Could Ethereum’s Staking Deposit Bug Happen on Cardano?
The headline sounds alarming: Ethereum developers found a way a block builder might receive ETH intended for a new staking validator. If you delegate ADA to a Cardano stake pool, could a similar mistake send your coins to the pool operator?
The specific Ethereum bug does not map onto ordinary Cardano stake pool delegation. In Cardano’s native staking model, you do not deposit your ADA into an operator-controlled validator account. You keep the ADA in your wallet and register a delegation choice. A pool operator cannot turn that choice into permission to spend your coins.
That answer deserves more than a reassuring slogan. The Ethereum flaw was real enough to change a proposed upgrade, and Cardano is still software with its own risks. To understand the difference, we need to look at what went wrong, when the vulnerable rule would have applied, and what actually happens when ADA is delegated.
What Was the Ethereum Bug?
The issue concerned Gloas, the consensus portion of Ethereum’s planned Glamsterdam upgrade. The upgrade introduces a protocol role for block builders alongside validators. As the new rules came into effect, pending deposits needed to be assigned to the correct kind of account.
The problematic draft rule looked at a public key already associated with a builder. Under certain conditions, a later deposit meant for a validator with that same public key could be credited to the builder instead, even though the two deposits had different withdrawal credentials. Those credentials matter because they specify the route for eventually withdrawing funds.
Here is the conditional scenario in plain language:
- An operator queues a valid deposit to register a builder under a particular public key, with withdrawal rights the operator controls.
- A staking service queues a deposit intended to create a validator under the same public key, with different withdrawal credentials protecting the service’s funds.
- Both deposits are still pending when the Gloas transition processes them.
- The draft transition logic sees the already registered builder and credits the validator’s pending deposit to that builder account.
- If every other condition needed for an exploit is met, the operator could withdraw value that the staking service intended for its validator.
The difference between the person paying for a deposit and the person controlling its public key is central. A staking service may fund a validator run by an operator; it must be able to ensure that its deposit follows its own withdrawal instructions. The proposed routing rule failed to respect that distinction in the described transition case.
This was not a report that every existing Ethereum staker’s balance could be taken. The scenario involved deposits pending at a future fork and particular relationships between the depositor, operator, public key, and withdrawal credentials. The researcher also described possible effects on staking services as conditional, because their deployed checks could prevent the required setup.
Did Anyone Actually Lose Staked ETH?
No confirmed loss from this issue was established in the public technical report. The flaw was identified in specifications for an upcoming upgrade, rather than demonstrated as a theft from Ethereum’s existing mainnet staking balances.
The issue was reported on October 12, 2026. Developers initially closed the proposed fix, reopened the discussion, and merged a correction into the consensus specifications on October 26. The fix routes pending validator and builder deposits according to their respective withdrawal credentials during the Gloas transition.
A merged specification change is an important milestone; client software and upgrade testing must implement the corrected behavior before the upgrade is activated. It should not be described as a mainnet exploit that has already happened or as proof that deployed Ethereum staking is currently diverting deposits.
Why Cardano Staking Works Differently
When you stake ADA through a normal self-custody wallet, you delegate the stake associated with your ADA to a pool. The delegation is recorded on-chain, but the ADA stays at addresses controlled by your wallet. The pool operates nodes and may produce blocks using the combined stake assigned to it.
The important credentials have different jobs:
| Item | Its job | Does it give the pool access to your ADA? |
|---|---|---|
| Your payment credential | Authorizes spending from your payment addresses | No; you retain this control |
| Your stake credential | Controls delegation choices and reward withdrawals | Not transferred to the pool by delegation |
| Pool operational keys | Let the pool participate in block production | No spending authority over delegators’ wallets |
| Delegation certificate | Records which pool your stake supports | No transfer of your payment balance |
A new delegation may involve a network transaction fee and, when the stake credential is first registered, a refundable registration deposit. Those are not the same as transferring your entire ADA balance to the pool. Your payment-address ADA remains spendable while it is delegated.
That is the architectural reason the Gloas mistake cannot simply be copied over. Ordinary Cardano delegation has no equivalent step in which a pool operator’s builder account receives a queued deposit of your staking principal. There is no validator-deposit balance of your ADA waiting to be reassigned to the pool during registration.
A 10,000 ADA Example
Suppose you have 10,000 ADA in a self-custody wallet and delegate it to Pool A.
