TLDR
- Ethereum’s Glamsterdam upgrade is set to activate on the Sepolia testnet on October 6, 2026
- Developers warned that fake “builder” identities using free test ether could disrupt block auctions
- An attacker could spin up thousands of fake builders, win bids, and withhold transaction data
- Client teams must release Sepolia-ready software by September 29, leaving only seven review days
- Mainnet activation remains unscheduled, with Ethereum targeting Q4 2026
Ethereum developers have confirmed October 6 as the date for the first public test of the Glamsterdam upgrade on the Sepolia testnet. The announcement came alongside a warning about a potential attack that could disrupt the test.
ETHEREUM’S NEXT MAJOR UPGRADE IS MOVING FORWARD.
Glamsterdam is scheduled to hit the Sepolia testnet on October 6, followed by a tentative Hoodi test on October 27.
Developers have identified a potential weakness where attackers could create fake builder identities, submit huge… pic.twitter.com/79L6vjSf4I
— MANDO CT 🇮🇪 🇦🇪 🇬🇧 (@MandoCT) September 18, 2026
The concern centers on how Glamsterdam handles block building. The upgrade introduces a system called Enshrined Proposer-Builder Separation, or ePBS. Under this design, specialized builders compete in auctions to supply blocks of transactions to validators.
On the real Ethereum network, participating in these auctions costs real money. On Sepolia, test ether is free, which changes the risk picture.
What the Attack Would Look Like
During a developer call on September 17, consensus developer Potuz explained the problem. An attacker could create thousands of fake builder identities, submit high bids to win block auctions, and then simply refuse to hand over the transaction data.
I am not sure you are prepared for Glamsterdam on Ethereum pic.twitter.com/O57rRe7XDr
— Ben {chmark} Adams ⟠ (@ben_a_adams) September 16, 2026
“I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads,” Potuz said. “Any teenager can do this.”
This would not put real funds at risk. But it could freeze traffic on the testnet and stop developers from properly evaluating how the upgrade performs under real conditions.
Existing safeguards may not be strong enough. Some client protections only kick in after several payloads go missing. Developers said clients also need a way to ban individual builders so attackers cannot return under a new identity.
What Glamsterdam Is Designed to Do
Glamsterdam is Ethereum’s next major upgrade. It is built to increase how much activity the network can handle per block, targeting a gas limit of around 200 million, up from 60 million in recent tests.
The upgrade also extends the window for sharing transaction payload data from roughly two seconds to about nine seconds, giving nodes more time to process larger blocks.
A private test network called Devnet-11 completed a successful Glamsterdam transition on September 16. It ran 84,000 validators across multiple clients and raised the gas limit toward 200 million without losing finality.
Timeline and What Comes Next
Client teams now have until September 29 to release Sepolia-ready software. That gives just seven days before the October 6 fork, half the 14 days Ethereum normally sets aside for security reviews and bug testing.
Developers accepted the shorter window because Sepolia uses a controlled validator set that is easier to recover if something goes wrong.
After Sepolia, a test on the Hoodi testnet is tentatively planned for October 27. That date depends on how Sepolia goes.
Ethereum has not set a mainnet activation date. The official roadmap lists Glamsterdam for Q4 2026, but no timestamp or epoch has been confirmed. Production builder software from teams Titan and Ultrasound has not completed a Glamsterdam fork transition yet.
