerous" for unsupervised public release, which is why Mythos Preview is not available via normal API access. Instead, it lives behind the Glasswing gate.

The coalition is not a research collaboration in the academic sense. Participants receive live access to Mythos to hunt vulnerabilities in their own systems — TLS implementations, AES-GCM primitives, SSH daemons, kernel code, and in JPMorgan's case, the internal payment and trading stacks that clear trillions of dollars daily. Anthropic has committed to publish a 90-day public report in early July 2026 summarizing what Glasswing has fixed.

Why Coinbase and Binance Are Now Negotiating From Outside the Wall​

Coinbase's chief security officer Philip Martin has publicly confirmed the company is in "close communication" with Anthropic, framing the objective as building an "AI immune system" — using Mythos defensively to scan its own systems before someone with a comparable capability uses it offensively. Binance's CSO described a parallel evaluation, citing both the defensive upside and the threat surface.

The asymmetry problem for crypto exchanges is brutal. A centralized exchange holds hot wallet keys, user balances, and a custody stack that any moderately motivated offensive operator would pay seven figures to probe. If Mythos — or a model of equivalent capability leaked from an employee, a state-sponsored actor, or an eventual open-weight competitor — ends up in attacker hands before exchanges harden their systems, the exploit window is measured in hours, not quarters.

That is the core of the Glasswing dilemma. Exchanges that are not inside the coalition cannot use Mythos to pre-audit their own code. They can use second-tier tools, but the capability gap matters. A bug that Mythos catches in 30 seconds might take a human auditor three weeks, and might be found by an adversary with comparable AI access in minutes.

The $3B Context: Why Speed Asymmetry Is an Existential Threat for DeFi​

H1 2025 saw over $3B in Web3 platform losses. Access control exploits alone accounted for $1.63B — the leading category in that period's OWASP Smart Contract Top 10. FailSafe's 2025 report tallied $2.6B in losses across 192 incidents. Immunefi has paid out over $115M in bug bounties across 400+ protocols and claims to have prevented more than $25B in potential losses.

Now overlay Mythos-class capability on that threat model. A protocol with $500M TVL that relies on a quarterly audit from a top-tier firm was already losing the race against well-resourced attackers. When one side of the table can auto-generate exploit chains in seconds, the audit cadence that defined DeFi security from 2020 through 2025 stops working.

The defensive equivalent exists but lags. CertiK's AI Auditor, open-sourced after six months of internal testing, achieves an 88.6% cumulative hit rate across 35 real 2026 web3 security incidents. It runs parallel specialized scanners through a multi-stage validator to filter duplicates and non-exploitable findings. CertiK has flagged over 180,000 vulnerabilities across its eight-year history and secured more than $600B in digital assets.

But 88.6% is not 100%, and an open-source auditor that runs in minutes is not the same as a frontier model that reasons about novel vulnerability classes in seconds. The gap between what Glasswing partners get and what public tools deliver is structural.

Three Competing Security Architectures​

The crypto industry now has to choose among three incompatible models for AI-era security:

Public bug bounties (Immunefi). Decentralized, economically aligned, proven at scale — $115M paid out, $25B saved. But the incentive structure assumes attackers and defenders operate at roughly equivalent speed. Mythos breaks that assumption. A white-hat researcher chasing a $50K bounty cannot outbid a state-sponsored actor paying $5M for a zero-day on a $10B protocol.

Open-source AI auditing (CertiK, Sherlock, Cyfrin). Democratic access to mid-tier AI capability, 88.6% hit rate, integrates into developer workflows. Preserves the crypto-native ethos that security tooling should be public. But the capability ceiling is below what Glasswing partners get, and the gap compounds as frontier models improve.

Gated-access frontier AI (Glasswing). Best-in-class vulnerability discovery, but only for members of a private coalition that currently does not include any crypto-native company. Creates clear tiers of cyber defense where the inside of the wall is safer than the outside.

The three models are not mutually exclusive — an exchange could run CertiK's auditor on every contract deployment, maintain an Immunefi bounty, and lobby for Glasswing partnership — but they imply very different industry structures. If Glasswing becomes the default tier for "systemically important" infrastructure, crypto's largest custodians face pressure to get in, and the protocols that can't get in face a pricing penalty on their risk premium.

The Systemic Framing Changes Everything​

What made the April 7 Bessent-Powell meeting remarkable is not the fact that regulators talked to bank CEOs about cyber risk. That happens routinely. The remarkable fact is the framing: AI-class cyber capability is now being treated as a potential catalyst for systemic financial events, on par with a sovereign debt crisis or a major clearinghouse failure.

That framing has second-order consequences for crypto. Stablecoin issuers holding tens of billions in reserves, custodians holding institutional BTC and ETH, and the exchange matching engines that process hundreds of billions in monthly volume all sit squarely inside the definition of "systemically important" that regulators are starting to apply to AI cyber risk. If the next Powell-Bessent-style meeting happens and crypto leadership is not at the table, that is both a signal and a problem.

The regulatory signal matters because Glasswing's 90-day public report in July 2026 will publish both what partners fixed and what the broader industry should learn. If that report documents classes of vulnerabilities that Mythos found in critical infrastructure, and crypto protocols have not done equivalent work, the gap will be visible to regulators, insurers, and institutional allocators pricing counterparty risk.

What This Means for Infrastructure Providers​

Machine-speed offensive AI changes the audit cadence required to defend production systems. A protocol or infrastructure provider that relied on annual audits, quarterly pen tests, and reactive incident response needs to shift to continuous AI-assisted red-teaming. That is expensive, and the expense lands unevenly across the stack.

