June has been a dense month for blockchain expertise updates, with builders patching privateness holes, rescheduling main upgrades, pushing quantum-resistance proposals, and racing to shore up safety towards a rising wave of provide chain assaults. From Bitcoin Core to Ethereum, Zcash to Polygon, the tempo of protocol-level change is accelerating — and among the selections made now will outline how these networks maintain up over the following decade.
Key takeaways
- Bitcoin Core 31.1 fixes a privateness vulnerability within the -privatebroadcast characteristic of model 31.0 that would expose a transaction initiator’s IP tackle.
- Ethereum’s Glamsterdam improve has been postponed to the second half of the 12 months; the Hegotá laborious fork is focusing on late 2026/early 2027.
- EIP-8182, a local non-public switch proposal, has been formally proposed for inclusion within the Hegotá laborious fork.
- Consensys CEO Joseph Lubin expects Ethereum to change into a totally zero-knowledge-proof protocol inside 3 to five years.
- Polygon zkEVM Mainnet Beta will stop operations on July 1, 2026 — customers should withdraw belongings earlier than the deadline.
- The SlowMist Safety Group confirmed malware variants lively throughout 23 npm packages, with 408 GitHub repositories containing stolen credentials.
- Microsoft’s Majorana 2 quantum chip is reportedly 1,000 occasions extra dependable than its predecessor, with common qubit lifetimes of 20 seconds.
Bitcoin Core Fixes Privateness Vulnerability in v31.1
A flaw hiding inside Bitcoin Core’s newly launched -privatebroadcast characteristic went public this month — and the implications for privacy-conscious customers are extra refined than most bug disclosures. Model 31.0 contained a vulnerability that, underneath particular community situations, may expose the IP tackle of a transaction initiator to the receiving node.
How the IP Leakage Really Occurs
The vulnerability surfaces when non-public broadcast selects an IPv4 or IPv6 node that helps BIP324 v2 transport. If the v2 handshake fails, Bitcoin Core falls again to a v1 retry — however that reconnection bypasses the Tor proxy solely, making a direct IPv4 or IPv6 connection to the peer. The outcome: a characteristic designed to boost privateness finally ends up doing the other underneath sure fallback situations.
The affected scope is restricted. Nodes operating Bitcoin Core 31.0 with -privatebroadcast enabled, broadcasting transactions through the sendrawtransaction RPC, and able to establishing direct IPv4/IPv6 outbound connections are in danger. Pockets RPC, onion, and I2P connections will not be affected.
Earlier than upgrading to model 31.1, Bitcoin Core advises related customers to both disable -privatebroadcast, disable v2 transport, or route IPv4/IPv6 outbound site visitors via Tor. The discharge candidate 31.1rc1 is already out there for testing on the official Bitcoin Core web site and contains fixes throughout validation, P2P networking, pockets migration, MuSig, construct system, testing, and CI modules.
Individually, developer rkrux has opened dialogue round eradicating specific Substitute-by-Charge (RBF) signaling from the Bitcoin Core pockets, arguing that BIP 125 indicators have change into redundant now that full-RBF is commonplace coverage and should depart pointless on-chain fingerprints. Group member Murch pushed again, noting that stopping replaceability indicators shouldn’t be a easy removing of fingerprints — every sender nonetheless wants to decide on a sequence quantity for each enter, with roughly 75% of transactions already utilizing particular sequence numbers, primarily MAX-2.
Ethereum Delays Glamsterdam and Advances Privateness Proposals
Ethereum’s improvement pipeline is shifting on a number of fronts, however essentially the most speedy information is a scheduling change: the Glamsterdam improve — which targets final L1 scaling and MEV equity — has been pushed to the second half of the 12 months. Devnet-5 and Devnet-6 iterations are nonetheless in progress, with countermeasures towards new EIPs underneath lively improvement. Core developer Terence confirmed that Glamsterdam devnet-6 has been launched, marking important progress towards testnet deployment.
Publish-Quantum Public Key Registry Proposal
Ethereum researchers Thomas Coratger and Tom Wambsgans printed a framework for establishing a post-quantum public key registry for validators — a phased migration path away from BLS signatures towards post-quantum safe signature schemes. The strategy envisions a registry fork first, permitting validators to pre-register post-quantum public keys, adopted by a number of subsequent forks earlier than the signature mechanism formally switches.
The main candidate is the hash-based XMSS signature scheme, which presents a compact 52-byte public key — although particular person signatures weigh in at roughly 3,112 bytes. Addressing that overhead would require leanVM and post-quantum SNARK aggregation. This isn’t a near-term improve, however the truth that Ethereum researchers are already scoping the migration structure indicators how critically the community is treating the quantum menace.
