No longer just talking about APR: After staking, whose ETH is it really?

Author: imToken

After staking 32 ETH into a validator, is this money still considered "yours"?

In today's world where various staking products are abundant, this is a question that sounds extremely basic, yet is often overlooked by everyone.

In the past, when choosing staking options, people were accustomed to using a magnifying glass to compare: which provider offers an APR that is 0.2% higher? Is the fee 5% or 10%? Can it automatically compound? When can it be withdrawn?

But today, as the benchmark staking yield across the network has been flattened to below 3%, the small differences in nominal returns among various providers are no longer significant. Compared to the hassle of chasing after a few basis points of interest, another question that has been hidden beneath the product interface is actually much more important:

After you stake your ETH, who is actually in control of it?

1. The Underlying Logic of Staking: Those Who Work Cannot Control the Money

To understand non-custodial staking, the key is to clarify a very clever design that Ethereum employs at the consensus layer.

Running a validator has never relied solely on a single key; it divides permissions into two distinctly different halves at the protocol level.

One type is the Signing Key, which is the private key for signing validations.

This key is specifically used for "working," participating in attestations, proposing blocks, and completing various consensus tasks 24 hours a day. It must be directly connected to a server and always online. Whoever holds this key is responsible for running this machine.

However, it can only be used to prove that you are honestly participating in consensus; even if you sign a thousand times with this key, it can never be used to access the principal. Moreover, if the machine goes offline or double-signs, Ethereum penalizes the validator's rewards or principal.

The other type is the Withdrawal Credentials, which refer to the control over withdrawals.

This is the real "withdrawal password," which is written on the beacon chain the moment staking takes effect, determining where the staked ETH and generated rewards can ultimately be withdrawn.

This key can quietly rest in your cold wallet or mnemonic phrase, never needing to go online for a lifetime.

In fact, Ethereum's official positioning of the two is very clear: the signing key is a "hot" permission that needs to remain online, while the withdrawal credentials represent "cold" permission regarding ownership of the funds.

This means that a third party can completely run the validator for the user without needing to own the user's ETH.

This is also why non-custodial staking, like that offered by imToken, works—node service providers (like InfStones) hold the Signing Key, responsible for data center operations, network defense, and maintaining online status 24/7. They determine whether the node runs smoothly and how much block reward can be earned, but they cannot find even a single line of code that allows them to withdraw the staked funds for themselves.

Even after Ethereum's upgrade and the introduction of EIP-7002 (which allows for exit triggers at the execution layer), the closed loop of this control has become even more extreme.

Previously, if a node operator went offline or acted dishonestly, although they could not take the money, users often had to wait for the operator to broadcast the exit message using the Signing Key, putting them in a passive position. However, with EIP-7002, as long as the withdrawal credentials (0x01 / 0x02) are in your hands, you can use your imToken wallet to directly issue a command at the execution layer to forcibly shut down the validator and queue for a refund.

In other words, even if one day the node service provider completely disappears, your money will not be stuck on the chain.

This is actually the key point that "non-custodial" needs to focus on: the entire staking process involves third-party participation, but those who are responsible for the work do not simultaneously have the power to take the money.

2. What Can Users, Wallets, Node Service Providers, and Ethereum Each Do?

Continuing along this line of thought, it becomes clear that what seems like a simple ETH staking process actually involves at least four roles.

These are the user, the wallet, the node service provider, and the Ethereum protocol itself, each with different permissions.

First is the user.

In a true non-custodial architecture, the user retains the most important control over their funds.

Taking imToken's non-custodial ETH staking as an example, users have withdrawal-related permissions, and service providers cannot arbitrarily transfer the staked assets to their own accounts. The status of the validator can also be directly queried on-chain.

This fundamentally differs from what many people usually understand as "handing over coins to someone for investment." Although the ETH is no longer sitting in the user's wallet balance but has entered the Ethereum Deposit Contract and become part of the validator's balance, it has not thereby become the asset of the related node.

The node maintains the Validator and controls its operational permissions, not the rights to withdraw assets.

Next is the wallet.

The wallet acts more like an entry point for users to manage this set of permissions, rather than being the owner of the staked assets.

It helps users initiate staking, manage addresses, sign operations, view validator status and rewards, but as long as the underlying design still follows a non-custodial approach, the wallet service provider itself does not automatically gain withdrawal permissions to the user's assets just by providing this interface.

Therefore, "staking through a certain wallet" and "entrusting ETH to this wallet" are actually two completely different concepts. What truly determines the nature is still how the underlying keys and withdrawal credentials are configured.

The third role is the node service provider.

