Written by: imToken

In the past period, security incidents in the Crypto industry have hardly stopped.

From trading platforms losing billions of dollars, to wallet supply chains and third-party service providers being attacked, to smart contract vulnerabilities and on-chain assets being stolen, a series of events repeatedly remind us: in the Crypto world, asset security depends not only on whether the underlying blockchain is reliable, but also on who holds the assets, who controls the keys, and how many trust elements exist in the entire service chain.

This is equally true for ETH holders participating in staking.

Ethereum has established a relatively mature native staking mechanism, allowing users to become network validators by staking ETH, thus earning protocol rewards while maintaining network security. However, as staking gradually develops into various participation methods such as exchange custody, liquid staking, and professional node services, an easy-to-overlook issue arises:

Though it is staking ETH, the control rights over assets and security boundaries behind different plans may differ greatly.

If ETH is given to a third party, who actually has the withdrawal authority? If a professional service provider operates the validator, can the user still maintain control over the principal? And what potential risks arise between native staking and liquid staking?

Clarifying these questions may be more important than simply comparing the APY of different staking products.

1. The First Line of Defense for Staking Security: Who Holds the Asset Withdrawal Rights?

To understand the security mechanism of ETH staking, one must first clarify who controls the Ethereum validator nodes.

Ethereum adopts a proof-of-stake (PoS) consensus mechanism, where a user can activate a validator node by depositing at least 32 ETH into a deposit contract, participating in block proposals, transaction validations, and consensus proofs, earning rewards according to network rules.

But a validator node is not controlled by a single key; in the Ethereum staking system, core authority is divided into two categories:

• Signing Key: Used for the daily operation of the validator, including submitting block proposals and validating proofs, representing the operating authority in network consensus;
• Withdrawal Key: Used to control the ownership of the staked principal and rewards, determining which designated address (usually directly bound to the user's self-custody wallet address) the funds can ultimately be returned to, representing the final control over the assets;

The responsibilities of both are very clear: the signing key determines whether the validator can perform its job normally, while the withdrawal key determines who can ultimately withdraw the funds. This means that the person responsible for running the validator does not necessarily need to have the final control over the assets.

Understanding this division of powers makes it clear the essential differences between custody and non-custody models:

• In completely custodial staking, both types of authority are often concentrated in the platform's hands. Users deposit ETH into trading platforms or custodial institutions, where the platform is responsible for node operation and also controls the withdrawal rights. What users see on the front end is just a balance on the books; whether assets can be successfully redeemed is directly subject to the platform's own fund management, withdrawal rules, and business condition;
• In non-custodial staking mode, the two types of authority achieve physical separation. Users control the withdrawal rights via their wallets, and professional service providers only hold the signing key and are responsible for the daily operation and maintenance of the node. Even if the service provider takes over the tedious hardware and network maintenance, they cannot move the user's staked principal away with the operational authority they hold;

This separation design of "withdrawal rights belong to users, operational rights belong to service providers" has core value in minimizing trust boundaries—users do not need to relinquish the control over the principal and do not need to bear the high node maintenance costs alone.

Of course, non-custodial does not mean zero risk.

The signing key still pertains to the daily performance of the validator. If the service provider suffers a key leak, double signature, or severe downtime, the validator may still face penalties at the protocol level.

Therefore, the first step in assessing a staking plan is to see whether it has strictly isolated the withdrawal rights from the operational rights, and whether users truly hold the keys to reclaim their assets.

2. How the Ethereum Native Protocol Protects Staked Assets?

Understanding key control rights leads to another critical question: why is directly participating in Ethereum's native staking structurally superior in security to various third-party derived staking products?

The core lies in that ETH native staking is built directly on the underlying consensus protocol of Ethereum without the need for additional intermediate layers.

When users participate in native staking, ETH directly enters the official Ethereum validator system, and reward distribution and penalty for violations are executed automatically by the underlying protocol code.

It does not need to rely on a third-party fund pool to aggregate assets, nor does it require the issuance of a derivative token (such as LST) to indirectly map staking rights, thus fundamentally eliminating the composite risks brought by third-party protocol contracts, cross-layer governance, and derivative disanchors.

As of now, within the native protocol, Ethereum has also established clear security and exit boundaries through three mechanisms.

First, the protocol constrains validator behavior through rewards and penalties.

Validators need to remain online continuously and submit block proposals and validation proofs as required. If nodes fail or are offline for an extended period, they may miss rewards and be subject to corresponding balance penalties.

If validators engage in more serious violations, such as signing conflicting blocks, they may trigger slashing mechanisms, where a portion of staked ETH will be destroyed, and validators will be forcibly exited from the network.