After the delegation takes effect, Pool A’s share of active stake reflects your eligible stake. The operator can run a block producer, earn pool rewards under the protocol’s rules, and publish information about the pool. The operator still cannot sign a payment transaction from your address.
Now imagine Pool A’s operator becomes dishonest or its server is compromised. That event can disrupt block production, damage the pool’s performance, or create operational risks for the pool itself. It does not provide the operator with your wallet’s payment key. Pool A cannot withdraw your 10,000 ADA by asking the ledger to reinterpret your delegation as a payment.
You could spend your ADA or redelegate to another pool with a valid transaction signed by your wallet. A change of pool affects which operator your stake supports after the normal epoch delay, not who owns the ADA.
The comparison is specific to native delegation from a wallet you control. If you instead send ADA to a company, an exchange, or a smart contract offering “staking,” you have chosen a different arrangement.
What About Staking Rewards?
Cardano’s protocol calculates and distributes delegator rewards to the reward accounts associated with their stake credentials. The pool operator’s fixed cost and margin are part of the reward distribution rules; they do not let the operator reach into a delegator’s wallet and take already credited rewards.
Your stake credential authorizes reward withdrawals. Delegating to a pool does not hand that credential to the operator. A badly performing pool can mean fewer or less regular future rewards. It does not make previously credited delegator rewards the operator’s property.
This distinction is useful when headlines use the phrase “staking funds.” They might mean principal locked in a validator deposit, ADA in a self-custody wallet whose stake is delegated, rewards in a reward account, or assets deposited into a DeFi product. The label alone does not tell you who can withdraw the money.
Can a Cardano Stake Pool Operator Steal Delegated ADA?
Not by operating the pool or receiving your normal delegation. To spend ADA from your wallet, an attacker would need the required spending authorization or would need to exploit some other failure in the transaction, wallet, or protocol. Control of a pool’s production infrastructure is not the same authority.
That does not mean pool selection is irrelevant. Availability, block production, fees, pledge, saturation, and operator transparency all matter to the experience and possible reward outcomes. If you want to examine operators before delegating, Blockiy’s Cardano Verified Pools | Find Trusted Stake Pools For ADA Staking directory is a practical place to start comparing verified pools. Verification and good operations help you assess a pool; they cannot guarantee rewards or certify every other product that asks you to connect your wallet.
The real security question before clicking “Stake” is: Am I signing a delegation certificate, or am I transferring assets into someone else’s custody or a smart contract? Wallet screens and marketing pages sometimes use the same everyday word for very different transactions.
Could Cardano Have a Different Protocol-Level Bug?
Yes, in principle. Cardano’s design removes the specific deposit-routing path at issue here from ordinary native delegation. It does not prove that every implementation of the Cardano ledger, wallet, node, or future upgrade is incapable of error.
A hypothetical defect in reward accounting, credential handling, transaction validation, or an upgrade could have its own consequences. Such a claim would need an identified rule, reproducible failure, and evidence about affected versions. It would be irresponsible to declare a live Cardano vulnerability merely because a different chain found a different bug.
This is also why upgrades need specification review, test networks, independent scrutiny, and careful rollout. The Ethereum case shows the value of finding a wrong assumption before new rules handle real funds. The lesson for Cardano is disciplined verification of its own rules, particularly where a proposed upgrade changes how money or authority is assigned.
The Risks Cardano Holders Should Actually Watch
The absence of an Ethereum-style validator deposit in native ADA delegation does not remove other ways to lose assets.
Custodial “staking” services
If an exchange or service requires you to send ADA into an address it controls, that service may hold the spending keys. Its payout, withdrawal, insolvency, and security risks are governed by its own setup. Calling the service “Cardano staking” does not make it equivalent to self-custody delegation.
DeFi deposits and liquid staking products
A lending protocol, yield vault, or tokenized staking product may ask you to lock ADA in a smart contract and receive a different claim or token. Your exit then depends on that product’s contracts, liquidity, administrator permissions, and withdrawal rules. Native pool delegation does not audit or insure those products.
Compromised wallet credentials
If someone gains your recovery phrase or payment signing key, they may authorize transactions from your wallet. This can happen through a fake wallet, a phishing page, unsafe storage, or malware. A trustworthy stake pool cannot reverse a payment you signed or a transaction an attacker signed with stolen keys.
