Ethereum fixed a Glamsterdam bug that sent deposits to builders

Ethereum developers merged a fix on 26 October for a Glamsterdam bug that could have credited a validator's stake to a block builder. The condition was narrow and specific: if a builder registered with a public key and a staking protocol later deposited ETH for a validator under that same key, the upgrade's original rules would have assigned both amounts to the builder's balance, which the builder could then withdraw.

“An operator could first register as a builder using a particular public key. If a staking protocol subsequently submitted ETH to establish a validator under that same key, the original upgrade rules could have credited both deposits to the builder's balance.”

— Avsetsin, the researcher who reported it, https://bitcoinist.com/ethereum-developers-fix-critical-glamsterdam-bug-that-threatened-staking-deposits/

Nobody lost anything. Glamsterdam has been running on the Sepolia testnet since 6 October and had not reached mainnet, which is the entire point of having testnets. The Hoodi activation has been pushed back again while clients implement the correction.

The fix changes what the rules key on. Pending deposits are now classified by withdrawal credentials rather than by public key alone, so a validator deposit stays attached to the validator even when a builder is using an identical key. That is a one-line description of a change that took three weeks to agree.

A rejected patch that turned out to be right

The process is the interesting part. Researcher Avsetsin reported the issue and proposed a correction. Justin Traglia, who maintains the consensus specifications, closed the proposal on 19 October. Avsetsin came back on 23 October with additional tests, and the fix was merged on the 26th. A rejected patch that turned out to be right is a better advertisement for the review process than a patch that sailed through.

The size of what was at risk is worth stating precisely, because the headline word is deposits and the number depends on which kind. A standard validator deposit is 32 ETH, which at $2,333.92 on 27 October is $74,685. Since the Pectra upgrade a compounding validator can hold up to 2,048 ETH, or $4.78m at the same price. One successful key collision would have moved somewhere between those two figures, per collision.

Second Glamsterdam problem this month

This is the second Glamsterdam problem in a month. We reported on 23 October that the same upgrade had its testnet fork delayed over a gas-related flaw. Two independent findings before mainnet is what a slow upgrade cycle is supposed to produce, and it is also why the Ethereum roadmap keeps slipping. Both of those sentences are true at once.

Informational material, not investment advice. No funds were lost, the bug never reached mainnet, and the dollar figures are our own conversion of the 32 and 2,048 ETH limits at the price on 27 October 2026.