A Lido engineer is warning that staking deposits could be hijacked during Ethereum's upcoming Glamsterdam upgrade, according to a report published by Crypto Briefing. The alert points to a potential attack path opened up by the upgrade process itself. Staking providers are being told to tighten security before the network change goes live.
The flaw in the upgrade window
The concern centers on the moment when Ethereum's network is being upgraded. During that window, the process for handling staking deposits may leave room for an attacker to intercept or redirect them. The Lido engineer's warning doesn't describe a flaw in the deposit contract so much as a risk in how deposits are handled while the upgrade is underway. That distinction matters: it puts the burden on staking providers rather than on the base protocol alone.
Glamsterdam is the codename for the next major Ethereum network upgrade. The name combines the two planned changes — Gloas and Amsterdam. The specifics of the deposit risk were laid out in the Crypto Briefing report, though the warning stops short of offering an exploit walkthrough. What it does say is that providers need to treat the upgrade as an active threat window, not a routine maintenance pause.
Why staking providers are the front line
Staking deposits pass through providers before they hit the Ethereum network. That makes those providers the natural choke point for any hijack attempt. If a deposit is redirected mid-flight — before it's credited to the intended validator — the depositor loses the funds and the provider's reputation takes the hit.
The Lido engineer's advice is straightforward: staking providers should implement robust security measures during Ethereum network upgrades. That's not a small ask. Upgrades mean code changes, config changes, and often a brief pause in normal operations. Each of those is a place where a rushed deployment can leave a gap.
There's no indication that an attack is underway. The warning is precautionary. But it lands at a sensitive time. Ethereum upgrades draw attention from both legitimate operators and people looking for weak spots. A deposit hijack during an upgrade would be a messy, high-visibility failure — the kind that erodes trust in staking more broadly.
The timing question
Glamsterdam hasn't shipped yet. That gives providers a window to review how they handle deposits around the upgrade. The Lido engineer's warning is effectively a request to use that window well.
For now, the concrete next step is for staking providers to audit their deposit flows ahead of the upgrade. Whether they do — and whether the risk turns out to be theoretical or real — is the open question. The Crypto Briefing report has put it on the record. The rest is up to the operators.
