The cost of keeping a network safe: Blast quits, Arbitrum and CLN go defensive

Victoria Shinder03 October 2026, 13:002 min read

Three announcements on 2 October came from very different parts of crypto, but they share a theme: the cost of keeping a network secure no longer stops after launch, and it is rising.

Blast decided the cost was not worth paying. The Ethereum layer 2 is shutting down because, in its words, the ongoing costs of maintaining the chain exceed the revenue it generates. Usage revenue last month was $1,793, against about $3.5m at the 2024 peak. CoinDesk's account of the closure points out that a chain still pays for development, infrastructure and security after users leave, and that a run of exploits has made security spending harder to cut. Source: https://www.coindesk.com/tech/2026/10/02/once-a-usd2-billion-ethereum-layer-2-blast-is-shutting-down-after-assets-plunge-98

Arbitrum paid in functionality. Its Security Council blocked new activations of Stylus programs on One and Nova, citing increasingly sophisticated AI-assisted attacks using hand-built WebAssembly. The known bugs threaten liveness, not funds, and active programs keep running. The Council also installed a guard that can pause One's settlement to Ethereum if two conflicting proofs are accepted. Source: https://cryptoslate.com/arbitrum-pauses-new-stylus-activations-over-ai-assisted-attack-risks

Core Lightning asked its operators to pay in attention. The team told anyone on version 26.06.7 or earlier to upgrade as soon as possible after reports that attackers were targeting unpatched nodes, according to Cointelegraph. It did not say which flaws were being used. The September release it points to fixed bugs reported by more than a dozen parties and deliberately held back some tests so the fixes would be harder to reverse-engineer; in August the team had described working through a high volume of AI-generated vulnerability reports. Source: https://cointelegraph.com/news/core-lightning-urges-upgrade-amid-reports-attackers-targeting-unpatched-nodes

What connects them. In all three cases, the expense is not a one-off audit but continuing work: reviewing reports, shipping fixes, getting operators to install them, and sometimes switching features off. Two of the three explicitly link the pressure to AI — as a tool for attackers in Arbitrum's case and as a flood of reports in Core Lightning's. Blast is what the arithmetic looks like when revenue cannot cover that work.

For users the practical lessons are plain. A network's security depends on someone being paid to keep doing it; when activity and fees disappear, that someone may leave. Node operators should treat "upgrade now" notices as part of the job, not an interruption. And anyone holding assets on a small chain should know in advance how to exit through the contracts, because that is the route left when the interface goes.