Author: imToken
After you stake 32 ETH into a validator, does this money still count as 'yours'?
In today's landscape overflowing with various Staking products, this sounds like an extremely basic question, yet one that everyone often skips over by default.
In the past, when choosing a staking solution, people were used to scrutinizing with a magnifying glass: which one offered 0.2% higher APR? Was the service fee 5% or 10%? Did it offer auto-compounding? When could you withdraw?
But today, with the baseline network staking yield smoothed down to below 3%, those tiny differences in nominal returns between providers are no longer significant. Compared to the hassle of chasing a few tenths of a percent in interest, another question that has always been buried at the bottom of product interfaces is actually much more important:
After you stake your ETH, who is really in control of it?
1. The Underlying Logic of Staking: The Worker Shouldn't Handle the Money
The key to understanding non-custodial staking lies in grasping a very clever design Ethereum employs at the consensus layer.
Running a validator has never relied on just one key. At the protocol level, permissions are split into two distinctly different halves.
One is the Signing Key, or the validator signing private key.
This key is used specifically for 'work'—staying online 24/7 to participate in attestations, propose blocks, and complete various consensus tasks. It must be hosted directly on the server, connected to the network at all times. Whoever holds this key is responsible for running that machine.
But it can only be used to prove you are faithfully participating in consensus. Even if you sign a message ten thousand times with this key, you absolutely cannot touch the principal. Moreover, if the machine goes offline or even commits a slashable offense like double-signing, Ethereum deducts penalties from this validator's rewards or principal.
The other is the Withdrawal Credentials, which represent the withdrawal control authority.
This is the real 'withdrawal password.' It is permanently written onto the Beacon Chain the moment the stake becomes active, determining where the staked ETH and generated rewards can ultimately be withdrawn to.
This key can safely reside in your cold wallet or mnemonic phrase, never needing to connect to the internet in its lifetime.
In fact, Ethereum's official positioning of the two is very clear: the validator signing key is a 'hot' permission that needs to stay online, while the withdrawal credential represents a 'cold' permission at the level of fund ownership.
This means a third party can completely run a validator on behalf of a user without thereby possessing the user's ETH.
This is also why non-custodial staking like imToken's works—the node service provider (e.g., InfStones) holds the Signing Key, responsible for data center operations, network attack protection, and maintaining 24/7 uptime. It determines how smoothly the node runs and how much block proposal reward it can earn, but it cannot find a single line of code in the protocol that would allow it to withdraw the staked funds to itself.
After Ethereum's upgrades and the introduction of EIP-7002 (Execution Layer Triggerable Exits), this division of control has become even more extreme.
Previously, if a node operator went offline or acted dishonestly, although they couldn't take the money, users wanting to exit their validator often had to wait for the operator to broadcast an exit message using the Signing Key, leaving users somewhat passive. But with EIP-7002, as long as you hold the withdrawal credentials (0x01 / 0x02), you can directly send an instruction from the execution layer using your own imToken wallet to forcibly shut down this validator and queue it for a refund.
In other words, even if the node service provider completely vanishes one day, your funds won't be trapped on-chain.
This is what 'non-custodial' really needs to focus on. The entire staking process involves third parties, but the party responsible for the work does not simultaneously possess the power to take the money away.
2. User, Wallet, Node Service Provider, and Ethereum: What Can Each Actually Do?
Continuing to dissect along this line, you'll find that what seems like a simple ETH staking action actually involves at least four roles.
These are the User, the Wallet, the Node Service Provider, and the Ethereum protocol itself. However, the permissions they possess are not the same.
First is the User.
In a truly non-custodial architecture, the user retains the most important fund control rights.
Taking imToken's non-custodial ETH staking as an example, the user possesses withdrawal-related permissions; the service provider cannot unilaterally transfer the staked assets to their own account. The validator's status can also be directly queried on-chain.
This is fundamentally different from what many people usually understand as 'handing over coins to someone else for management.' Although the ETH is no longer sitting in the user's wallet balance and has instead entered the Ethereum Deposit Contract to become validator balance, it has not thereby become the asset of the related node.
The node maintains the Validator on your behalf, controlling its operational permissions, not the asset withdrawal rights.
Next is the Wallet.
The wallet is more like the user's gateway to managing this set of permissions, not the owner of the staked assets.
It helps the user initiate staking, manage addresses, sign operations, view validator status and earnings. But as long as the underlying design remains non-custodial, the wallet service provider itself does not automatically gain withdrawal rights over the user's assets simply by providing this interface.
Therefore, 'staking through a certain wallet' and 'entrusting ETH to this wallet' are two completely different concepts. What truly determines the nature is still how the underlying keys and withdrawal credentials are configured.