For RPC providers, API infrastructure, and node services that sit between agents and chains, the pressure is to harden the surface where machine-initiated traffic terminates. Agent-driven transaction volume already creates a different threat profile than human-driven dApps: burst-heavy, predictable schedules, and deterministic call graphs that an attacker can model more precisely than a dispersed human user base.

BlockEden.xyz operates enterprise-grade RPC and API infrastructure across Sui, Aptos, Ethereum, Solana, and other major chains, with security and reliability built to serve both human developers and autonomous agent workloads. Explore our services to build on infrastructure designed to hold up in an AI-accelerated threat environment.

The Open Question Heading Into July 2026​

The 90-day Glasswing report is the pivot. If it documents a large backlog of serious vulnerabilities fixed in AWS, Google, Microsoft, Apple, and JPMorgan systems, the case for expanding the coalition gets stronger, and pressure builds on Anthropic to add crypto-native members or to license Mythos-equivalent access through a formal vendor relationship. If the report underdelivers — overcounts CVE findings, documents mostly low-severity bugs, or surfaces issues that existing scanners already caught — the Glasswing model loses some of its regulatory mystique and the crypto industry's open-source alternative looks relatively stronger.

Either way, the status quo from 2020-2025 is gone. The combination of an emergency Bessent-Powell meeting, a $100M Anthropic commitment, a 99%+ unpatched rate on Mythos-discovered bugs, and $3B in annual DeFi losses means that AI-era security is no longer a research question. It is a market structure question, and crypto's answer will define whether the next $100B of on-chain value sits inside a defensible perimeter or outside one.

Sources​

Bonk.fun Domain Hijack: Front-End Attacks Are Crypto's Fastest-Growing Threat Vector

· 9 min read
Dora Noda
Dora Noda
Software Engineer

On March 12, 2026, a community-driven Solana launchpad processing hundreds of thousands of dollars in daily fees briefly turned into a wallet-draining trap — and the smart contracts powering it were never touched. Bonk.fun, the letsBONK-branded meme coin platform backed by Raydium and the BONK DAO, had its domain hijacked, a fake "Terms of Service" signature prompt injected into its front-end, and roughly 35 wallets emptied before the team flagged the compromise. The attackers didn't need a zero-day. They needed a hostname.

That single hour of chaos captures what security teams across DeFi have been whispering since 2023 and shouting since the $1.4 billion Bybit heist: the Solidity code is no longer the soft target. The front-end is. And the industry's collective blind spot is costing users more than any smart contract exploit in history.

Circle Arc Bets the Stablecoin Future on Quantum-Resistant Cryptography — Why the First Post-Quantum L1 Matters Before Bitcoin Does

· 13 min read
Dora Noda
Dora Noda
Software Engineer

What if the $200 billion stablecoin market is about to pick a winner based not on speed, fees, or liquidity — but on cryptography that does not exist in production anywhere else?

That is the wager Circle just made. In April 2026, the issuer of USDC published a full-stack, phased post-quantum security roadmap for Arc, its upcoming Layer-1 blockchain. Arc will debut at mainnet with opt-in quantum-resistant wallets and signatures based on NIST-standardized lattice cryptography. No other major L1 — not Bitcoin, not Ethereum, not Solana — currently ships this at launch. Arc is aiming to be the first chain where "post-quantum" is a shipping feature, not a years-away governance debate.

The timing is not accidental. Six days before Circle's announcement, Google Quantum AI published research slashing the qubit count needed to break Bitcoin's elliptic curve cryptography by a factor of twenty. Google now says the industry needs to migrate by 2029. For a stablecoin chain targeting BlackRock, Visa, HSBC, and ten-year institutional commitments, "we will figure it out later" is not a credible answer.

A Stablecoin-Native Chain With Heavyweight Testnet Traffic​

Arc is not a typical "crypto VC chain." It is a stablecoin operating system, built by the company with the second-largest regulated stablecoin on Earth.

USDC's market cap sits around $77.5 billion, trailing only Tether. Arc's testnet, which went live in October 2025, already counts BlackRock, Visa, HSBC, AWS, and Anthropic as participants. Visa is evaluating stablecoin-backed payment rails for cross-border settlement. BlackRock's digital assets team is exploring on-chain FX and capital markets use cases for its tokenized funds. These are not pilot-program footnotes — they are the institutions that define what "enterprise blockchain" actually means in 2026.

The chain's technical stack is tuned for this audience:

  • USDC as native gas. No volatile native token to account for. Fees are dollar-denominated and predictable — a feature finance departments have been demanding since 2017.
  • Malachite consensus. Built by the team Circle acquired from Informal Systems, Malachite is a formally verified Byzantine Fault Tolerant engine. Benchmarks show roughly 780-millisecond finality with 100 validators on 1MB blocks.
  • Built-in FX engine. An institutional-grade RFQ system for 24/7 PvP (payment-versus-payment) settlement across stablecoins.
  • Opt-in privacy. Selectively shielded balances and transactions — a nod to enterprises that cannot publish every payroll run to a public explorer.

Circle CEO Jeremy Allaire confirmed at a Seoul event on April 14, 2026 that a native Arc token is under active consideration, primarily for governance, validator incentives, and economic alignment — but not for gas. That stays USDC.

The pitch is clear: Arc is the chain you build on if your compliance team reads the cryptography section.

Why Quantum Just Became an Urgent Problem​

For most of the last decade, "quantum threat to Bitcoin" was a dinner-party thought experiment. That changed in March 2026.

Google Quantum AI published research showing that breaking the ECDSA cryptography securing Bitcoin, Ethereum, and virtually every major cryptocurrency now requires roughly twenty times fewer qubits than prior estimates suggested. Specifically: fewer than 500,000 physical qubits, with a runtime measured in minutes.

