Crypto: why Ethereum delayed its major Glamsterdam upgrade?

On Monday, October 26, at 18:42 and 48 seconds Brussels time, Ethereum was supposed to take another step toward Glamsterdam, its biggest upgrade since 2022. Nothing happened. Four days earlier, the developers had cancelled everything, without giving a new date.

The reason? A security firm, ChainSecurity, found 13 programs already running on Ethereum that could be caught out by the new rules. No hack, no euro stolen. Just a “wait, we hadn’t thought of that”.

October 26 was the planned date, and that's all we know about the schedule for now

First, the good news: the safety net worked

A quick reminder of the setup. Before touching the real Ethereum, the one where real ETH is sleeping, the developers try each upgrade on test networks, exact copies where everything works the same way but with Monopoly money. Glamsterdam has already been running on the first one, Sepolia, since October 6. On the 26th, it was supposed to arrive on the second, Hoodi, the one where the people who run the network rehearse the switch one last time before the big night.

And that is exactly what a rehearsal is for. The problem was spotted during testing, before the new rules touched a single real wallet. The developers preferred to cancel rather than charge ahead, even though they were aiming for a launch on the real network in early December. Frankly, that's the decision I expect from people managing a network worth hundreds of billions.

Better for the set to fall during the dress rehearsal, with an empty house

The problem, explained with a delivery driver

On Ethereum, a “smart contract” is a small program placed on the chain, which runs all by itself: it distributes payments, manages a withdrawal queue, exchanges tokens. And every operation consumes “gas”, the fuel for computation, paid by whoever sends the transaction. More operations, more gas. I already explained three weeks ago that Glamsterdam changes the price of this fuel: a simple ETH transfer becomes much cheaper, but creating new data on the chain costs more. It is precisely this change that is causing trouble.

Imagine a withdrawal queue. The program pays every person on the list, and if a payment fails, it notes “failure” in its memory and moves on to the next one. A smartass can take advantage of this: they start the process with just enough fuel for your payment to run dry, but enough left for the program to write “failure”. It's the delivery driver we send with too little gas to reach your place, but enough to fill out the missed-delivery notice. And your withdrawal is marked as failed for good, even though you did nothing. Specialists call this “griefing”: causing harm without necessarily stealing.

The missed-delivery notice even though you were home: on Ethereum, it's an attack that's been known for years

Why the old protections no longer hold up

The developers of these programs have been protecting themselves for a long time, and the simplest countermeasure comes down to a price. Today, writing a new slot in a contract's memory costs 22,100 units of gas. It's expensive, and that's intentional. After running dry, there is too little fuel left to pay for that. The program therefore cannot write its “failure”, the whole operation is cancelled, and you can try again later. The delivery driver no longer has enough gas to fill out the missed-delivery notice, so he comes back tomorrow.

Glamsterdam changes this price with a proposal called EIP-8037 (Ethereum updates are divided into numbered proposals, like bills). In total, writing a slot will cost about five times more than today. But the bill is split in two. A small part, 12,100 units, about half the current price, is paid from the usual reservoir. Most of the rest, nearly 98,000 units, is paid first from a second reservoir, kept separately and reserved for data creation.

And that's where it gets stuck. The program does not see this second reservoir when it checks its gauge. The cheeky little program can therefore empty the usual reservoir to cause it to run dry, while leaving the second one nicely full. With the same small remainder as before, the "failure" write goes through: the delivery driver now has a backup fuel can just for filling out delivery notices. To top it all off, when an operation is canceled partway through, fuel that has already been burned can return to the reservoir. Some programs specifically monitor their gauge to detect the attack, and that gauge starts lying.

The total cost goes up, but the share taken from the usual reservoir goes down: that's what the protections were monitoring

In plain English, programs whose code has not changed by a single line would become vulnerable because the rules changed underneath them. Every developer has experienced that at least once, me first: a system update, not a line of your code touched, and something that had worked for years breaks. Except here, we're not talking about a misaligned button, we're talking about blocked money withdrawals.

ChainSecurity analyzed the new rules on October 13, and announced on the 23rd that it had found 13 real cases among contracts already in service. It does not name them: it first warns the projects concerned privately, so they can fix things before the cheeky little programs read the report. And it specifies that not all gas-based protections fail. On October 21, a security researcher known by the pseudonym pcaversaccio had described the risks as "serious" and asked for the schedule to be reviewed. The next day, it was done.

And you, with your ETH?

Nothing to do. Really nothing. If you have ETH on an exchange or in your wallet, this delay changes nothing about your balance, your keys or your app. The real Ethereum has never received these new rules.

What changes is the schedule for the good news. Cheaper ETH transfers and larger blocks, the ones that are supposed to reduce the rush during peak hours, will arrive later than expected. How much later? Nobody knows. The Ethereum Foundation is simply announcing a new date "later". Some specialist media are talking about another attempt on Hoodi after Devcon, the major conference for Ethereum developers, from November 3 to 6, but nothing official. December is becoming frankly uncertain.

And as with every Ethereum update, expect scams riding on it. A message telling you "Glamsterdam has been delayed, migrate your ETH before Friday so you don't lose it" is fake. One hundred percent. An Ethereum update never asks you for anything.

My opinion

We'll read here and there that Ethereum is late, that it's dragging on, that it's a mess. I mostly see a system that worked: a security company reads the rules before everyone else, raises the alarm, the developers listen and delay it by nine days. I would take a late update over a single withdrawal blocked forever because someone wanted to stick to a date, a thousand times over.

And to the 13 projects whose names ChainSecurity is keeping quiet: you've received an email. Read it before December!

Sources

• Ethereum Foundation, October 22, 2026: Glamsterdam delayed on Hoodi
• ChainSecurity: when spent gas comes back, the analysis of EIP-8037 and EIP-8038
• Cointelegraph: the alert timeline and the 13 contracts concerned
• CoinDesk, October 23, 2026: Ethereum delays the Glamsterdam test
• Blockonomi: a new date mentioned after Devcon

Article written with the help of Claude Code, reread and corrected by me.