No longer just talking about APR: After staking, whose ETH is it really?

Author: imToken

After staking 32 ETH into a validator, is this money still considered "yours"?

In today's world where various staking products are abundant, this is a question that sounds extremely basic but is often overlooked by everyone.

In the past, when choosing staking options, people were accustomed to using a magnifying glass to compare: which provider has an APR that is 0.2% higher? Is the fee 5% or 10%? Can it automatically compound? When can it be withdrawn?

But today, with the overall staking benchmark yield across the network being suppressed to below 3%, the small differences in nominal returns among providers are no longer significant. Compared to the hassle for a few basis points of interest, another question that has been hidden beneath the product interface is actually much more important:

After your ETH is staked, who is actually controlling it?

1. The Underlying Logic of Staking: Those who work cannot control the money

To understand non-custodial staking, the key is to grasp a very clever design that Ethereum employs at the consensus layer.

Running a validator has never relied solely on a single key; it has split permissions into two completely different halves at the protocol level.

One type is the Signing Key, which is the private key for signing validations.

This key is specifically used to "do the work," participating in attestations, proposing blocks, and completing various consensus tasks 24 hours a day. It must be directly attached to a server and always online. Whoever holds this key is responsible for running this machine.

But it can only be used to prove that you are honestly participating in consensus; even if you sign a thousand times with this key, it can never access the principal, and if the machine goes offline or double-signs, Ethereum penalizes the validator's rewards or principal.

The other type is Withdrawal Credentials, which refers to the control rights for withdrawals.

This is the real "withdrawal password," written on the beacon chain at the moment the staking takes effect, determining where the staked ETH and the generated rewards can ultimately be withdrawn.

This key can quietly reside in your cold wallet or mnemonic phrase without ever needing to go online.

In fact, the Ethereum official clearly defines the two: the signing key is a "hot" permission that needs to remain online, while the withdrawal credentials represent "cold" permission regarding ownership of funds.

This means that a third party can completely run the validator for the user without needing to own the user's ETH.

This is also why non-custodial staking solutions like imToken work—node service providers (like InfStones) hold the Signing Key, responsible for data center operations, network defense, and maintaining 24/7 online status. They determine whether the node runs smoothly and how much block reward can be earned, but they cannot find even a single line of code that allows them to withdraw the staked funds for themselves.

Even after Ethereum's upgrade and the introduction of EIP-7002 (execution layer can trigger exits), this layer of control has become even more extreme.

Previously, if a node operator went offline or acted dishonestly, although they could not take the money, users often had to wait for the operator to broadcast the exit message using the Signing Key, which was passive. However, with EIP-7002, as long as the withdrawal credentials (0x01 / 0x02) are in your hands, you can use your imToken wallet to directly issue a command on the execution layer to forcibly shut down the validator and queue for a refund.

In other words, even if one day the node service provider completely disappears, your money will not be trapped on the chain.

This is actually the core concern of "non-custodial" staking: the entire staking process may involve third parties, but those who do the work do not simultaneously have the power to take the money.

2. What can users, wallets, node service providers, and Ethereum each do?

Continuing along this line of reasoning, we find that what seems like a simple ETH staking actually involves at least four roles.

These are the user, the wallet, the node service provider, and the Ethereum protocol itself, each with different permissions.

First is the user.

In a true non-custodial architecture, the user retains the most important control over their funds.

Taking imToken's non-custodial ETH staking as an example, users have withdrawal-related permissions, and service providers cannot arbitrarily transfer the staked assets to their own accounts. The status of the validator can also be directly queried on-chain.

This fundamentally differs from the common understanding of "handing over coins to someone for investment," even though the ETH is no longer sitting in the user's wallet balance but has entered the Ethereum Deposit Contract and become part of the validator's balance, it has not thereby become the asset of the related node.

The node maintains the Validator, controlling its operational permissions, not the rights to withdraw assets.

Next is the wallet.

The wallet acts more like an entry point for users to manage this set of permissions rather than being the owner of the staked assets.

It helps users initiate staking, manage addresses, sign operations, check validator status and rewards, but as long as the underlying design remains non-custodial, the wallet service provider itself does not automatically gain withdrawal permissions for user assets just by providing this interface.

Thus, "staking through a certain wallet" and "entrusting ETH to this wallet" are actually two completely different concepts; the true nature is still determined by how the underlying keys and withdrawal credentials are configured.

The third role is the node service provider.

This is the part of non-custodial staking that is most easily misunderstood. Since users do not run machines 24/7 themselves, someone must maintain the validator.