The more dramatic number inside the paper is the transaction-window risk. Under idealized conditions, Google estimates a 41 percent probability that a primed quantum computer could derive a private key from a public key before a Bitcoin transaction is confirmed. A real-time attack on the mempool, not a years-long post-hoc breakage.

Google paired the finding with a specific deadline. In a follow-up paper picked up by Bloomberg, the company stated that its own systems — and by implication the broader financial infrastructure that uses the same elliptic curves — need to migrate to post-quantum schemes by 2029. Google is careful to note this is not a prediction that quantum computers will break cryptography by 2029. It is a stance that it plans to be ready before they do.

Three months, three major quantum-computing papers, one consistent direction: the timeline is compressing.

Bitcoin's response has been to merge BIP 360, which introduces a quantum-resistant address format called Pay-to-Merkle-Root, into the formal improvement repository. Merged is not deployed. Core-level signature migration for Bitcoin is, realistically, years away. Ethereum has active EIP discussions but no agreed timeline. Solana has no formal quantum roadmap at all.

Arc is shipping at mainnet.

The Arc Post-Quantum Roadmap, Decoded​

Circle's April 2026 roadmap outlines four phases, running through 2030.

Phase 1: Mainnet launch — quantum-resistant wallets and signatures. Arc will implement CRYSTALS-Dilithium (now standardized as ML-DSA) and Falcon as its primary post-quantum signature schemes. Both were finalized by NIST in August 2024 as part of FIPS 204. Both are lattice-based, meaning their security rests on the computational hardness of structured lattice problems — a class of problems for which no efficient quantum algorithm is known. Crucially, Phase 1 ships these as opt-in, not mandatory. Developers can migrate their wallets when they are ready; the chain does not break existing tooling on day one. This is a deliberate compatibility-first choice that acknowledges the reality of developer ecosystems: a chain that bricks every existing library on launch day does not get institutional adoption regardless of how advanced its cryptography is.

Phase 2: Private state encryption. The next layer wraps public keys in symmetric encryption to protect balances and transaction data against quantum-era surveillance. This addresses the "harvest now, decrypt later" problem: an adversary who captures today's blockchain data could, once a cryptographically relevant quantum computer arrives, decrypt historical transaction graphs. For stablecoin finance, where payment metadata is commercially sensitive, this is not theoretical.

Phase 3: Validator security. Consensus messages, attestations, and validator-to-validator communication get post-quantum signatures. This closes the gap where an attacker could target the consensus layer rather than individual user transactions.

Phase 4: Off-chain infrastructure. The final phase extends coverage to communication protocols, cloud environments, hardware security modules, and access controls. Full-stack means full-stack.

The roadmap's phased structure is itself a differentiator. Arc is not claiming to be "quantum-safe on day one" the way some marketing decks overstate. It is claiming to be the first L1 where quantum resistance is a first-class design axis, deployed incrementally, with a credible schedule.

The Institutional Premium — And the Competitive Positioning​

Here is the argument Arc is making to its testnet participants: cryptographic agility is now a line item in institutional risk assessments.

A BlackRock-sized allocator evaluating which chain to use for a tokenized money-market fund with a ten-year horizon cannot assume that the ECDSA signatures securing that fund will still be considered safe in 2035. The conservative procurement decision is to pick the chain that already has a roadmap — not the chain that will figure it out.

This creates a "quantum premium" dynamic that did not exist in prior L1 competitions. Arc's direct competitors for institutional stablecoin settlement are:

  • Tempo — building around ISO 20022 compliance for traditional finance messaging.
  • Pharos Network — commercial-finance-focused with KYC at the chain level, fresh off a $44M Series A at a $1B valuation.
  • Ethereum mainnet + L2s — the incumbent with the deepest liquidity but the oldest cryptographic assumptions.
  • Solana, Aptos, Sui — high-performance general-purpose chains with strong stablecoin volume but no quantum-specific roadmaps.

Each of these has real strengths. None of them currently match Arc's combination of USDC-native gas, Circle's banking and fintech distribution (Visa, Stripe, Coinbase), sub-second finality, and quantum-resistance-as-a-design-requirement. For institutions optimizing for cryptographic risk alongside performance and compliance, that is a differentiated bundle.

The skeptical read is also fair. Quantum attacks on ECDSA remain, today, a hypothetical. A chain that shipped in 2023 with standard cryptography has not been exploited and will not be exploited tomorrow. Arc's quantum bet may only matter in 2030 — if it matters at all on the timeline quantum researchers currently project. Opt-in migration means the security is real only for users who choose it, at least in Phase 1.

The counter is simpler: cryptographic migration is a lagging indicator. By the time it is obviously needed, it is too late to retrofit quietly. Arc is pricing in the fat-tail outcome.

What This Means For Developers and Infrastructure​

For builders, the practical implication is that post-quantum wallet primitives — once an academic curiosity — are about to become a mainnet feature with real traffic.

Arc's opt-in design means tooling has to evolve: SDKs that expose signature-scheme choice as a first-class parameter, explorers that render ML-DSA signatures cleanly, HSMs that hold Dilithium keys, and APIs that serve both classical and post-quantum transactions without fragmenting developer experience. Teams building on Arc will need to reason about which signature class a user or smart contract expects, and how to migrate users between them without breaking existing balances or authorization flows.

For blockchain infrastructure providers — RPC, indexing, and data services — the shift is less dramatic but still real. Node operators must support new signature verification paths. Indexers must recognize post-quantum transaction types. API consumers writing agents or DeFi backends must handle a world where not every signature is an ECDSA blob of the same shape.

