Author: imToken
For some time now, security incidents in the Crypto industry have barely stopped (further reading: "From Binance to PHP2Shell: In the AI Era, the Defense Line of Web Security Urgently Needs Redefinition").
From trading platforms losing billions of dollars, to wallet supply chains and third-party service providers being attacked, to smart contract vulnerabilities and on-chain assets being stolen, a series of incidents repeatedly reminds us: in the Crypto world, asset security does not only depend on whether the underlying blockchain is reliable, but also on who custodies the assets, who controls the keys, and how many trust links exist throughout the entire service chain.
For ETH holders, the same is true when participating in staking.
Ethereum has already established a relatively mature native staking mechanism. Users can stake ETH to become network validators, earning protocol rewards while maintaining network security. However, as staking has gradually developed into various participation methods such as exchange custody, liquid staking, and professional node services, an easily overlooked question has also emerged:
Even when staking ETH in the same way, the asset control rights and security boundaries behind different solutions may be completely different.
If ETH is handed over to a third party, who exactly holds the withdrawal permission? If a professional service provider runs the validator, can users still independently control the principal? And between native staking and liquid staking, what additional potential risks have emerged?
Clarifying these questions may be more important than simply comparing the APY of different staking products.
The First Line of Defense for Staking Security: Who Holds the Withdrawal Rights to the Assets?
To understand the security mechanism of ETH staking, one must first clarify who exactly controls an Ethereum validator node.
Ethereum adopts the Proof of Stake (PoS) consensus mechanism. By depositing at least 32 ETH into the deposit contract, a user can activate a validator node, participate in block proposals, transaction validation, and consensus attestations, and receive rewards according to network rules.
However, a validator node is not managed by a single key. In the Ethereum staking system, core permissions are split into two categories:
Signing Key: used for the daily operation of the validator, including submitting block proposals and attestations; it is the operational permission for participating in network consensus. Withdrawal Key: used to control the ownership of the staked principal and returns, determining the only designated address to which funds can ultimately be returned (usually directly bound to the user's self-custody wallet address); it represents the ultimate control over the assets.
The responsibilities of the two are very clear: the signing key determines whether the validator can do its job properly, while the withdrawal key determines who can ultimately withdraw the money. This means that the person responsible for running the validator does not necessarily need to have ultimate control over the assets.
Once this layer of permission separation is understood, the essential difference between custodial and non-custodial models becomes clear:
In fully custodial staking, the two types of permissions are often concentrated in the hands of the platform. Users deposit ETH into a trading platform or custodian, and the platform is responsible both for running the node and for controlling withdrawal permissions. What users see on the front end is merely a string of book balances, and whether assets can be smoothly redeemed is directly subject to the platform's own fund management, withdrawal rules, and operating conditions. In the non-custodial staking model, the two types of permissions are physically isolated. Users control withdrawal permissions through their own wallets, while professional service providers hold only the signing key and are responsible for the daily operation and maintenance of the node. Even if the service provider takes over the cumbersome hardware and network maintenance, it cannot use the operational permission in its hands to transfer away users' staked principal.
The core value of this isolated design—"withdrawal rights belong to the user, operational rights belong to the service provider"—lies in minimizing the trust boundary. Users do not need to give up control of their principal, nor do they need to bear the high cost of node operation and maintenance alone.
Of course, non-custodial does not mean zero risk. The signing key still affects the validator's daily performance. If the service provider experiences key leakage, double signing, or severe downtime, the validator may still face penalties at the protocol level.
Therefore, the first step in evaluating a staking solution is to see whether it strictly isolates withdrawal permissions from operational permissions, and whether users truly hold in their own hands the key to recovering their assets.
How Does Ethereum's Native Protocol Protect Staked Assets?
Having understood key control rights, another key question is: why is direct participation in Ethereum native staking clearly superior in security structure to various third-party derivative staking products?
The core reason is that ETH native staking is built directly on Ethereum's underlying consensus protocol and does not require additional intermediate layers.
When users participate in native staking, ETH directly enters Ethereum's official validator system, and reward distribution and penalty enforcement are fully automatically executed by the underlying protocol code. It does not need to rely on a third-party fund pool to aggregate assets, nor does it need to mint a derivative token (such as an LST) to indirectly map staking rights, thereby eliminating at the root the composite risks brought by third-party protocol contracts, cross-layer governance, and derivative depegging.
To date, within the native protocol, Ethereum has also established clear security and exit boundaries through three mechanisms.
First, the protocol constrains validator behavior through rewards and penalties. Validators need to remain online continuously and submit block proposals and attestations as required. If a node fails or remains offline for a long time, it may miss rewards and suffer corresponding balance penalties. If a validator engages in more serious violations, such as signing conflicting blocks, it may trigger Slashing, in which part of the staked ETH is destroyed and the validator is forcibly ejected from the network. The purpose of this mechanism is to ensure that participants, while earning staking returns, must also bear corresponding responsibilities, so that any attempt to undermine network consensus requires paying a real economic price.