This is the part of non-custodial staking that is most prone to misunderstanding. Since users do not run machines 24/7 themselves, someone must maintain the validator.

Node service providers are responsible for running the client, staying online, completing validation tasks, and safeguarding the Signing Key used for these operations. This means they are still very important; if they frequently go offline, users will lose part of the rewards they should have earned; if serious violations occur, there is a risk of slashing.

So "non-custodial" never means "no service provider risk"; it simply means that this risk is primarily limited to the quality of validator operation and rewards, rather than "whether the service provider can take your 32 ETH."

The final role is the Ethereum protocol itself.

This layer is often the most overlooked. Once ETH enters the validator, no party can transfer it like a regular wallet balance whenever they want.

It must adhere to the unified rules set by Ethereum, such as when it can be activated, when it can be exited, whether exiting requires queuing, what behaviors of the validator will be penalized, and when withdrawals can ultimately be completed, all determined by the protocol.

The 0x02 Compounding Validator launched after Pectra is the same; it allows the effective balance of the validator to increase from the traditional limit of 32 ETH to a maximum of 2048 ETH, allowing rewards to continue participating in compounding, but withdrawals and exits still proceed according to protocol regulations.

3. What About Lido? What Is Sacrificed Behind Liquidity?

Once this framework is established, looking at liquidity staking like Lido becomes very intuitive.

After users deposit ETH into Lido, they receive stETH, and stETH itself still completely belongs to the user, can be transferred, traded, and can also be used in DeFi.

This is also the greatest value of Liquid Staking, as it releases the liquidity that was originally locked in the Validator.

However, at the same time, the control structure of the underlying ETH has also changed.

Lido aggregates a large amount of user ETH and then allocates it through the protocol to different Node Operators to create and operate validators. The Withdrawal Credentials of these validators are not the Ethereum addresses of each stETH user, but are uniformly set by the Lido protocol, and the underlying withdrawal process is completed by the protocol's smart contracts, Oracles, node operators, and other components.

So what users hold is the staking rights represented by stETH, not a Withdrawal Credential that "only belongs to their own Validator."

When users want to redeem ETH from the protocol, they need to submit stETH to the Lido Withdrawal Queue, waiting for the protocol to complete the corresponding exit and fund preparation, and then receive ETH. Lido will generate an NFT representing the withdrawal rights for this withdrawal request, and users can only receive the underlying ETH after the request is completed.

However, although it seems that users still hold stETH, the protocol itself operates through smart contracts, and there is no centralized entity that can arbitrarily take away all user assets, it indeed has a different trust boundary compared to non-custodial native staking, where each person has their own Validator and withdrawal address directly belonging to the user.

The former brings lower participation thresholds, better liquidity, and the extensive composability of stETH in DeFi;

The latter sacrifices some liquidity and requires at least 32 ETH, but makes the funding control relationship of the underlying validator more direct.

In simple terms, Liquid Staking is more like holding a freely circulating "staking asset certificate," while non-custodial native staking is closer to owning a truly personal Validator, only outsourcing its daily operations.

There is no absolute superiority or inferiority between the two.

For users with only a few ETH, who need to trade at any time or wish to participate in DeFi, liquid staking assets like stETH are clearly more convenient.

But if a user holds 32 ETH, 64 ETH, or even more for a long time, and does not have a strong liquidity demand, then the difference in yield is not significant enough to dictate the choice; at this point, considerations regarding "who controls the assets" will weigh much more heavily in terms of security.

After all, staking rewards change daily, APR fluctuates with the total staking amount across the network, and fees may also be adjusted.

Ultimately, where the Withdrawal Credentials point, who can withdraw the principal, and whether third-party cooperation is needed in extreme situations determine the fundamental trust structure of the entire product.

This may also be an easily overlooked change after ETH Staking gradually matures:

As the yields and experiences of various products become increasingly similar, the next real differentiator may return to a very fundamental question—who really holds my ETH?

Final Thoughts

There is no absolute right or wrong in choosing.

If you only have two or three ETH, or are keen on playing around with circular lending in DeFi Lego, then from the perspective of capital utilization and threshold, liquid staking tokens like stETH are a more pragmatic choice.

However, if your goal is to establish a core long-term position in the Ethereum network, whether it’s 32 or more, the situation changes completely. When the net yield differences among various products are only a few thousandths or even a few basis points, bearing the lengthy contract calls and governance risks for such marginal gains actually has very low cost-effectiveness.

In the crypto industry, people often say "Not your keys, not your coins."

But in the context of Staking, it may also need an additional half-sentence: "Not your withdrawal credentials, not your native stake."