The broader point is that cryptographic diversity is coming to the application layer. For a decade, developers could assume "secp256k1 or Ed25519." The next decade will layer post-quantum schemes on top, and the chains that make this transition smooth for developers will capture institutional workloads.

BlockEden.xyz provides enterprise-grade RPC and API infrastructure across Sui, Aptos, Ethereum, Solana, and 20+ chains. As stablecoin-native chains like Arc bring post-quantum primitives to mainnet, reliable data access across signature schemes and consensus engines is table stakes. Explore our API marketplace to build on infrastructure that is ready for what comes next.

Q&A: The Questions Institutional Allocators Are Actually Asking​

Is Arc the first quantum-resistant blockchain? Not the first to talk about it — QANplatform, Algorand, and a few others have shipped partial post-quantum features. Arc is the first major L1 with significant institutional backing to treat quantum resistance as a design requirement at mainnet, with a phased roadmap through 2030 and NIST-standardized schemes (ML-DSA, Falcon).

How close are quantum computers to actually breaking Bitcoin? Unknown precisely, but rapidly compressing. Google's March 2026 paper reduced the estimated qubit requirement to under 500,000 physical qubits. Current quantum systems are in the low thousands. Most experts place the earliest credible date in the early 2030s, with 2029 as the Google-recommended migration deadline.

Does Arc have a token? Not at launch. USDC is the native gas. CEO Jeremy Allaire confirmed on April 14, 2026 that Circle is actively exploring a native Arc token for governance and staking, separate from gas.

What does "opt-in" quantum resistance mean in practice? Users and developers can choose ML-DSA or Falcon signatures at wallet creation. Existing ECDSA wallets continue to work. The migration is voluntary in Phase 1, which protects compatibility but means only quantum-conscious users get the security benefit at first.

Which institutions are on the testnet? BlackRock, Visa, HSBC, AWS, and Anthropic are publicly named, alongside regional stablecoin issuers. Each is running production-shaped workloads — cross-border payments (Visa), tokenized fund operations (BlackRock), banking integrations (HSBC).

The Ten-Year Bet​

The honest framing is this: Arc is a bet that the decade ahead will be defined by institutional capital flowing onto blockchains, and that those institutions will increasingly price cryptographic risk the way they already price credit risk and counterparty risk.

If that bet is right, the chains that shipped post-quantum cryptography first — before it was a crisis, before the CISOs asked — will have a durable moat. If it is wrong, Arc will still be a high-performance stablecoin L1 with USDC-native gas and top-tier institutional adoption. The downside is bounded; the upside is a structural position at the center of regulated on-chain finance.

Either way, the conversation has moved. Quantum resistance is no longer a theoretical concern for the 2030s. It is a roadmap item for 2026, an RFP question for 2027, and an audit requirement not long after. Circle just put it in the center of the table.

Sources​

The Great Capital Rotation: Why 40% of Crypto VC Now Flows to AI-Crypto Convergence

· 12 min read
Dora Noda
Dora Noda
Software Engineer

When Paradigm quietly filed paperwork in March 2026 for a $1.5 billion fund spanning "crypto, AI, and robotics," the rebrand told a bigger story than the headline. The most respected name in crypto venture — the firm that backed Uniswap, Optimism, and Blur — no longer calls itself a crypto fund. It calls itself a frontier tech fund that happens to do crypto.

That repositioning is not marketing. It is a tell. The capital flowing into Web3 in 2026 is not hunting for the next DeFi protocol or L1 chain. It is hunting for the pick-and-shovel infrastructure of the agent economy — the compute networks, payment rails, identity layers, and data marketplaces that autonomous AI systems will need to transact with each other. And the numbers say this is not a side bet. It is the dominant thesis.

The Numbers Behind the Rotation​

Crypto venture capital raised roughly $5 billion in Q1 2026, down about 15% year over year. That alone would read as a cooling sector. But zoom out to the entire VC universe and a different picture emerges: global venture funding hit roughly $300 billion for the quarter, with AI capturing $242 billion — about 80% of the total. Crypto is no longer competing against fintech or SaaS for the marginal dollar. It is competing against AI. And increasingly, it is winning that competition only when it wears an AI jersey.

Inside that $5 billion crypto pool, the share flowing to AI-crypto convergence projects has ballooned. Decentralized AI now represents a $22.6 billion market cap sector across 919 tracked projects as of March 2026. Bittensor alone carries a $3.49 billion market cap, a pending Grayscale ETF, 128 active subnets, and year-to-date performance around +47%. Render Network, Virtuals Protocol, io.net, Akash, and Fetch-cluster projects are no longer speculative narrative trades. They are generating protocol revenue, signing enterprise compute contracts, and booking line items in institutional research reports.

The capital allocation pattern mirrors the 2020 DeFi Summer in one important way and diverges in another. Like DeFi Summer, a single keyword — "AI" — has become the mandatory pitch-deck topline for any founder hoping to raise. Unlike DeFi Summer, the top AI-crypto projects ship revenue that auditors can verify, not just TVL that flash-loan farms can inflate overnight.

How the Top Funds Are Repositioning​

The three firms that dominated the 2020-2023 crypto venture era are all pivoting at once, and the shape of each pivot matters.

a16z crypto is raising a fifth fund targeting roughly $2 billion, expected to close in the first half of 2026. This comes after parent firm Andreessen Horowitz closed more than $15 billion across multiple 2025 vehicles, including $1.7 billion earmarked for AI infrastructure and $1.7 billion for application-layer AI. Partners at a16z crypto have been unusually blunt in public writing: 2026 is the year AI agents either graduate from demo to deployment or the whole thesis deflates. Portfolio commitments include Catena Labs (agent payment infrastructure), and a growing roster of "stablecoin-as-agent-rail" plays.

