Ethereum Glamsterdam Bug Fix Saved Staking: Is $2,300 Safe?

The Bug That Could Have Stolen Ethereum Staking Deposits — And the Fix That Just Saved Them

Co-produced by Daniel Aharonoff and DigitalDan

As the chief editor of ethdan.me, I have a simple rule for upgrade season: the scariest stories in crypto are rarely the hacks you hear about. They are the bugs that get caught just in time, in code that has not shipped yet, by someone who bothered to read the fine print.

That is exactly what happened with Ethereum's Glamsterdam upgrade this week. Developers have patched a flaw that, in the worst case, could have let an operator walk off with ETH that staking services deposited to create new validators. No money was lost. No validator was harmed. But the near-miss matters — because it touches the single biggest pile of money in Ethereum today: the record 43.8 million ETH now locked in staking.

So what went wrong, how close did it come to shipping, and why does a technical fix in an unfinished upgrade matter to anyone holding ETH at $2,300? Let me walk you through it, because this one is worth understanding properly.

What's the Big Deal? A Deposit That Could Go to the Wrong Person

First, a quick primer, because Glamsterdam is one of those upgrades that sounds abstract until you see the money involved.

Ethereum today bundles two jobs together. Builders put transactions into blocks. Validators — who stake ETH to help secure the network — pick and confirm those blocks. Glamsterdam splits those two jobs apart, so builders and validators each do their own thing, more cleanly and more efficiently.

Both builders and validators deposit ETH. And their money is supposed to be tracked separately, even though both use the same kind of identifier: a public key.

Here is where researcher Avsetsin found the hole. During the upgrade itself, Ethereum would process deposits that were still waiting to be credited — pending deposits, in the jargon. Avsetsin described a scenario in which an operator first registers as a builder using a particular public key, and a staking service then deposits ETH to start a validator under that same key. Under the draft rules, both deposits would be credited to the builder.

Read that again, because the consequence is stark:

• The operator could withdraw the protocol's funds: Avsetsin wrote that the operator could withdraw money that was never theirs to take.
• No validator gets created: Because the deposit never lands as a validator, the staking service has no validator to show for its money.
• Recovery becomes nearly impossible: Without a validator, the staking service cannot produce the proof it would normally need to recover its funds.

Avsetsin, listed as a member of Lido's GitHub organization, examined how Lido, Origin, and Rocket Pool — three of the biggest names in Ethereum staking — could be affected. The researcher was careful to add an important caveat: these were conditional findings based on how each protocol handles deposits, not confirmed live exploits, and existing checks rejecting an earlier builder deposit could stop the attack in some cases.

Why You Should Care: 43.8 Million ETH Is Staked Right Now

This is where the story stops being a developer footnote and starts being a market story.

At the end of September, a record 43.8 million ETH was staked, according to a Bitwise report cited by The Block. That is nearly 36 percent of Ethereum's entire supply, locked up to secure the network. Staking inflows reached 7.96 million ETH in the first nine months of 2026 alone. Staked ETH is, by design, less liquid than ETH sitting on an exchange: it cannot be sold at a moment's notice, and that illiquidity is part of what tightens the tradeable supply of ETH.

Now put the bug in that context. A flaw in how validator deposits are credited is not a flaw in some side feature. It is a flaw in the front door of the staking system — the exact mechanism by which new validators are born. If stakers, or the services acting for them, cannot be certain that a deposit will land where it is supposed to land, the trust that underpins that 43.8 million ETH pile starts to crack.

That trust is precisely why the fix matters more than the bug's complexity suggests:

• Staking is Ethereum's bedrock now: More than a third of all ETH is staked. A deposit-handling flaw is a flaw in the foundation, not the paintwork.
• The victims would have been the careful ones: Staking services deposit on behalf of users who did everything right. A loss here would not have been a story about reckless leverage; it would have been a story about the system itself misdirecting money.
• Confidence compounds: Every upgrade that ships clean makes the next wave of staking easier. Every upgrade that ships with a known deposit flaw makes institutions ask harder questions — and institutions are already asking plenty, as we will see.

The fix, in plain language, sorts pending deposits by their withdrawal credentials — the setting that says where a deposit's money can eventually go. Validator deposits now stay with validators, even if a builder is using the same public key. Simple in hindsight, as the best fixes usually are. But it had to be written, tested, and merged before Glamsterdam moves any further toward mainnet.

Rejected, Then Rescued: How the Fix Almost Didn't Happen

Here is the part of the story that tells you something real about how Ethereum actually gets built — and it is messier, and more human, than the usual "developers ship upgrade" headline suggests.

The proposed fix was first closed on October 19. Justin Traglia, who maintains Ethereum's consensus specifications, wrote that there was not enough support from clients to make the change at that time. Clients are the separate software programs that validators run to take part in the network, and without client support, a specification change is just words on a page.

