Ethereum Developers Warn of Sepolia Testnet Attack Risk Ahead of Glamsterdam Upgrade

1 hour ago 2 sources neutral

Key takeaways:

  • Glamsterdam's 200M gas target is structurally bullish for ETH, yet testnet attack risk warrants caution.
  • ePBS builder attack concerns highlight scaling complexity, suggesting ETH upside remains tied to execution timelines.
  • Watch ETH volatility around October 6 Sepolia fork and September 29 client releases.

Ethereum developers have confirmed that the Glamsterdam upgrade will enter its first public test phase on the Sepolia testnet on October 6, 2026, while also warning that the testing process could be disrupted by a specific builder-level attack. A tentative follow-up test on the Hoodi testnet is planned for October 27, 2026, but mainnet activation remains unscheduled.

The concern focuses on Glamsterdam’s introduction of Enshrined Proposer-Builder Separation (ePBS), a system where specialized builders compete in auctions to supply transaction blocks to validators. On Ethereum mainnet, those auctions cost real money. On Sepolia, test ETH is free, which changes the risk calculation. During a developer call on September 17, consensus developer Potuz explained that an attacker could ‘spin up a thousand builders, rotate them, offer very high bids, and not produce payloads. Any teenager can do this.’

Such an attack would not put mainnet user funds at risk, but it could freeze traffic on the testnet and prevent developers from properly evaluating the upgrade under realistic conditions. Developers said existing safeguards may not be strong enough, and clients need a way to ban individual builders so attackers cannot simply return under a new identity.

Glamsterdam is designed to increase network capacity per block, targeting a gas limit of around 200 million, up from roughly 60 million in recent tests. It also extends the payload data-sharing window from about two seconds to nine seconds, giving nodes more time to process larger blocks. A private test network called Devnet-11 completed a successful Glamsterdam transition on September 16, running 84,000 validators across multiple clients and raising the gas limit toward 200 million without losing finality.

Client teams have until September 29 to release Sepolia-ready software, leaving only seven days before the October 6 fork — half the 14 days Ethereum normally sets aside for security reviews. Developers accepted the shorter window because Sepolia uses a controlled validator set that is easier to recover if something goes wrong. The official roadmap lists Glamsterdam for Q4 2026, but no mainnet timestamp or epoch has been confirmed. Production builder software from teams Titan and Ultrasound has also not yet completed a Glamsterdam fork transition.

Disclaimer

The content on this website is provided for information purposes only and does not constitute investment advice, an offer, or professional consultation. Crypto assets are high-risk and volatile — you may lose all funds. Some materials may include summaries and links to third-party sources; we are not responsible for their content or accuracy. Any decisions you make are at your own risk. Coinalertnews recommends independently verifying information and consulting with a professional before making any financial decisions based on this content.