Node service providers are responsible for running the client, staying online, completing validation tasks, and safeguarding the Signing Key used for these tasks. This means they are still very important; if they frequently go offline, users will lose some of the rewards they should have earned; if serious violations occur, there is a risk of slashing.

So "non-custodial" never means "no service provider risk"; it just means that this risk is mainly confined to the quality of validator operations and rewards, rather than "whether the service provider can take your 32 ETH."

The final role is the Ethereum protocol itself.

This layer is often the most overlooked. Once ETH enters a validator, no party can transfer it at will like a normal wallet balance.

It must adhere to the rules set uniformly by Ethereum, such as when it can be activated, when it can exit, whether exiting requires a queue, what actions by the validator will incur penalties, and when withdrawals can ultimately be completed, all determined by the protocol.

The 0x02 Compounding Validator launched after Pectra operates similarly; it allows the effective balance of the validator to increase from the traditional limit of 32 ETH to a maximum of 2048 ETH, allowing rewards to continue participating in compounding, but withdrawals and exits still proceed according to protocol rules.

3. What about Lido? What sacrifices were made for liquidity?

Once this framework is established, looking at liquid staking solutions like Lido makes the differences very clear.

After users deposit ETH into Lido, they receive stETH, and stETH itself still completely belongs to the user, can be transferred, traded, and can also be used in DeFi.

This is also the greatest value of Liquid Staking, as it re-releases the liquidity that was originally locked in the Validator.

However, at the same time, the control structure of the underlying ETH has changed.

Lido aggregates a large amount of users' ETH and allocates it through the protocol to different Node Operators to create and operate validators. The Withdrawal Credentials of these validators are not the Ethereum addresses of each stETH user but are uniformly set by the Lido protocol, and the underlying withdrawal process is completed by the protocol's smart contracts, Oracles, node operators, and other components.

So users hold the staking rights represented by stETH, not a Withdrawal Credential that "only belongs to their own Validator."

When users want to redeem ETH from the protocol, they need to submit stETH to the Lido Withdrawal Queue, waiting for the protocol to complete the corresponding exit and fund preparation, and then receive ETH. Lido will generate an NFT representing the withdrawal rights for this withdrawal request, and users can only claim the underlying ETH once the request is completed.

However, although it seems that users still hold stETH, the protocol itself operates through smart contracts, and there is no centralized entity that can arbitrarily take all user assets. Still, it has different trust boundaries compared to non-custodial native staking, where each person has their own Validator and withdrawal address directly belonging to the user.

The former brings lower participation thresholds, better liquidity, and the extensive composability of stETH in DeFi;

The latter sacrifices some liquidity and requires at least 32 ETH, but makes the funding control relationship of the underlying validator more direct.

In simple terms, Liquid Staking is more like holding a freely circulating "staking asset certificate," while non-custodial native staking is closer to owning a truly personal Validator, only outsourcing its daily operations.

There is no absolute superiority between the two.

For users with only a few ETH who need to trade at any time or wish to participate in DeFi, liquid staking assets like stETH are clearly more convenient.

But if a user holds 32 ETH, 64 ETH, or even more for the long term, and does not have a strong liquidity demand, then the difference in yield is not significant enough to dictate the choice; at this point, the security consideration of "who controls the assets" will weigh much more heavily.

After all, staking rewards change daily, APR fluctuates with the total staking amount across the network, and fee rates may also adjust.

Ultimately, where the Withdrawal Credentials point, who can withdraw the principal, and whether third-party cooperation is needed in extreme situations determine the fundamental trust structure of the entire product.

This may also be an easily overlooked change after ETH Staking gradually matures:

As the yields and experiences of various products become increasingly similar, the real differentiating factor may return to a very fundamental question—who exactly holds my ETH?

Final Thoughts

There is no absolute right or wrong in choosing.

If you only have two or three ETH, or are keen on playing around with cyclical lending in DeFi Lego, then from the perspective of capital utilization and threshold, liquid staking tokens like stETH are a more pragmatic choice.

However, if your goal is to establish a core long-term position in the Ethereum network, whether it’s 32 or more, the situation changes completely. When the net yield differences among various products are only a few thousandths or even just a few basis points, it becomes very low cost-effectiveness to bear lengthy contract calls and governance risks for such minimal returns.

In the crypto industry, people often say "Not your keys, not your coins."

But in the context of Staking, it may also need an additional half-sentence: "Not your withdrawal credentials, not your native stake."