Ethereum Closes Staking Bug Before Glamsterdam Launch
Ethereum engineers closed a flaw in the upcoming Glamsterdam upgrade that could have let one operator claim deposits meant for new validators. No funds were lost, but the fix shows why staking apps need thorough testing before new network rules go live.
What actually happened
The fix merged on 26 October 2026, changing how pending validator deposits get processed, CoinDesk reported. Researcher Avsetsin, tied to Lido's GitHub organization, found that an operator registering as a builder with a specific public key could claim both builder and validator funds if a staking service reused that key. Avsetsin wrote, 'The operator can withdraw the protocol's funds.' Developers first rejected the fix on 19 October 2026, with spec maintainer Justin Traglia citing weak client support. After more testing, Traglia merged it on 26 October 2026. Separately, treasury firm Bitmine added 10,452 ETH and spent $46 million (USD) on buybacks, with chairman Tom Lee saying a 'crypto bull market is underway,' per The Block. ETH traded near $2,345, up 0.36% in 24 hours.
How we got here
Glamsterdam splits block building from validation, letting specialized builders assemble blocks while validators, who stake ETH, pick which ones confirm. The upgrade already ran on the Sepolia test network. Its planned 26 October launch on Hoodi, another test network, was pushed back once developers spotted the shared-key deposit flaw, giving them time to patch it before any live network touched real stake.
Why this matters for you
For everyday wallet users, this matters even if you never read a spec sheet. Pooled staking services like Lido and Rocket Pool handle deposits for millions of smaller holders, including people staking through apps built on top of Ethereum. A bug like this, left unpatched, could have frozen or redirected pooled funds without any single user noticing until withdrawal time. For now, nothing changes for holders or stakers inside the bonuz ecosystem: no funds were at risk, and the fix landed before any mainnet date was set. Builders integrating staking features get a concrete lesson in handling shared identifiers across deposit types.
The bigger question
Ethereum keeps separating functions that used to run together, building, validating, staking. Each split adds a new coordination point where a shared key or edge case can misroute funds. How much added complexity can a decentralized network absorb before coordination itself becomes the main source of risk?
What to watch
Glamsterdam still needs a new Hoodi testnet date before any mainnet schedule follows. Client teams must finish coding the revised deposit-sorting rules first. Bitmine reported $15 billion (USD) in combined crypto, cash, and securities as of 25 October 2026, a figure worth tracking for future treasury moves.
