Ethereum developers patched a bug in the upcoming Glamsterdam upgrade that could have let an operator claim ETH meant for new validators. The fix closes a fund-loss scenario before any staking service lost money, and before the upgrade reaches a live network.
What actually happened
The fix, merged on 26 October 2026, changes how pending validator deposits are processed, according to CoinDesk. Researcher Avsetsin, listed as a member of Lido's GitHub organization, found that an operator registering as a builder with a specific public key could claim both builder and validator deposits if a staking service used the same key. 'The operator can withdraw the protocol's funds,' Avsetsin wrote. Developers rejected the proposed fix on 19 October 2026. Justin Traglia, who maintains Ethereum's consensus specifications, said there was 'not enough support from clients to make this change at this time.' After added tests, Traglia merged the fix on 26 October 2026. No losses were reported. Separately, Ethereum treasury firm Bitmine added 10,452 ETH and spent $46 million on share buybacks, as chairman Tom Lee said 'crypto bull market is underway,' per The Block. ETH traded at $2,345, up +0.36% over 24 hours, with a 24-hour high of $2,337 and low of $2,296.
How we got here
Glamsterdam is Ethereum's next major upgrade. It separates block building from validation, a design called proposer-builder separation. Builders assemble blocks, while validators, who stake ETH to secure the network, choose which blocks to confirm. The upgrade already ran on the Sepolia test network, but its 26 October launch on the Hoodi test network was postponed after developers flagged the deposit flaw. That delay gave researchers extra time to examine the shared public-key scenario before Glamsterdam reached a live network, a sequence detailed by CoinDesk.
Why this matters for you
For stakers, the fix removes a scenario where a staking service's deposit could have become unrecoverable, a risk relevant to protocols like Lido, Origin, and Rocket Pool that pool user ETH into validators. For client teams, the merged specification means new code must ship before any mainnet date is set. For ETH holders, the episode shows testing can catch fund-risk bugs before launch. Builders working on proposer-builder separation now have a concrete case for handling shared keys across deposit types.
The bigger question
Ethereum's roadmap keeps separating roles once bundled together, building, validating, staking. Each split adds a coordination point where a shared identifier or edge case can move funds unexpectedly. How much added complexity can a decentralized network absorb before coordination itself becomes the main source of risk?
What to watch
Glamsterdam still needs a new Hoodi testnet date before developers can schedule a mainnet launch. Client teams must implement the revised deposit-sorting rules first. Bitmine reported $15 billion in combined crypto, cash, and securities as of 25 October 2026, a figure worth tracking for further treasury moves.
This article is information, not financial advice. Prices are a snapshot and change constantly. Nothing here is a recommendation to buy or sell any asset. Do your own research.
