Ethereum developers patched a flaw in the upcoming Glamsterdam upgrade that could have allowed an operator to withdraw ETH intended for new validators. The vulnerability involved builder and validator deposits sharing a public key, potentially crediting both deposits to the builder and leaving staking services unable to recover their funds.
Tech Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders Developers initially rejected the change before reversing course, as testing delays gave them more time to examine a flaw in Ethereum’s upcoming Glamsterdam upgrade. By Shaurya Malwa Oct 27, 2026, 3:09 a.m. EDT 2 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on Ethereum fixes Glamsterdam bug that could have sent staking deposits to builders. (Ethereum) Summary Show Ethereum developers patched a flaw in the upcoming Glamsterdam upgrade that could have allowed an operator to withdraw ETH intended for new validators. The vulnerability involved builder and validator deposits sharing a public key, potentially crediting both deposits to the builder and leaving staking services unable to recover their funds. No losses have been reported, and client teams must now incorporate the revised deposit rules before Glamsterdam can proceed toward a mainnet launch. Ethereum developers have patched a flaw in the upcoming Glamsterdam upgrade that could have let someone walk off with ETH that staking services meant for new validators. The fix, which changed the rules for handling validator deposits , was merged Monday, a week after developers turned it down. Glamsterdam splits up two jobs that are bundled together today. Builders put blocks of transactions together, and validators, who stake ETH to help secure the network, pick and confirm them. Both can deposit ETH, and their money is supposed to be tracked separately. How the money could go missing The problem appeared during the upgrade itself, when Ethereum would process deposits that were still waiting to be credited. Researcher avsetsin identified a scenario in which an operator first registers as a builder using a particular public key, the identifier tied to a validator or builder. If a staking service then deposits ETH to start a validator under that key, the draft rules would credit both deposits to the builder. “The operator can withdraw the protocol’s funds,” avsetsin wrote. No validator gets created, so the staking service can’t produce the proof it would need to recover its money. Avsetsin, who is listed as a member of Lido’s GitHub organization, looked at how Lido, Origin and Rocket Pool could be affected, in what the researcher called “quick AI research.” The findings depended on how each protocol handles deposits. “These are conditional code findings, not confirmed live exploits,” avsetsin wrote, adding that existing checks rejecting an earlier builder deposit could stop the attack. No losses have been reported. Turned down, then merged Developers closed the proposed fix on Oct. 19 . “There was not enough support from clients to make this change at this time,” wrote Justin Traglia, who maintains Ethereum’s consensus specifications. Clients are the separate software programs validators run to take part in the network. The fix was reopened after further review, avsetsin added tests on Oct. 23, and Traglia merged it Monday. Under the new rules, pending deposits are sorted by their withdrawal credentials, the setting that says where a deposit’s money can eventually go. Validator deposits stay with validators even if a builder is using the same key. The change is now part of Ethereum’s consensus specifications, and client teams still have to build it into their software. Glamsterdam needs a new Hoodi date before a mainnet launch can be scheduled. Read More: Ethereum delays Glamsterdam test after security devs flag risk to existing contracts Latest Crypto News 1 Zcash co-founder proposes ending grants funding, citing $125 million treasury 1 hour ago 2 Ripple gets a final go-ahead to launch its own U.S. national trust bank 2 hours ago 3 Tom Lee’s Bitmine favors share buybacks to ether purchases as crypto declines 15 hours ago 4 NBA joins pro sports leagues on CFTC prediction markets bandwagon while NFL balks 15 hours ago 5 OCC calls on community banks to enter the stablecoin payments market 15 hours ago 6 South Korea weighs fourth delay on its crypto gains tax, pushing it to 2029 16 hours ago 7 Canada opens consultation on draft stablecoin rules, maintains ban on yields 17 hours ago 8 AI giant Anthropic files for blockbuster IPO 18 hours ago 9 A $68 million bitcoin bet is targeting a post-midterm election breakout to $90,000 19 hours ago 10 Bitcoin holds near $80,000 as oil retreats and the Fed decision looms 19 hours ago Latest Research Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. By CoinDesk Research Sep 24, 2026 Commissioned by RealFi Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. Why it matters : Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. View Full Report More From Tech Live news: Bitcoin dips below $80,000 as stocks rally following Anthropic IPO filing Bitcoin wallet bug let rogue servers steal funds when users tried to speed up payments Block’s new voice AI sounds eerily human, sparking awe and scam fears