Paradigm is raising up to $1.5 billion for a new fund whose scope has quietly expanded beyond crypto to include AI and robotics. Recent bets include Nous Research (open-source model training with crypto coordination) and EVMbench (on-chain performance tooling). Paradigm's willingness to blend asset classes signals that LPs are no longer willing to fund pure-play crypto vehicles at 2021-vintage sizes.

Polychain has tilted toward AI trust and identity infrastructure — the layer that answers "is this counterparty a human, an agent, or a bot, and can I trust its claims?" Investments in Billions Network and Talus Labs reflect a thesis that the scarcest resource in the agent economy will not be compute or tokens, but verifiable identity.

The common thread across all three: these funds are underwriting a world where autonomous software transacts with autonomous software, billions of times per day, using crypto rails because no other system can handle the micropayment granularity, the cross-border settlement speed, or the programmable authorization required.

Why DeFi Capital Is Not Flowing to DeFi​

For five years, the default answer to "what is crypto VC funding?" was a variation on DeFi — lending, DEXs, yield aggregators, stablecoin issuers, derivatives venues. In 2026, that share has compressed sharply.

This is not because DeFi is dying. Stablecoin market cap crossed $315 billion, lending protocols hit record utilization, and Polymarket rebuilt its entire exchange stack on PUSD-native collateral. DeFi is healthier than ever as a usage layer. But VCs no longer see it as a greenfield for new startup equity.

The reasoning is straightforward. DeFi's core primitives — AMMs, over-collateralized lending, perp DEXs — are commodified. The winning protocols in each category are entrenched, liquidity-moated, and revenue-generating, but their equity is either already public through tokens or priced at growth-stage multiples that crush venture returns. A new fork launching in 2026 cannot plausibly beat Uniswap or Aave, and the fee compression across the stack leaves little margin for a twentieth AMM.

What VCs can still underwrite at venture-stage valuations is the infrastructure DeFi has not yet built but will need: privacy-preserving execution, verifiable off-chain data, AI-driven risk management, agent-initiated transactions with programmatic guardrails, and cross-domain settlement between public chains and institutional private ledgers. Most of those categories overlap meaningfully with AI-crypto convergence. A DeFi protocol that uses AI models to price risk, settle with autonomous agents, and verify data through zero-knowledge proofs is, by any reasonable definition, an AI-crypto project.

The Pitch Deck Math​

Walk through a typical 2026 crypto fundraise and the AI framing is not subtle. Projects that three years ago would have pitched "decentralized storage" now pitch "memory layer for AI agents." Projects that would have pitched "oracles" now pitch "verifiable data for AI training." Projects that would have pitched "payment channels" now pitch "x402 micropayment rails for autonomous commerce."

Some of this is real. Walrus Protocol genuinely built a Sui-native storage layer optimized for the persistence patterns of AI agents. Virtuals Protocol genuinely processes hundreds of millions in Agent Gross Domestic Product through token-native revenue shares. Render Network genuinely onboarded NVIDIA Blackwell B200 hardware and is serving enterprise compute SLAs.

Some of it is narrative cover. CryptoSlate's Q1 2026 analysis argues that of the $28 trillion in transaction volume attributed to the "agent economy," as much as 76% is automated bots shuffling stablecoins between contracts rather than autonomous agents executing novel commerce. Only about 19% of on-chain transactions qualify as genuinely agent-initiated. The 17,000+ agents launched since 2025 cluster heavily in trading bots — estimated at 84%+ of agent AGDP — with fewer than 5% performing non-trading commerce.

The risk of a 2022-style reckoning is real. If "agent economy" transaction counts get audited the way DeFi TVL eventually did, a meaningful fraction of the valuations currently supported by those headlines will compress. The projects that survive will be the ones whose revenue ties to identifiably new economic activity — an AI character renting GPU time, an autonomous supply-chain agent settling cross-border invoices, a research-model subnet earning inference fees from third-party applications — not bots moving USDC around the same handful of pools.

Who Gets Funded and Who Gets Stranded​

The 40% allocation shift reshapes the pecking order for crypto founders looking to raise in 2026.

Favored categories:

  • Agent payment infrastructure — Catena Labs, Coinbase's x402 ecosystem, and adjacent stablecoin-denominated micropayment rails
  • Decentralized compute and GPU marketplaces — Render, io.net, Akash, the emerging tier of Nvidia-Blackwell-optimized networks
  • Verifiable AI inference and training data — ZK-ML providers, decentralized data co-ops, identity and attestation layers
  • Agent identity and trust — Billions Network, Humanity Protocol, worldcoin-style proof-of-personhood plays
  • Onchain agent frameworks — Virtuals-style launchpads, autonomous-vault systems, LLM-orchestrated DeFi strategies

Stranded categories:

  • Consumer DeFi apps without AI angles — the twentieth savings front-end cannot raise
  • Generalist L1s — new chains competing on "faster, cheaper" without an agent-native story find no takers
  • Memecoin infrastructure — launchpads, sniping tools, rug-detection overlays have matured into a fee-compressed category
  • Pure NFT and metaverse projects — post-2022 capital exited and has not returned

The implication for RPC and infrastructure providers is significant. Node services, indexers, and data APIs need to demonstrate value in agent workflows specifically — handling automated transaction streams, supporting non-human query patterns, and exposing AI-friendly data schemas — rather than competing on raw latency and uptime alone.

The Risk Case​

Three ways the thesis could go wrong.

First, the agent economy numbers may not audit. If the $28 trillion headline compresses to a verifiable $3-5 trillion of genuinely productive commerce once bots are stripped out, token valuations across the AI-crypto sector re-rate downward hard. This is the DeFi 2.0 playbook applied to agents, and the memory of that reckoning is only three years old.