Second, withdrawal permissions and validator operation permissions can be independent of each other. This is a very important design in native staking for asset security. Even if there is a problem with the validator's signing key, as long as the withdrawal key is still securely kept by the user, an attacker cannot simply use the signing key to directly withdraw the user's staked principal. After the Pectra upgrade, Ethereum further improved this mechanism: the withdrawal address can also directly initiate a validator exit operation, no longer relying entirely on the validator signing key. This gives non-custodial users an underlying guarantee to "force withdrawal of funds" in extreme circumstances.
Finally, the exit of native staking is also constrained by protocol rules. Native staking supports reward withdrawal and full principal exit, but it does not arrive instantly like an ordinary wallet transfer. After a validator initiates an exit, it must enter the network-wide exit queue according to protocol rules (the queue time depends on the number of validators exiting simultaneously across the network at that time). Only after completion will the principal and remaining rewards be automatically settled to the bound withdrawal address (further reading: "Why Do You Need to Queue for a Month First to Participate in Ethereum Native Staking Now?").
From this perspective, the value of native staking is not only obtaining ETH rewards, but also providing an underlying settlement guarantee with fully public rules, on-chain transparency and verifiability, and no reliance on any centralized institution for redemption.
A Side-by-Side Breakdown of Mainstream Solutions: Where Exactly Are the Risks Distributed?
Combining "key control rights" and "protocol dependence," the four mainstream types of ETH staking solutions currently on the market essentially place risks in different baskets.
Staking services provided by exchanges and custodians usually have the lowest participation threshold, support small-amount staking, and offer an operating experience close to traditional wealth management, so users do not need to handle complex technical operations. But at the same time, control of the principal is completely transferred to the platform. Even if the underlying ETH ultimately enters Ethereum's official staking contract, users still need to bear the platform's credit risk, internal risk control risk, and withdrawal restrictions under extreme market conditions.
Taking liquid staking protocols such as Lido as an example, after users deposit ETH, they can obtain an LST representing staking rights, such as stETH, making it convenient to earn secondary yield in DeFi or cash out at any time in the secondary market. The biggest advantage of such solutions is lowering the participation threshold and allowing users to still participate in DeFi and other applications during the staking period, but the risk layers increase significantly. Holding an LST does not mean holding the validator's withdrawal rights; rather, it means holding a debt certificate based on a smart contract. In addition to the underlying node slashing risk, users also need to bear additional smart contract vulnerability risk, protocol governance risk, and, under extreme market conditions, LST secondary market discount (depegging) and redemption run risk, which has already occurred multiple times in the history of LSTs.
What non-custodial native staking attempts to solve is precisely the contradiction between asset autonomy and node operation and maintenance. Users participate in the network through Ethereum's native staking mechanism and hold the withdrawal key themselves, while professional service providers are responsible for the operation, monitoring, and maintenance of validators. This does not require users to bear the additional depegging risk of liquid staking tokens, and it also reduces the additional risks brought by third-party staking pool smart contracts and governance mechanisms.
If users have enough ETH and technical capability, they can also build validator nodes themselves. In this way, the signing key, withdrawal key, and node equipment are all managed by the users themselves, with no need to rely on third-party node service providers. But this does not mean the risk is the lowest: node hardware failure, network interruption, client configuration errors, improper key backup, and even duplicate signing can all cause reward losses or slashing. Therefore, for ordinary users without long-term node operation and maintenance experience, technical and maintenance costs are also a barrier.
Keep Control in Your Own Hands: The Long-Term Value of the Non-Custodial Model
In summary, different staking models address the needs of different capital sizes and risk preferences. For users who value absolute control over their principal and do not want to spend effort maintaining servers themselves, "non-custodial native staking" is undoubtedly the more suitable security solution.
This is also the core design philosophy of imToken's non-custodial ETH staking solution: withdrawal permissions that should never be handed over remain in the user's own wallet, while node operations requiring high-availability guarantees are entrusted to professional infrastructure.
At the practical implementation level, this solution also offers two modes—compound-interest validation nodes and auto-withdrawal validation nodes—allowing users to flexibly choose different fund management approaches.
Of course, choosing the non-custodial model does not mean one can be a "hands-off boss." Since the ultimate control of assets rests entirely with the user, users still need to fulfill their personal security responsibilities: properly backing up wallet mnemonic phrases offline, carefully verifying withdrawal addresses before initiating staking, and maintaining a clear understanding of the Ethereum protocol's exit queue mechanism, service fee rates, and potential underlying slashing rules.
As more and more ETH enters long-term yield-generating systems, as holders, what we truly need to focus on may not just be how much yield our assets can earn, but rather whether, when any external service link encounters an extreme situation, I still hold the ultimate initiative to retrieve my principal?
Keep the ultimate control of assets in your own hands, and let professionals handle professional matters. This may be the most noteworthy security value of non-custodial native staking.