EIP-8182 Native Non-public Switch Proposal for Hegotá
EIP-8182, developed by Tom Lehman, has been formally Proposed for Inclusion within the Hegotá laborious fork — the improve focusing on censorship resistance, privateness enhancement, and node slimming, presently on monitor for the late 2026/early 2027 window.
The proposal goals to carry privateness natively to Ethereum’s base layer with out further charges, token governance, or multi-sig coordination. It makes use of fixed-address system contracts and ZK verification precompiles to create a shared, protocol-level anonymity pool accessible to all wallets and functions. That shared pool issues: fragmented privateness apps presently break up liquidity and anonymity units throughout separate implementations, weakening the sensible privateness ensures for everybody. By embedding privateness at L1, EIP-8182 would break that fragmentation with out requiring application-level adjustments.
The proposal has entered competitors for a slot on the Core Builders’ laborious fork schedule — a course of that includes important technical and neighborhood debate earlier than something will get finalized.
Consensys CEO on Ethereum’s Zero-Information Future
Consensys CEO Joseph Lubin provided a longer-range view, stating that Ethereum may change into a totally zero-knowledge-proof-based protocol inside 3 to five years. Lubin pointed to Layer 2 networks already reaching real-time ZK proof era as proof that the expertise is maturing quick sufficient to succeed in L1. He envisions a future the place a number of formally verified provers help Ethereum on the base layer, ultimately enabling a bridge-free, single atomic execution surroundings that unifies fragmented liquidity.
Lubin additionally addressed the Ethereum Basis’s future construction, stating there won’t be a “second basis” — as an alternative, no less than three teams will spin off from the prevailing basis, focusing respectively on core protocol work, usability and scalability, and institutional outreach.
Ethereum Layer 2 Advances and Polygon zkEVM Shutdown
Ethereum’s Layer 2 ecosystem noticed each new launches and laborious deadlines this month. Essentially the most pressing improvement for current customers is Polygon zkEVM Mainnet Beta ceasing operations on July 1, 2026 — leaving roughly two weeks for customers to behave.
Starknet’s STRK20 Privateness Framework
Starknet launched STRK20, a zero-knowledge proof privateness framework that allows any ERC20 asset throughout the community to help non-public balances and confidential transfers. In contrast to conventional coin mixers, STRK20 embeds privateness features straight into the asset move reasonably than routing transactions via a separate mixing layer. The framework features a Viewing Keys mechanism, permitting customers to selectively disclose transaction information for compliance functions. The primary asset to undertake it’s strkBTC.
The framework will be utilized throughout transfers, buying and selling, lending, staking, and funds — a broad scope that means Starknet is positioning STRK20 as infrastructure reasonably than a characteristic.
Polygon zkEVM Mainnet Beta Ceasing Operations
Polygon’s zkEVM Mainnet Beta will formally shut down on July 1, 2026. Belongings held in wallets that haven’t accomplished cross-chain transfers will robotically migrate to Ethereum mainnet and will be claimed via a devoted interface. Nonetheless, belongings locked in DeFi protocols can’t be robotically migrated — these customers should manually withdraw LP positions and belongings earlier than the deadline or danger everlasting lack of entry.
The Base L2 community in the meantime deployed its Beryl improve to the Base Sepolia testnet, with mainnet activation deliberate for June 25. Beryl introduces the B20 token commonplace for issuing stablecoins and different belongings natively inside Base’s node software program, shortens the withdrawal window from Base to Ethereum from 7 days to five days, and brings Reth V2 to scale back node disk footprint.
Zcash Ironwood Improve and Community Safety Enhancements
Zcash is making ready a big community improve aimed toward resolving one of many extra severe vulnerabilities to floor on a privacy-first blockchain this 12 months.
Ironwood Targets the Orchard Privateness Pool
The Zcash Ironwood improve is deliberate for activation in July, designed to repair vulnerabilities within the Orchard privateness pool that beforehand threatened the community’s fastened provide ensures. The Zcash Basis had already launched Zebra 4.5.3 and 5.0.0 as emergency responses — Zebra 4.5.3 quickly disabled Orchard actions on mainnet through an emergency mushy fork at block peak 3,363,426, whereas Zebra 5.0.0 activated the NU6.2 laborious fork at block peak 3,364,600, re-enabling Orchard with a corrected circuit. The muse confirmed the vulnerability was found earlier than any recognized exploitation and that no unauthorized worth creation occurred.
Ironwood takes this additional. It would introduce a newly fastened privateness pool and step by step retire the previous one. As soon as full, customers and nodes will be capable to combination balances from each swimming pools to independently confirm that complete ZEC in circulation doesn’t exceed the laborious cap of 21 million cash — restoring decentralized confidence in Zcash’s provide mechanism.