Second, hyperscaler capture. If 80%+ of "on-chain" agents ultimately run inference on AWS, Azure, and Google Cloud, the decentralization story becomes cosmetic. The DePIN compute networks either scale to genuine alternative capacity or settle into being cheap overflow — useful but not foundational.

Third, regulatory ambush. Agent-initiated transactions stretch every existing framework. KYC/AML expects a human counterparty. Securities regulation expects a human solicitor. Consumer protection expects a human victim. If regulators decide autonomous systems require entirely new rulebooks — and those rulebooks arrive slowly and unevenly — the addressable market for agent-crypto infrastructure narrows faster than the build cycle can adapt.

None of these is an existential risk to the thesis, but each can individually halve valuations for exposed portfolio companies.

What This Means for Builders​

If you are building in crypto in 2026, the rotation has practical consequences.

The pitch meeting is different. VCs who funded your DeFi protocol in 2022 now open with questions about your agent strategy, your token-to-AI-service unit economics, and whether your infrastructure survives a shift from human transaction patterns to machine-scale throughput. The projects getting term sheets are the ones where the AI angle is load-bearing, not decorative.

The technical stack is different. Agent-native applications demand different primitives than human-native ones — deterministic execution, revocable authorization, rate-limited spending, verifiable reasoning traces. The stacks that support both human and agent users without re-architecture are scarce, and the premium for getting this right is substantial.

The time pressure is different. A 2021 crypto startup could raise on hype and ship a product in 18-24 months. A 2026 AI-crypto startup is racing not just other crypto teams but every hyperscaler, every AI-native SaaS player, and every traditional-finance integration. Shipping slow means shipping into a market where the winners have already locked in distribution.

The Bottom Line​

The 40% rotation is not a fad, and it is not a pivot away from crypto. It is the crypto industry's answer to the question every LP has been asking since 2024: what does the next cycle look like? The answer Paradigm, a16z, and Polychain have settled on is that the next cycle is not about speculative tokens or retail memecoins. It is about providing the rails for a machine economy that has no choice but to settle on-chain.

Whether that thesis survives contact with audit, regulation, and hyperscaler competition will define the 2026-2028 cycle. But the capital is already positioned, the portfolio companies are already building, and the infrastructure is already being laid. Founders who read this rotation early and build accordingly have the most tailwinds they have had in three years. Founders who mistake it for a passing narrative will spend 2026 wondering why the meetings dried up.

BlockEden.xyz provides the API and node infrastructure that agent-native applications depend on — across Sui, Aptos, Ethereum, Solana, and more than two dozen other chains. If you are building for the agent economy, explore our API marketplace to ship on rails designed for machine-scale throughput.

Sources​

$3B Blockspace Futures: How ETHGas and ether.fi Gave Ethereum Its First Forward Curve

· 12 min read
Dora Noda
Dora Noda
Software Engineer

For more than a decade, Ethereum has priced its most important resource the same way a fish market prices tuna at 4 a.m.: whoever shouts the loudest at the very last second wins. Every twelve seconds, a new auction opens and closes, with no way to lock in a price the day before, no way to hedge a spike, and no way for a validator to know what next Tuesday's revenue might look like.

That changed on April 15, 2026. ETHGas and ether.fi struck a three-year, $3 billion commercial agreement that introduces the first serious forward market for Ethereum blockspace. Ether.fi, the largest non-Lido liquid staking protocol with 2.8 million ETH under management, is committing roughly 40% of its holdings to ETHGas's High Performance Staking service. In exchange, ETHGas gets the validator depth it needs to sell something Ethereum has never had: a guaranteed, pre-priced seat in a block that hasn't been built yet.

It sounds like plumbing. It is plumbing. But so were the first natural gas futures contracts in 1990, and those went on to reshape how every airline, utility, and industrial buyer on earth does business.

Glamsterdam Slips: Ethereum's MEV Reform Hits Engineering Reality as ePBS Runs Late

· 11 min read
Dora Noda
Dora Noda
Software Engineer

For the first time in Ethereum's accelerated 2026-2027 fork cadence, the roadmap has blinked. In mid-April 2026, core developers publicly acknowledged what client teams have whispered for weeks: Enshrined Proposer-Builder Separation — the single most ambitious piece of the Glamsterdam hard fork — is "trickier than anticipated," and the original May-June mainnet window is almost certainly out of reach. The slip pushes Glamsterdam toward Q3 or Q4 2026, narrowing the gap with the already-scheduled Hegota fork and reopening a question Ethereum thought it had settled: can a five-client base layer still upgrade at the pace a post-Pectra L2 economy demands?

MCP + A2A + x402: The Three-Layer Agent Commerce Stack Web3 Developers Can't Ignore

· 12 min read
Dora Noda
Dora Noda
Software Engineer

An AI agent wakes up at 3:17 AM, queries a DeFi analytics API, delegates a risk scoring subtask to a specialized partner agent, pays both providers in USDC, and settles the whole workflow on-chain before the coffee finishes brewing. No human clicked anything. No subscription got charged. No API key got emailed around.

That scenario stopped being theoretical in April 2026.

Three standards — Google's Agent-to-Agent (A2A) protocol, Anthropic's Model Context Protocol (MCP), and the x402 payment protocol — converged into production at the same time, forming what developers are now calling the three-layer agent commerce stack. For Web3 engineers, the window to support all three shut quietly last month: agents that don't speak A2A, MCP, and x402 simultaneously are already being routed around by their more interoperable peers.

This is not another "standard wars" drama where one protocol crushes the others. It's the opposite problem. Three complementary standards each solve a different layer of the same blockchain interaction, and none of them is going away. Here's what that actually means for developers building on Web3 in 2026.

