7 min read · 12 sources

Bitcoin just had its biggest week ever. The asset gained $14,264 in seven days to close at $77,387 — a 22.7% move that sets a new record for weekly dollar appreciation in BTC’s 16-year history. The proximate driver: the Treasury’s buyback expansion, which rekindled the scarcity narrative that bitcoin bulls have been waiting for. The Crypto Fear & Greed Index hit 78, its highest since December 2024, while spot bitcoin ETFs pulled in $1.92 billion in net inflows for the week ended August 21 — the strongest since October 2025. The bitcoin-to-gold ratio crossed 16.73oz, the highest since May, which Strive CEO Matt Cole called a signal that this cycle is outpacing all prior ones. For engineers running custody stacks or exchange matching engines, the sudden liquidity surge into ETFs means on-chain spreads and slippage will behave differently than they did through most of 2025 — the instrument has changed in ways that matter for risk models.

Bitcoin gained $14,264 in one week — the largest weekly dollar gain in its history — closing at $77,387 on August 24.

CFTC Will Regulate Crypto With or Without Congress

The biggest regulatory story of the week came from the CFTC. Chair Brian Selig announced the agency will invoke its existing statutory authorities — rooted in the 1992 Commodity Exchange Act — to establish a crypto asset markets regulatory regime if the CLARITY Act continues to stall in Congress. The move positions the CFTC to set market structure rules unilaterally rather than waiting on comprehensive legislation, bypassing a Senate floor vote that would need 60+ members. Coinbase CEO Brian Armstrong said crypto regulatory clarity will arrive through one of two paths: a Senate bill on September 15, or new CFTC and SEC rules on September 16. For engineers building crypto infrastructure in the US, this is the signal that compliance posture needs to be set for a CFTC-first regime now, not after the rules drop. Existing authority over event contracts and derivatives gives the agency real levers even without new legislation.

Infinex Adds Per-Wallet 2FA and Secret Export

Infinex shipped two features that change how custody security works at the wallet level. Per-wallet 2FA controls let users assign independent security postures to individual wallets rather than enforcing a single account-level setting. Wallets with 2FA enabled form a “security zone” — transfers between them are frictionless, but moving funds outside the zone triggers verification. The second feature, wallet secret export, lets users retrieve seed phrases or private keys for Infinex, imported, hardware, and Safe wallets after passing passkey signature and 2FA/email confirmation. Critically, secrets are rendered inside a Turnkey-hosted iframe and decryptable only within Turnkey’s secure enclave — neither Infinex nor Turnkey can access the plaintext. The implementation matters architecturally because it separates security policy per key rather than per account, a pattern that solves the friction tradeoff that uniform 2FA imposed on active DeFi users who need both custody security and fast daily transactions. If you’re designing a multi-wallet custody system, this is the reference implementation to study.

Solana Cuts Mainnet Slot Time to 350ms

Solana’s Friday mainnet upgrade reduced target slot time from 400ms to 350ms under proposal SIMD-0525. This is the first step in a planned four-stage reduction targeting 200ms finality, with three more 50ms cuts still to come. One important caveat: the change reduces confirmation latency but does not increase throughput, since each slot now carries proportionally less work. Full economic finality remains around 12.8 seconds today — that number won’t meaningfully move until the separate Alpenglow overhaul ships, which aims to bring finality down to approximately 150ms. For developers building on Solana, the slot time reduction means block finality from a user’s perspective will feel snappier for single-slot confirmations, but your systems should not assume faster settlement for multi-hop transactions until Alpenglow lands.

This Week on Base: $5B TVL, x402 Dominance, and Base Batches 004

Base crossed $5B in DeFi total value locked and surpassed every other network in monthly stablecoin card spend, with $2.5B USDC deployed across 16 lending venues — $2.1B of that concentrated in Morpho Blue alone. AI agents executed 7.3 million of the 14 million total x402 transfers logged across all chains over the past 30 days, and Blockrunai cleared 1 million x402 transactions per day on Base, confirming the chain’s dominance in machine-to-machine payment rails. On the application layer, Venice crossed $100M in annualized revenue and o1 Exchange recorded $200M in cumulative trading volume with over 25,000 tokens launched. Base Batches 004 is now accepting applications through September 9, taking 10 early-stage teams with up to $100K each and a NYC Demo Day. New primitives launching on Base include ZARU stablecoin, Veil multi-asset pool, and Tenor’s standardized monthly maturities — worth evaluating if you’re building fixed-income or structured product infrastructure.