Misleading transaction prompts
A website can describe an action as “staking” while asking your wallet to sign a transfer, a contract deposit, or another operation. Read the wallet’s transaction details: recipients, assets, amount, fee, script interactions, and certificates. Do not infer what you are signing from the website button alone.
Poor pool performance
A pool missing blocks can reduce potential rewards. That is a real economic downside, but it is different from a theft of the delegated principal. Cardano’s native delegation does not slash your ADA because the pool misses a block.
How to Check Whether Your ADA Is Still Under Your Control
If a service says you have “staked” ADA and you are unsure what happened, follow the on-chain action rather than the label:
- Look at the transaction. Did it register or change a delegation, or did it send most of your balance to a new address or script?
- Check the payment addresses. Is the ADA still in addresses controlled by your wallet, subject to the usual transaction fees and any stake registration deposit?
- Check the stake credential and pool ID. Does the delegation point to the operator you selected?
- Read the withdrawal conditions. If a service issued a receipt token or shows a custodial account balance, find out who controls the underlying ADA and how redemptions work.
- Protect your keys. None of these checks requires entering a recovery phrase into a pool directory, explorer, or “staking verification” site.
A wallet can display an aggregated balance in ways that make the difference between spendable ADA, reward-account ADA, and tokens less obvious. If the balance looks surprising, inspect the transaction and the relevant addresses before assuming theft.
What Would Have to Change for the Comparison to Become Closer?
Suppose a third-party Cardano service collected ADA from many customers, issued them account balances, and later routed pooled funds to operators or contracts. A bug in that service’s deposit attribution could send value to the wrong party. The service might even use a public key or identifier incorrectly, echoing the general lesson from the Ethereum issue: money must be matched to the correct withdrawal authority, not just a convenient label.
But that would be a flaw in the service’s custody or contract design. It would not mean ordinary Cardano stake pool delegation deposits user principal with an operator. Keep the two models separate when evaluating an actual product.
Future Cardano features could also introduce new accounting or credential rules that deserve separate review. Security conclusions should be tied to a specific feature and implemented version, not turned into a permanent claim that a whole blockchain can never make a mistake.
Frequently Asked Questions
Was the Ethereum bug used to steal ETH?
The public report described a conditional flaw in proposed Gloas transition rules. A correction was merged before those rules went live on Ethereum mainnet. The report did not establish a confirmed theft of ETH through this scenario.
Can a Cardano pool operator withdraw my ADA if I delegate to their pool?
With native self-custody delegation, no. The operator does not receive your ADA or your payment signing key. Your wallet retains spending control.
Does “no slashing” mean Cardano staking has zero risk?
No. Native delegation does not slash your principal for pool underperformance, but you can receive fewer rewards, lose access to your keys, sign an unwanted transaction, or take on custodial and smart-contract risks through a separate service.
Are pool rewards and my ADA principal stored in the same place?
Your payment-address ADA and distributed staking rewards are tracked differently. Rewards accumulate in the reward account associated with your stake credential; they count toward delegated stake and can be withdrawn under the applicable rules. Neither balance becomes the pool operator’s wallet merely because you delegate.
If an Ethereum-style bug is impossible here, is Cardano provably safe?
The conclusion is narrower: the described builder/validator deposit collision has no direct counterpart in ordinary Cardano delegation. Cardano software and third-party products still need security review, testing, and secure key handling.
Does choosing a verified pool protect me from a malicious DeFi contract?
No. Pool verification helps evaluate the operator you delegate to. A DeFi contract that asks you to deposit assets has separate code and withdrawal rules, which must be assessed on their own.
The Answer
The Ethereum bug depended on a particular upgrade rule that could misroute a pending validator deposit into a builder account sharing its public key. The correction made the deposit’s withdrawal credentials decisive. It was found and addressed before the proposed rule reached mainnet.
When you delegate ADA from your own Cardano wallet, your principal is not queued as a deposit to a pool-controlled validator or builder account. Your wallet retains the authority to spend it. So the same bug cannot be transplanted into normal ADA delegation.
That is a useful protection, with a clear boundary. It applies to native self-custody staking. Before using any product marketed as “staking,” check whether you are simply choosing a pool—or actually transferring your assets to a company or contract. That one transaction detail tells you far more about the risk than the product’s label.
