Welcome to The Protocol, CoinDesk’s weekly wrap of the most important stories in cryptocurrency tech development. I’m Margaux Nijkerk, a reporter at CoinDesk.
In this issue:
AI agent forms its own company, gets ready to trade crypto
Solana’s ‘Alpenglow’ upgrade could arrive next quarter, co-founder Yakovenko says
Ripple to share North Korean threat intelligence with crypto firms
AI agents are breaking web economics, but Cloudflare says x402 can help
SOLANA’S ALPENGLOW UPGRADE COULD COME NEXT QUARTER: Solana co-founder Anatoly Yakovenko said a major upgrade to the network, dubbed Alpenglow, is expected to arrive as soon as this year, potentially within the next quarter, marking what he described as a pivotal step in the blockchain’s technical evolution. “So the Alpenglow release is basically due sometime this year, I think next quarter,” Yakovenko said during a fireside panel at Consensus Miami 2026. “That, to me, is this exciting step in the evolution of the protocol.” In simple terms, Alpenglow is about making Solana faster, more predictable and more secure at its core. Blockchains like Solana rely on a network of computers to agree on the order of transactions. Today, that process can introduce delays or uncertainty depending on network conditions. Alpenglow aims to tighten those guarantees. Yakovenko described a system where transaction confirmations approach the physical limits of how fast information can travel, essentially, near the “speed of light” around the globe. For users and developers, that means quicker finality (knowing a transaction is permanently settled) and a more reliable foundation for building applications. — Margaux Nijkerk Read more.
RIPPLE SHARING INTELLIGENCE ON NORTH KOREA HACKING THREAT: Ripple is now sharing its internal threat intelligence on North Korean hackers with the crypto industry, the company said, in a move that reframes how the sector is responding to a shift in DPRK attack methodology. The Drift hack was not a hack in the way most people think of one. Nobody found a bug or exploited a smart contract. North Korean operatives spent months befriending Drift’s contributors, slipped malware onto their machines, and walked off with the keys. By the time the $285 million moved, every system that was supposed to catch a hack had nothing to flag. That is the version of events Ripple and Crypto ISAC, the crypto industry’s threat-sharing group, laid out Monday alongside news that Ripple is now sharing its internal data on North Korean threat actors with the rest of the sector. The 2022-24 wave of more DeFi hacks was centred on exploiting code, with attackers finding smart contract vulnerabilities and draining protocols in minutes. But as security gets tighter, the modus operandi shifts from technology to people. Rogue operatives apply for jobs at crypto firms, pass background checks, show up on Zoom calls and build trust for months. Then they deploy attacks that no traditional security tool was built to catch, because the attacker is already inside. Ripple is now feeding Crypto ISAC the kind of profile data that makes that pattern legible across companies. — Shaurya Malwa Read more.
CLOUDLFARE ON AI AGENTS AND WEB ECONOMICS: For decades, the web ran on a simple bargain: Publishers and businesses made information freely accessible, search engines and other crawlers indexed it, and those services sent human traffic back. Sites could then monetize that traffic through ads, subscriptions or commerce. But that’s all changing fast, Cloudflare Chief Strategy Officer Stephanie Cohen said at CoinDesk’s Consensus conference in Miami. With the rise of AI agents, software can scrape a webpage, summarize content and keep the source user inside a chatbot or automated workflow instead of sending a person back to the original site. Cohen said that shift is breaking the internet’s old business model, with non-human traffic now exceeding human engagement. Cloudflare’s proposed answer is to give websites more control over automated traffic: identify the bots, verify who they are, understand what they intend to do and decide whether to allow, block or charge them. Cohen pointed to x402, an open payments protocol built around the HTTP 402 “Payment Required” status code, as one piece of that stack. — Jeffrey Albus Read More.
In Other News
Coinbase is set to slashing its workforce by roughly 14%, or 660 employees in response to negative market conditions and AI challenges. CEO Brian Armstrong announced the cuts in an X post, citing the “two forces” that converged in his firm’s decision to slash staff. Coinbase has more than 4,700 employees, according to its website, so 14% would be equivalent to around 660. “While we’ve managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth,” said the CEO of the Nasdaq-listed company. The second reason is AI, and how it is changing the way Coinbase operates, he said. “Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks,” Armstrong stated, adding that “the pace of what’s possible with a small, focused team has changed dramatically, and it’s accelerating every day.” — Olivier Acuna Read more.
Bullish, CoinDesk’s parent company, has agreed to acquire transfer agent and shareholder services firm Equiniti in a $4.2 billion deal that would fold a core piece of traditional market infrastructure into its digital asset platform, expanding its push into tokenized securities. The transaction comprises $1.85 billion of assumed Equiniti debt and roughly $2.35 billion in Bullish stock, priced at $38.48 per share based on Bullish’s 30-day VWAP through May 4, according to a press release. After initially declining on news of the all-stock deal, Bullish shares have surged 17% in morning U.S. trade. The transaction gives Bullish, a regulated transfer agent, a required function for public companies, alongside its existing tokenization, trading and market infrastructure capabilities. — Will Canny Read more.
Regulatory and Policy
Lawyers seeking to seize $71 million in frozen ether for victims of North Korean terrorism changed their legal strategy Tuesday, arguing in a new court filing that the April 18 rsETH exploit was not theft but fraud, directly countering Aave’s attempt to void a restraining notice blocking the release of the assets. In a 30-page opposition brief filed in the Southern District of New York, a lawyer representing the North Korean terror victims argues the exploit was not a smash-and-grab theft but a fraudulent lending transaction, and that under longstanding U.S. law, fraudsters who acquire property through deception can obtain legal title to it, even if that ownership is later reversible. “What actually happened is that North Korea borrowed assets from users of the ‘Aave Protocol’ and did not pay it back, and when the ‘Aave Protocol’ sought to liquidate North Korea’s collateral, the ‘Aave Protocol’ unhappily discovered that the collateral was worthless,” the new filing reads. — Sam Reynolds Read more.
Brad Garlinghouse, Ripple’s CEO, has been closely following the U.S. Senate’s progress on the crypto market structure bill, and he said it’s not a “done deal” as the next two weeks may be pivotal for the legislation’s chances. “If it doesn’t happen then, I think the likelihood is going to drop precipitously,” Garlinghouse said Tuesday at Consensus 2026 in Miami. But he said he still thinks it’s likely to happen, and the next moment will be the scheduling of the Senate Banking Committee’s long-awaited hearing to “mark up” the bill and advance it to the next stage. Senators at the center of the negotiations over the Digital Asset Market Clarity Act revealed last week the latest compromise language on a major sticking point — stablecoin yield — that is expected to allow the banking panel to schedule the hearing. “Do I think it’s perfect? Hell, no,” Garlinghouse said. “There’s tradeoffs and compromises, but I do think clarity is better than chaos.” The stablecoin compromise aims for a balance that allows crypto firms to pursue certain rewards programs without offering yield-bearing stablecoin accounts that resemble banks’ interest-bearing deposits that fuel U.S. lending. Crypto insiders have generally agreed that it’s acceptable, but a coalition of banking groups said this week that the deal “falls short.” — Jesse Hamilton Read more.
President Gustavo Petro said Colombia’s Caribbean coast could host bitcoin mining facilities powered by surplus renewable energy, following a path similar to Paraguay.
What to know:
President Gustavo Petro is promoting Colombia’s Caribbean cities as bitcoin mining hubs that would use the country’s surplus renewable energy.
Petro has proposed giving the Indigenous Wayúu community co-ownership in potential mining projects, framing the plan as a major development opportunity for the region.