The third role is the Node Service Provider.
This is the link most prone to misunderstanding in non-custodial staking. Since the user isn't running the machine 24/7 themselves, someone must maintain the validator.
The node service provider is responsible for client operation, maintaining uptime, completing validation tasks, and safeguarding the Signing Key used for this work. This means they remain very important. If they experience frequent downtime, the user loses some of the rewards they should have earned; if severe违规操作 occurs, there is a Slashing risk.
So 'non-custodial' never means 'no service provider risk.' It's just that this risk is mainly confined to the level of validator operational quality and earnings, not 'whether the service provider can transfer your 32 ETH away.'
The final role is the Ethereum protocol itself.
This layer is often the easiest to overlook. Once ETH enters a validator, no party can transfer it at will like a normal wallet balance.
It must follow the rules uniformly set by Ethereum—such as when it can activate, when it can exit, whether exiting requires queuing, what validator behaviors will be penalized, and ultimately when withdrawals are completed—all are determined by the protocol.
The same applies to the 0x02 Compounding Validator introduced post-Pectra. It allows a validator's effective balance to increase from the traditional 32 ETH cap up to a maximum of 2048 ETH, enabling rewards to continue compounding. However, withdrawals and exits still proceed according to protocol rules.
3. What About Lido? What Is Sacrificed for Liquidity?
After establishing this framework, looking at liquid staking like Lido makes the differences very intuitive.
When users deposit ETH into Lido, they receive stETH, and the stETH itself still completely belongs to the user. It can be transferred, traded, or used further in DeFi.
This is the greatest value of Liquid Staking: it re-releases the liquidity originally locked in Validators.
But simultaneously, the control structure of the underlying ETH also changes.
Lido aggregates ETH from many users and then distributes it through its protocol to different Node Operators to create and operate validators. The withdrawal credentials for these validators are not each individual stETH user's own Ethereum address but are uniformly set by the Lido protocol. The underlying withdrawal process is also completed by components of the protocol's smart contracts, oracles, node operators, etc.
Therefore, users hold the staking rights represented by stETH, not the withdrawal credentials for a specific 'validator belonging solely to themselves.'
When a user wants to redeem ETH from the protocol, they need to submit stETH to the Lido Withdrawal Queue and wait for the protocol to complete the corresponding exit and fund preparation before claiming the ETH. Lido generates an NFT representing the withdrawal right for this request, and the user can only claim the underlying ETH after the request is fulfilled.
However, although it seems users still hold their stETH themselves and the protocol itself runs via smart contracts without a centralized institution that can arbitrarily take all user assets, it indeed has a different trust boundary compared to non-custodial native staking where each person has their own validator with a withdrawal address directly belonging to the user.
The former trades for a lower participation barrier, better liquidity, and the broad composability of stETH in DeFi.
The latter sacrifices some liquidity and requires at least 32 ETH but makes the underlying validator's fund control relationship more direct.
Simply put, Liquid Staking is more like holding a freely tradable 'staked asset certificate,' while non-custodial native staking is closer to owning a truly personal validator, only outsourcing its daily operations.
There is no absolute superiority or inferiority between the two.
For users with only a few ETH, needing to trade at any time, or hoping to participate in DeFi, liquid staking assets like stETH are clearly more convenient.
But if a user holds 32 ETH, 64 ETH, or even more for the long term, and doesn't have strong liquidity needs themselves, then the yield difference isn't large enough to dictate the choice. At this point, the security consideration of 'who controls the asset' carries much greater weight.
After all, Staking yields change daily; APR will continuously fall or rise with the total network stake, and fee rates may also be adjusted.
But where the withdrawal credentials point, who can withdraw the principal, and whether third-party cooperation is needed in extreme situations determine the most fundamental trust structure of the entire product.
This might also be a subtle, easily overlooked shift as ETH Staking matures:
As the returns and experiences of various products become increasingly similar, what will truly differentiate them next may very well return to the most fundamental question—who exactly holds control over my ETH?
In Conclusion
There is no absolute right or wrong choice.
If you only have two or three ETH, or are keen on playing with leveraged loops in the DeFi Lego, then liquid staking tokens like stETH are a more pragmatic choice from both a capital efficiency and barrier-to-entry perspective.
But if your goal is to position a core, medium-to-long-term holding within the Ethereum network, whether it's 32 ETH or more, the situation changes completely. When the net yield differences between various products shrink to just a few tenths of a percent, or even a few basis points, the cost-effectiveness of bearing lengthy contract calls and governance risks for such marginal gains becomes extremely low.
In the crypto industry, people often say, 'Not your keys, not your coins.'
But in the context of Staking, perhaps it should have an additional half: 'Not your withdrawal credentials, not your native stake.'