Onshoring Hyperliquid: The Compliance Path US Traders Have Been Waiting For

Hyperliquid remains geoblocked from US markets because its permissionless infrastructure conflicts with CEA requirements for registered DCMs, DCOs, and FCMs — the exchange, clearinghouse, and broker roles that TradFi separates. A new analysis frames HyperCore’s modular stack as a natural mirror of that separation: the protocol handles matching and settlement, deployers set contract specs by staking a slashable 500k HYPE bond and can retain up to half the fees their markets generate, and builders onboard users as FCM equivalents bearing KYC/AML obligations. The Hyperliquid Policy Center has lobbied the CFTC and SEC to allow regulated firms to access HyperCore through permissioned HIP-3 DEXs. Trump’s recent announcement validating this onshoring approach means US traders may eventually access Hyperliquid’s perpetuals infrastructure through regulated wrapper products rather than waiting for the protocol itself to register. For engineers, the shift from fully permissionless to permissioned deployment models on Hyperliquid is a design constraint that didn’t exist a year ago — compliance engineering is now a first-class concern for any Hyperliquid integration targeting US users.

Timing the Head: A New Attack Class in Ethereum PoS

New research published on ethresear.ch identifies two attack vectors that exploit head vote timing in Ethereum’s LMD-GHOST consensus. The first, the head-vote timing game, has an adversarial proposer delay block broadcast until near the 4-second attestation deadline in a 12-second slot, pushing honest validators to attest the parent block instead and forfeit head-vote rewards. Prysm experiments measured a 15.06% average total reward loss for honest participants under this manipulation. The second vector, the k-block withholding attack, lets an adversary controlling consecutive proposer slots privately extend a competing chain and release it to trigger reorganizations, voiding honest attestation rewards on the reorganized blocks. Researchers propose a distance-weighted head reward mechanism that grants partial credit for attestations pointing to recent canonical ancestors, reducing timing-game losses from 15.06% to 4.71% without modifying core consensus rules. The proposed “Proposer Boost” mitigation adds 40% additional weight to proposer blocks — a change that would require a soft fork to adopt. This is the kind of formal, quantitative analysis that consensus engineers should be running against their own validator stacks before these attack surfaces are catalogued as theoretical.

BounceBit Shuts Down L1 After $286.5M Exploit

BounceBit is permanently shutting down its Evmos-based L1 after a protocol-level authorization flaw allowed an attacker to drain approximately 286.5 million BB tokens from nine mainnet accounts. No private keys or individual wallets were compromised — the exploit was in the protocol’s own authorization logic. The YZi Labs-backed project, whose 2024 seed round was co-led by Blockchain Capital and Breyer Capital, will reissue BB as a BEP-20 token on BNB Chain using a pre-exploit snapshot, with the 286.5 million exploited tokens excluded from the new issuance. CeDeFi, Prime, and RWA products operated by the team were unaffected. For engineers evaluating L1 projects, this is a reminder that protocol-level authorization flaws can be more catastrophic than key compromise — the blast radius doesn’t stop at a single wallet.

Send Taps Wirex, Grayscale Files Zcash ETF Amendment

Send announced a partnership with Wirex to power Send Cards, selecting Wirex for its scale — 8M+ users, $20B+ processed, and approximately $2B in annualized onchain card spend — and shared self-custody ethos. Wirex BaaS will provide instant settlement, 0% FX conversion, IBANs, cards, and yield features, letting recipients receive full amounts in seconds. The integration is positioned as a multi-rail payments stack rather than a standalone card product — combining payouts, multi-currency accounts, and on-chain card spend in a single stack. Separately, Grayscale filed its fifth SEC amendment converting its Zcash Trust — running since 2017 with $260M+ AUM — into The Zcash ETF, bringing the first regulated US Zcash exposure product a step closer to market.