Zcash core developer Sean Bowe confirmed that no less than three main auditing companies are reviewing the Orchard circuit, a number of AI auditing instruments are scanning the codebase, and formal verification work is progressing. The Valar Group has launched a testnet and begun implementing wallet-side adjustments. Progress, based on Bowe, is presently going easily.
Safety Alerts and Quantum Computing Advances
Two developments this month sit at reverse ends of the menace timeline: one is an lively assault taking place now within the npm ecosystem, the opposite is a quantum {hardware} milestone that is still theoretical for blockchain safety — however is shifting quicker than many anticipated.
SlowMist Warns of npm Malware Exploiting Stolen Developer Credentials
The SlowMist Safety Group issued an alert about new malware variants — recognized as Shai-Hulud, Miasma, and Hades — linked to the stolen developer account “czirker” and lively within the npm ecosystem. The assault vector is exact: malicious code triggers throughout npm set up through a pre-configured binding.gyp file, making it straightforward to overlook in commonplace dependency audits.
The confirmed numbers are notable. 23 affected packages have been recognized, with one — leo-logger — reaching 3,140 weekly downloads. Moreover, 408 GitHub repositories containing stolen credentials have been found. The malicious exercise spans theft of GitHub and npm tokens, cloud credentials throughout AWS, GCP, and Azure, native surroundings information, and abuse of GitHub Actions pipelines.
SlowMist recommends that safety groups instantly examine lockfiles and bundle information, take away affected packages, rotate all important keys, and implement two-factor authentication. The assault sample underscores a persistent danger in open-source ecosystems: credential theft on the developer account degree can contaminate lots of of downstream repositories earlier than detection.
Microsoft’s Majorana 2 Quantum Chip Unveiled
At its annual Construct convention, Microsoft unveiled Majorana 2, its second-generation topological quantum chip. The corporate claims the chip is 1,000 occasions extra dependable than its predecessor, with a mean qubit lifetime of 20 seconds — and a few qubits lasting as much as 1 minute. Microsoft anticipates shifting nearer to scalable quantum computing by 2029, with AI Agent instruments reportedly serving to speed up materials screening, measurement automation, and manufacturing optimization.
The announcement renewed exterior dialogue about quantum computing’s long-term implications for Bitcoin’s digital signature safety. That dialog is price having critically, however context issues: the hole between present quantum {hardware} and the computational threshold required to threaten Bitcoin’s elliptic curve cryptography stays very giant. Majorana 2 is a significant step in qubit reliability, not an imminent menace to stay blockchain networks.
What it does characterize is a reputable motive for Ethereum’s post-quantum migration analysis to speed up — and for tasks just like the Algorand Basis, which has printed a post-quantum safety roadmap focusing on broader quantum resistance by the tip of 2027, to remain forward of the curve. The sensible query for each main blockchain community is not whether or not quantum-resistant cryptography is required, however when the migration must be full.
FAQ
What privateness challenge was fastened in Bitcoin Core model 31.1?
Bitcoin Core 31.1 fastened a privateness vulnerability in model 31.0’s -privatebroadcast characteristic. Beneath sure situations involving a failed BIP324 v2 handshake, the software program would fall again to a v1 connection that bypassed the Tor proxy, probably exposing the transaction initiator’s IP tackle to the receiving node.
When is Ethereum’s Glamsterdam improve anticipated now?
Ethereum’s Glamsterdam improve has been postponed to the second half of the 12 months. Growth continues via Devnet-5 and Devnet-6 iterations, with the separate Hegotá laborious fork focusing on a late 2026/early 2027 window.
What’s EIP-8182 and its significance?
EIP-8182 is a local non-public switch proposal for Ethereum developed by Tom Lehman. It could introduce a non-mandatory, protocol-fee-free non-public switch mechanism straight at Ethereum’s L1 layer utilizing fixed-address system contracts and ZK verification precompiles. It has been formally Proposed for Inclusion within the Hegotá laborious fork and is important as a result of it targets protocol-level privateness reasonably than counting on fragmented application-layer privateness instruments.
What threats does the SlowMist malware alert spotlight?
SlowMist recognized malware variants (Shai-Hulud, Miasma, Hades) exploiting the stolen npm developer account “czirker” to contaminate packages throughout set up. The assault steals GitHub and npm tokens, cloud credentials from AWS, GCP, and Azure, and native surroundings information, whereas additionally abusing GitHub Actions. 23 packages and 408 GitHub repositories have been confirmed affected.
Article produced with the help of synthetic intelligence and reviewed by the editorial staff.