Intent-Based Wallets: The Endgame of Account Abstraction

· 12 min read
Dora Noda
Dora Noda
Software Engineer

For fifteen years, using crypto has meant one deeply strange ritual: opening a wallet, scrutinizing a hex-encoded transaction, manually funding an account with the right gas token, and signing with a key you are personally responsible for never losing. By 2026, that ritual is on the way out — and the wallets leading the charge are not asking users to sign transactions at all. They are asking users what outcome they want.

That shift, from transaction-based wallets to intent-based wallets, is the long-promised endgame of account abstraction. It is being assembled right now out of three apparently unrelated pieces: ERC-4337 smart accounts, EIP-7702 EOA programmability, and a $10B+ wallet-as-a-service market in which Coinbase, Privy (now part of Stripe), Dynamic (acquired by Fireblocks), Safe, and Biconomy are racing to build the default consumer surface for Web3. Put them together and you get a wallet that finally behaves like Apple Pay: you express a desire, someone else figures out the plumbing, and the blockchain disappears.

The Final Form: Users Specify Outcomes, Not Transactions​

The mental model for a 2020-era crypto wallet was a transaction factory. You selected a chain, chose a gas token, set slippage, reviewed calldata, and signed. Every UX paper cut — wrong network, insufficient ETH for gas, a signature for an approval plus a second signature for the swap — came from the fact that the user was the one operating the low-level machine.

Intent-based architectures invert that model. As Anoma's research on intent-centric topologies frames it, an intent is a partial state change expressing a preference, signed by the user, that a solver network competes to fulfill. CoW Protocol has run this playbook for years as a batch-auction DEX where users sign "sell X for at least Y" and solvers do the routing. Flashbots' SUAVE takes the same idea down into block building. Cross-chain intent protocols are actively replacing bridges, turning "bridge from Arbitrum to Base" into "have these tokens on Base in under a minute."

The critical point for wallets is this: once an account is programmable enough to accept conditional, multi-step instructions and hand them off to a solver, the UI no longer has to look like Etherscan. It can look like a chat box, a Shopify checkout, or a one-tap "Buy PENGU" button inside a consumer app. The wallet becomes the place where intents get authenticated; something else does the executing.

ERC-4337 Built the Execution Pipes​

The first enabling piece is ERC-4337, which went live on Ethereum mainnet on March 1, 2023, and quietly became the execution substrate for most of today's smart wallets. Instead of sending a transaction from an externally owned account, a user signs a UserOperation — a richer object that specifies validation rules, an optional paymaster, and the calls to execute. Bundlers package these into real transactions and send them to a canonical EntryPoint contract. Alchemy's overview of account abstraction walks through this pipeline in detail.

Three capabilities fall out of this design, and together they make intent-based UX actually shippable:

  • Gas abstraction via paymasters. A paymaster contract can agree to pay gas on the user's behalf, sponsored by the application or swapped from any ERC-20 the user holds. The experience is a user with zero ETH transacting immediately after account creation — the pattern that Nadcab's 2026 gas abstraction guide projects will become an invisible default by 2027.
  • Session keys. Rather than reauthorizing every action, a user can grant a scoped, time-limited key — "this dApp may spend up to 100 USDC on trades on Base for the next hour." This is the primitive that makes on-chain games, AI agents, and high-frequency DeFi usable without a signature popup every 30 seconds.
  • Modular validation. Because validation is expressed in contract code, not hard-coded by the protocol, wallets can swap in passkeys, multisig logic, social recovery, or fraud checks without changing the underlying account.

ERC-4337 by itself, however, had a structural problem: smart accounts are separate contracts from the ordinary EOAs most users already had. Migrating 200M+ existing addresses into brand-new accounts was never going to happen cleanly. That is the gap EIP-7702 closed.

EIP-7702 Upgraded Everyone's Wallet Overnight​

Ethereum's Pectra upgrade launched on May 7, 2025, and introduced EIP-7702 — a deceptively simple change that lets an ordinary EOA temporarily delegate its code to a smart contract. The private key still controls the account, but while the delegation is active, the EOA behaves like a smart wallet: it can batch calls, use paymasters, whitelist session keys, and plug into ERC-4337 infrastructure. Turnkey's deep dive on the 4337-to-7702 journey captures the key insight: the two standards are complementary, not competing.

The effect on adoption is dramatic. MetaMask, Ledger, Ambire, and Trust Wallet have shipped EIP-7702 support, and Ledger has rolled it out across Flex, Stax, Nano Gen5, Nano X, and Nano S Plus hardware. BuildBear's ERC-4337 vs EIP-7702 comparison notes that most major wallet providers are expected to follow through 2025 and into 2026, which is exactly what the on-chain data is now showing.

In practical terms, 7702 means users do not have to know they are getting a smart wallet. Their existing address keeps working; it just starts doing more. That is the quiet precondition for a mass-market intent-based UX: you cannot ask hundreds of millions of users to migrate, so you upgrade the account they already have.

The $10B+ Wallet-as-a-Service Battle​

If ERC-4337 and EIP-7702 are the protocol layer, the battle for the product layer is being fought in wallet-as-a-service. This is where consumer-grade onboarding, passkeys, embedded UIs, and intent routing get packaged into an SDK that any app can drop in.

