Welcome to The Protocol, CoinDesk's weekly wrap of the most important stories in cryptocurrency tech development. I’m Margaux Nijkerk, a reporter at CoinDesk.

In this issue:

• Ethereum Developers Prep for Fusaka, Second Upgrade of 2025
• Anthropic Research Shows AI Agents Are Closing In on Real DeFi Attack Capability
• Ethereum Devs Push ZK ‘Secret Santa’ System Toward Deployment
• Bitnomial Prepares to Debut First CFTC-Regulated Spot Crypto Market

Network News

FUSAKA WILL GO LIVE ON ETHEREUM: Ethereum developers are preparing for the network’s second upgrade of 2025 to go live later today. Fusaka – a blend of the names Fulu + Osaka – consists of two upgrades happening on Ethereum’s consensus and execution layers at the same time. The goal of the upgrade is to enable Ethereum to handle the large transaction throughput from the layer-2 chains that use the blockchain as their base layer. Fusaka consists of 12 code changes, also known as “Ethereum Improvement Proposals” (EIPs) that will make the layer-2 experience faster and cheaper. The biggest change in Fusaka is known as PeerDAS, which allows validators to check only segments of data instead of full “blobs,” easing bandwidth demands and lowering expenses for both validators and layer-2 networks. Layer 2s currently submit thousands of transactions to Ethereum via “blobs,” where validators currently on the Ethereum blockchain have to download all of the transaction data from the blob to verify it is accurate, creating bottlenecks. With this improvement, those validators will only need to verify a fraction of a blob, speeding up the process and lowering the transaction fees that come with it. — Margaux Nijkerk Read more.

ANTHROPIC STUDY ON DEFI AI AGENTS: AI agents are getting good enough at finding attack vectors in smart contracts that they can already be weaponized by bad actors, according to new research published by the Anthropic Fellows program. A study by the ML Alignment & Theory Scholars Program (MATS) and the Anthropic Fellows program tested frontier models against SCONE-bench, a dataset of 405 exploited contracts. GPT-5, Claude Opus 4.5 and Sonnet 4.5 collectively produced $4.6 million in simulated exploits on contracts hacked after their knowledge cutoffs, offering a lower bound on what this generation of AI could have stolen in the wild. The team found that frontier models did not just identify bugs. They were able to synthesize full exploit scripts, sequence transactions and drain simulated liquidity in ways that closely mirror real attacks on the Ethereum and BNB Chain blockchains. The paper also tested whether current models could find vulnerabilities that had not yet been exploited. GPT-5 and Sonnet 4.5 scanned 2,849 recently deployed BNB Chain contracts that showed no signs of prior compromise. Both models uncovered two zero-day flaws worth $3,694 in simulated profit. One stemmed from a missing view modifier in a public function that allowed the agent to inflate its token balance. Another allowed a caller to redirect fee withdrawals by supplying an arbitrary beneficiary address. In both cases, the agents generated executable scripts that converted the flaw into profit. Although the dollar amounts were small, the discovery matters because it shows that profitable autonomous exploitation is technically feasible. — Sam Reynolds Read more.

ETHEREUM DEVELOPERS PUSH ZK PROTOCOL FOR PRIVACY: Ethereum developers are refining a zero-knowledge protocol designed to bring stronger privacy guarantees to on-chain interactions, starting with a “Secret Santa”-style matching system that could evolve into a broader toolkit for private coordination. Solidity engineer Artem Chystiakov resurfaced the research on Monday in an Ethereum community forum post, pointing to work he first published in January on arXiv.The idea aims to recreate the anonymous gift-exchange game on Ethereum, where participants are randomly matched without anyone learning who is sending to whom. Doing that on a transparent blockchain, however, requires solving several long-standing issues around randomness, privacy and Sybil-resistance. Chystiakov said the core problems are straightforward: “Everything on Ethereum is visible to everyone,” blockchains do not provide true randomness, and the system must prevent users from registering multiple times or assigning gifts to themselves. The proposed protocol uses zero-knowledge proofs to verify sender–receiver relationships without revealing identities, and a transaction relayer to submit moves so individual wallets cannot be linked to actions. In the proof-of-concept, participants register their Ethereum addresses in a smart contract and commit to a unique digital signature, which blocks duplicate entries. Each participant then submits a random number to a shared list through the relayer. Because the relayer broadcasts the transactions, no one can tell which address contributed which number. Receivers encrypt their delivery details using these shared numbers, ensuring only their assigned counterpart can decrypt them. — Shaurya Malwa Read more.

