EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar27 Oct 2026
Ethereum developers have merged a fix for a flaw in the upcoming Glamsterdam upgrade that could have let an operator withdraw ETH that staking services meant for new validators. The patch was rejected on Oct. 19, reopened after further review and merged on Monday. No losses have been reported.
Ethereum TradeReviewed News Desk
Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let an operator walk off with ETH that staking services intended for new validators, CoinDesk reported. The fix changes how validator deposits are handled and was merged on Monday, about a week after developers first turned it down.
What Glamsterdam changes
Glamsterdam separates two roles that are bundled together on Ethereum today. Builders assemble blocks of transactions, while validators, who stake ETH to secure the network, pick and confirm those blocks. Under the upgrade, both builders and validators can deposit ETH, and their funds are supposed to be tracked separately.
How the flaw worked
The issue sat in the moment of the upgrade itself, when the network processes deposits that are still waiting to be credited. A researcher using the handle avsetsin described a scenario in which an operator first registers as a builder with a given public key, the identifier tied to a validator or builder. If a staking service then deposited ETH to start a validator under that same key, the draft rules would credit both deposits to the builder.
“The operator can withdraw the protocol’s funds,” avsetsin wrote. Because no validator would be created, the staking service could not produce the proof needed to recover its money.
The researcher, listed as a member of Lido’s GitHub organization, looked at how Lido, Origin and Rocket Pool might be affected, but stressed that these were “conditional code findings, not confirmed live exploits.” Existing checks that reject an earlier builder deposit could stop the attack, and no losses have been reported.
Rejected, then merged
Developers closed the proposed fix on Oct. 19. Justin Traglia, who maintains Ethereum’s consensus specifications, wrote at the time that there was not enough support from client teams. The proposal was reopened after more review, tests were added on Oct. 23, and Traglia merged it on Monday.
Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that defines where a deposit’s money can eventually go. Validator deposits stay with validators even if a builder uses the same key.
What it means for traders
The fix is now part of the consensus specifications, but every client team still has to build it into its software. Glamsterdam has already run on the Sepolia testnet, while its Oct. 26 launch on the Hoodi testnet was postponed. A new Hoodi date is needed before a mainnet launch can be scheduled, so traders positioning around the upgrade should expect the timeline to depend on client readiness rather than a fixed date. Staking protocols such as Lido and Rocket Pool are worth watching for any follow-up statements.
If you trade ETH or liquid staking tokens around upgrade news, compare fees and spot liquidity first in our exchange comparison. Our tested picks are BingX and OKX, and you can see how we rate platforms on how we test. This is news, not financial advice.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.