The leaders each come from a different angle:

  • Coinbase Smart Wallet is the reference consumer implementation. Coinbase's announcement and Base's rollout plan describe a wallet with passkey-based authentication, gasless transactions by default, and cross-chain deployment — 8 networks at launch and the same contract address across 248 chains via the Safe Singleton Factory. It is effectively trying to become the "Sign in with Apple" of Web3.
  • Privy, acquired by Stripe in June 2025, is now fused with Bridge to unify crypto and fiat payments, pushing embedded wallets deep into mainstream fintech flows. Openfort's Privy alternatives guide tracks how this acquisition reshaped the consumer-crypto landscape.
  • Dynamic, acquired by Fireblocks, is focusing on developer experience and multi-chain adapters, positioning embedded wallets as an enterprise building block.
  • Safe and Biconomy are competing on the modular-account side, particularly around ERC-7579 — a minimal standard for modular smart accounts co-developed by Rhinestone, Biconomy, ZeroDev, and OKX that lets validators, executors, hooks, and fallback handlers plug into any compliant account.
  • Aggregators such as WAGMI, Web3Modal, RainbowKit, and Reown have already integrated smart wallets at the connector layer, meaning most new dApps are intent-capable by default.

The strategic prize is the identity and intent layer for Web3. Whoever owns the wallet owns the funnel for every transaction, payment, and agent action a user initiates. Openfort's top 10 embedded wallets report and the wave of Stripe/Fireblocks M&A make it clear that incumbents now treat this as strategically important — and finite.

The Four Primitives That Make the Intent Wallet Real​

Strip away the marketing and there are four concrete primitives behind "wallets that hide the blockchain."

  1. Native passkeys (EIP-7212). A precompile for secp256r1 signature verification lets wallets authenticate with the same WebAuthn passkeys iPhones, Android devices, and YubiKeys already use. That removes seed phrases as the default recovery model and replaces them with device-secure, phishing-resistant credentials users already trust.
  2. Session keys (commonly structured as ERC-7579 validator modules). Scoped, revocable permissions underwrite one-tap gameplay, recurring payments, and agent autonomy without turning the signature popup into spam.
  3. Gas abstraction (ERC-4337 paymasters). Apps sponsor gas, users pay fees in the stablecoin they already hold, and "I need to buy ETH first" stops being a gating step.
  4. Batched execution (ERC-7821). A single user action can contain an approve + swap + bridge + stake sequence that either all happens or none of it does, eliminating the half-completed multi-step disasters that define crypto UX today.

Combine these four with a solver network and you have the ingredients for an actual intent-based wallet: the user says "swap $500 of USDC for ETH on whatever chain is cheapest," and the wallet handles bridging, gas, approval, and execution under one authorization.

Why This Is Also a Security Story​

Intent architectures are not just a UX upgrade. They are also a security pattern, which matters more than usual given the $25M Resolv hack reporting from March 2026 that put intent-layer safety on investors' radar.

Two shifts stand out. First, because intents are expressive declarations of desired end states, wallets and solvers can simulate and reason about them before execution — rejecting anything whose outcome would violate a policy, rather than relying on users to spot malicious calldata. Second, smart accounts let wallets layer defense-in-depth: spending limits, address allow-lists, transfer delays on large outflows, and automatic pauses on anomalous activity can all be modules on the account itself, not optional settings buried in a UI.

The flip side is new risk surface. Solver networks can collude, paymasters can front-run, and a mis-scoped session key can drain an account silently. Intent wallets do not eliminate risk; they move it from "did the user read the calldata?" to "did the wallet's modules and solvers behave correctly?" That is a far better question to be auditing in 2026.

What Builders Should Watch in the Next 12 Months​

Three inflection points are worth tracking:

  • EIP-7702 saturation. As more wallets turn on delegation and more dApps start assuming smart-wallet capabilities, the design space for EOA-only UX collapses. Apps that still require users to manually fund gas, approve separately, and sign bridges will feel obsolete.
  • ERC-7579 module ecosystems. Expect a real marketplace of audited validators, session-key modules, recovery policies, and compliance hooks that wallets can compose the way mobile apps compose SDKs. Thirdweb, OpenZeppelin, and Rhinestone are already building toward this.
  • Intent settlement standards. Cross-chain intents are the next battleground, and whoever standardizes settlement (ERC-7683 and its successors) will influence how liquidity and MEV get captured across L2s.

The underlying infrastructure — low-latency RPCs, bundlers, paymasters, indexers — has to keep pace. Every intent that a wallet accepts becomes several chain operations behind the scenes, which means the providers that serve these wallets see traffic scale non-linearly with user counts.

BlockEden.xyz operates high-availability RPC and indexing infrastructure across Ethereum, Base, Arbitrum, Sui, Aptos, and other networks that intent-based wallets settle on. If you are building a smart-wallet SDK, paymaster, solver, or embedded-wallet experience, explore our API marketplace to run on infrastructure designed for the multi-chain, intent-driven future.

Sources​

Kraken's $550M Bitnomial Bet: Buying the Only CFTC-Regulated Crypto Derivatives Stack Money Can Build

· 10 min read
Dora Noda
Dora Noda
Software Engineer

When Kraken's parent company Payward agreed on April 17, 2026 to acquire derivatives exchange Bitnomial for up to $550 million in cash and stock, most headlines framed it as another exchange consolidation story. They missed the actual point. Co-CEO Arjun Sethi gave the game away in the press release: "The shape of a market is determined by its clearing infrastructure, not its front end."

That single sentence reframes the deal. Kraken did not buy a competitor. It bought the only crypto-native company in the United States that holds all three CFTC licenses required to operate a complete derivatives stack — Designated Contract Market (DCM), Derivatives Clearing Organization (DCO), and Futures Commission Merchant (FCM) — and it did so months before its anticipated public listing. In a market where Coinbase clears its futures through a third party, CME dominates institutional notional volume, and the CFTC is actively onshoring perpetual contracts, Kraken just bought the regulatory differentiator that nobody else can replicate without years of approval timelines.