BITNOMIAL ROLLS OUT SPOT TRADING IN U.S.: Bitnomial, a Chicago-based derivatives exchange, is preparing to roll out the first spot cryptocurrency trading platform overseen by the U.S. Commodity Futures Trading Commission (CFTC). The Chicago-based derivatives exchange’s self-certified rules became effective last week, authorizing it to list both leveraged and non-leveraged spot crypto products. The approval opens the door for customers to buy, sell and finance digital assets directly on a federally regulated commodities exchange — a first in the U.S. market.Caroline Pham, the acting head of the CFTC, said in November that it was in talks with regulated exchanges over the potential launch of spot crypto products. Bitnomial’s approval lands as the CFTC accelerates its effort to bring retail-facing crypto markets under federal commodities oversight. Pham has argued the agency already has sufficient authority to supervise spot crypto commodities. The CFTC and the Securities and Exchange Commission recently revealed that nothing in current law prevents exchanges registered with either regulator from listing certain crypto commodity products, including those with leverage, so long as they coordinate with agency staff. The approval could pave the way for other exchanges that hold designated contract market (DCM) status, including Coinbase and prediction market venues like Kalshi and Polymarket. – Oliver Knight Read more.

In Other News

• Kalshi, a U.S.-based prediction market, has closed its $1 billion financing round, which has pushed its valuation to around $11 billion, according to a press release. The latest round was led by Paradigm, with participation from veteran venture capital firms including Sequoia Capital and CapitalG, Alphabet’s growth-equity arm. The news of the raise broke last month, when TechCrunch reported the $1 billion raise.Kalshi, which offers binary event contracts that allow users to trade on outcomes of future real-world events like political races and legislation, overtook its rival Polymarket in Q3, racking up $4.47 billion in trading volume compared to Polymarket's total of $3.5 billion, according to TokenTerminal data. — Oliver Knight Read more.
• Antithesis, a Northern Virginia startup pitching itself as infrastructure for never-down software, raised a $105 million Series A led by Jane Street, a bet that stress-testing distributed systems matters as much for blockchains as it does for high-speed trading. The company’s platform uses deterministic simulation testing, running large-scale, production-like simulations to surface the kinds of edge cases that can blow up in live networks, Antithesis said in a press release. When a failure hits, Antithesis said it can replay the bug exactly, helping engineers isolate issues without the usual can’t reproduce limbo, a familiar pain point for crypto protocols where small glitches can cascade into chain instability. — Will Canny Read more.

Regulatory and Policy

• The U.K. now formally recognizes cryptocurrency as property following the passing of a new law this week. The Property (Digital Assets etc) Act received Royal Assent, the final step of an act becoming law after being passed by Parliament. The act, approved by King Charles on Tuesday, was designed to modernize property law to take account of digital assets. Previously, property fell into one of two categories: things in possession, such as physical objects, and things in action, such as a debt. The law establishes a third category that includes digital assets such as cryptocurrencies and non-fungible tokens (NFTs). Crypto industry associations welcomed the law, hailing it as an important step in the legal recognition of digital assets and therefore instilling greater confidence for users.— Jamie Crawley Read more.
• President Karol Nawrocki of Poland has refused to sign a bill that he believed would have imposed overly-stern regulations on the cryptocurrency market. The president vetoed provisions of the bill on the basis that they "pose a real threat to the freedom of Poles, their property and the stability of the state," according to an update on his website. The Cryptoasset Market Act was Poland's legislation to bring it in line with the European Union's (EU) Markets in Crypto-Assets (MiCA) regulation, which is the bloc's framework to establish a single rulebook for oversight of the crypto industry. President Narwocki was concerned that the act would allow the government to disable crypto companies websites "with a single click," and that the regulation on domain blocking lack transparency and were open to abuse. — Jamie Crawley Read more.

Calendar

• Dec. 11-13: Solana Breakpoint, Abu Dhabi
• Feb. 10-12, 2026: Consensus, Hong Kong
• Feb. 17-21, 2026: EthDenver, Denver
• Mar. 30-Apr. 2, 2026: EthCC, Cannes
• Apr.15-16, 2026: Paris Blockchain Week, Paris
• May 5-7, 2026: Consensus, Miami