Lido engineer warns of staking deposit hijack risk at Glamsterdam

Ethereum’s next big upgrade is supposed to make the network better. Lido’s head of engineering thinks it could also briefly make it easier to steal stakers’ ETH. On October 20, 2026, Dima Gusakov, Head of Engineering at Lido Finance, publicly flagged a potential front-running attack. The risk targets delegated staking protocols during the transition to the Glamsterdam hard fork. The window is narrow, but the stakes involve the deposits that make liquid staking work. How the attack would work Glamsterdam introduces builder deposits that use a specific type of withdrawal credentials, marked with the 0xB0 prefix. Withdrawal credentials essentially tell the network who owns the staked ETH and where it ultimately goes. According to Gusakov’s warning, builder deposits and validator deposits will run through shared deposit queues around the fork. That overlap creates an opening. A malicious node operator with the right access could submit a builder deposit that preemptively claims ETH meant for a staker’s validator. The result, if the attack succeeds: the deposit gets credited to the attacker’s builder account. The validator the staker was funding never activates. The vulnerability is spe...