Then came further review. Avsetsin added tests on October 23. Traglia reopened the fix — and merged it on Monday, October 26, a week after it had been turned down.

That sequence tells you something real about how Ethereum gets built:

1. The system worked, but only just: A researcher found the flaw, wrote it up, and kept pushing after an initial rejection. That persistence is the difference between a patched upgrade and a post-mortem.
2. Rejection is not always the end: In open-source development, "not enough support right now" is a scheduling judgment, not a verdict on whether a bug is real. The reversal shows the process can correct itself — but it also shows how close a real flaw can come to being deferred.
3. The work is not finished: The change is now part of Ethereum's consensus specifications, but client teams still have to build it into their software. A specification is a blueprint; the clients are the building. Until they implement the revised deposit rules, Glamsterdam cannot proceed toward a mainnet launch on this point.

Glamsterdam still faces a separate hurdle: its October 26 Hoodi testnet launch was postponed after a smart-contract risk assessment, a different issue from the deposit bug.

What This Means for the Price: ETH at $2,300, the Fed on Wednesday

So the code is safer. What about the price? Because readers of ethdan.me do not live on specifications alone, and the market tape this week is doing its own complicated dance.

Ethereum rose 1.77 percent to about $2,347 on October 27, leading the major coins on a green day that also saw Bitcoin reclaim $80,000. But step back and the month is still ugly: ETH is down roughly 12 to 13 percent in October after peaking near $2,777 on October 2, and it has fallen harder than Bitcoin over the past month. Traders are watching $2,300 as the line in the sand — ETH dipped below it again recently, touching around $2,296 before bouncing — with the August low near $2,220 and then $2,200 below, and $2,400, then the $2,480 to $2,500 zone, above.

The institutional flows tell the same two-sided story as the upgrade:

• Bitcoin ETFs bounced, Ethereum ETFs bled: U.S. spot Bitcoin ETFs took in about $110 million on October 26, ending a run of outflows. U.S. spot Ethereum ETFs went the other way, losing $88.58 million the same day.
• One issuer drove the Ethereum outflow: BlackRock's ETHA lost $104.71 million on October 26, partly offset by $16.13 million into Fidelity's FETH. Every other Ethereum fund was flat that day — a reminder that this was concentrated selling, not a stampede across every product.
• October is now Ethereum ETFs' worst month of the year: Total October outflows have passed $1.1 billion, with a fourth straight week of net redemptions. Yet cumulative net inflows since launch still stand at about $12.63 billion, and total net assets at roughly $14.07 billion — the money has thinned out, not walked away entirely.
• The Fed decides Wednesday, October 28: That rate decision is the next big macro catalyst, and traders are openly waiting for it before taking a strong side. A cautious market plus a technical fix is a strange combination: better code, nervous money.

The fix removes a tail risk from the staking story. It does not, by itself, reverse ETF selling or lift ETH back above $2,400 — code safety is necessary for a recovery, not sufficient for one.

Three Things I'm Watching Next

If you want to know whether this near-miss turns into a footnote or a turning point, watch these three things — in this order:

• Client implementation: Do the major client teams build the revised deposit rules into their software promptly?
• The Hoodi restart: When does the postponed Hoodi testnet launch get rescheduled, and does it go cleanly? Two separate issues in one week — the builder-deposit bug and the smart-contract assessment — mean the next testnet result will be read as a verdict on Glamsterdam's readiness, fairly or not.
• The $2,300 line into the Fed decision: Does ETH hold $2,300 through Wednesday's Fed announcement, or does a daily close below it open the path toward $2,220 and $2,200? And do Ethereum ETF outflows slow from their October pace, or does the $1.1 billion monthly total keep growing? The first green week of ETF flows would do more for sentiment than any code merge.

Final Thoughts: The Best Bug Is the One You Never Hear About

As the chief editor of ethdan.me, I will be blunt: nobody is going to throw a party for a merged specification change. There is no price chart for "disaster avoided." But this is exactly the kind of story that separates a maturing network from a reckless one.

Ethereum caught a flaw that could have misdirected staking deposits to builders. It caught it before mainnet, before any loss, and after an initial rejection that could easily have ended the conversation. The fix is now in the specifications, the clients are next, and the testnets will tell us whether Glamsterdam is ready for the big stage.

Meanwhile, 43.8 million ETH sits staked — a vote of confidence so large it dwarfs any single day of ETF flows. That confidence is not automatic. It is earned, bug by bug, review by review, in public, by researchers like Avsetsin and maintainers like Traglia who are willing to reopen a closed proposal when the evidence demands it.

Is $2,300 safe? The code just got safer. The market still has to prove it. But if you are looking for a reason to believe Ethereum's foundation is being taken seriously, this week gave you one — written not in a price rally, but in a patch.

Stay tuned to ethdan.me for daily Ethereum coverage, market analysis, and the stories behind the upgrades and money flows that actually move this market.

Co-produced by Daniel Aharonoff and DigitalDan