The purpose of this mechanism is to ensure that participants, while gaining staking rewards, must also bear corresponding responsibilities, making any attempts to undermine network consensus come at a real economic cost.

Second, withdrawal rights and validator operational rights can be mutually independent.

This is a very important design for asset security in native staking. Even if problems arise with the validator's signing key, as long as the withdrawal key is still securely held by the user, attackers cannot simply use the signing key to withdraw the user's staked principal directly.

After the Pectra upgrade, Ethereum further improved this mechanism, allowing the withdrawal address to directly initiate validator exit operations, no longer fully relying on the validator's signing key, thereby providing non-custodial users with an underlying guarantee for "forced fund withdrawal" in extreme situations.

Lastly, the exit of native staking is also constrained by protocol rules.

Native staking supports reward withdrawal and complete principal exit, but it does not arrive instantly like a typical wallet transfer. Once a validator initiates an exit, it must enter the global exit queue according to protocol rules (the queuing time depends on the number of validators exiting simultaneously), and only after completion will the principal and remaining rewards be automatically settled to the bound withdrawal address (further reading "Why do you need to queue for a month to participate in Ethereum's native staking?").

From this perspective, the value of native staking lies not only in obtaining ETH rewards but also in providing a completely open, on-chain, transparently verifiable set of rules that does not rely on any centralized institution for redemption.

3. Comparison of Four Mainstream Solutions: Where Are the Security Boundaries of Different Staking Models?

By combining "key control rights" and "protocol dependence," the four mainstream ETH staking solutions currently on the market essentially place risks in different baskets.

1. Completely Custodial Staking (Centralized Exchanges / Custodians)

The staking services provided by exchanges and custodians typically have the lowest participation threshold, support small stakes, and offer an experience close to traditional wealth management, allowing users to avoid handling complex technical operations.

However, at the same time, the control rights of the principal are entirely transferred to the platform, even if the underlying ETH ultimately enters the official Ethereum staking contract, users still need to bear the credit risk of the platform, internal risk controls, and withdrawal restrictions in extreme market conditions.

2. Liquid Staking (represented by protocols like Lido)

Taking protocols like Lido as an example, users can receive LST representing staking rights, such as stETH, after depositing ETH, which facilitates secondary earnings in DeFi or liquidating on the secondary market at any time.

The biggest advantage of this type of solution is lowering participation barriers and allowing users to participate in other applications during the staking period, such as DeFi. However, the risk level significantly increases. Holding LST does not equate to holding the validator's withdrawal rights but is holding a debt certificate based on smart contracts.

Apart from the underlying node penalty risks, users also have to shoulder additional smart contract vulnerability risks, protocol governance risks, and potential discounts (decoupling) and redemption run risks of LST in extreme market conditions—which has occurred multiple times in LST's history.

3. Non-Custodial Native Staking (Self-Holding Withdrawal Rights + Professional Node Operations)

Non-custodial native staking aims to resolve the contradiction between asset autonomy and node operations.

Users participate in the network through Ethereum's native staking mechanism while holding the withdrawal key, with professional service providers responsible for the operation, monitoring, and maintenance of the validator. This avoids the additional risks of liquid staking tokens’ decoupling and reduces the extra risks associated with third-party staking pool smart contracts and governance mechanisms.

4. Solo Staking

If users have sufficient ETH and technical ability, they can build their own validator node. In this case, the signing key, withdrawal key, and node equipment are all managed by the user, eliminating reliance on third-party node service providers.

However, this does not mean the risk is the lowest—node hardware failure, network interruptions, client configuration errors, improper key backups, or even double-signing can all lead to losses in rewards or slashing. Therefore, for ordinary users without long-term node operation experience, the technical and maintenance costs also represent a barrier.

In summary, the security differences among these models can be outlined as follows:

In conclusion, different staking models meet different funding sizes and risk appetite needs. For users who value absolute control over the principal but do not want to spend energy maintaining servers, "non-custodial native staking" is undoubtedly a more compatible safety solution.

This is also the core design philosophy of the imToken Non-Custodial ETH Staking solution: the withdrawal rights that should never be surrendered remain in the user's own wallet, while the node operations requiring high availability guarantees are entrusted to professional infrastructure.

On the practical implementation level, this solution also offers two modes of compounding verification nodes and automatic withdrawal verification nodes, allowing users to flexibly choose different funding management methods:

• Compounding Verification Nodes: All rewards generated from staking will automatically remain in the validator's balance for compound reinvestment, enhancing the long-term funding compounding efficiency (the maximum effective staking limit for a single validator node can be expanded up to 2048 ETH);
• Automatic Withdrawal Verification Nodes: The effective balance of the verification node remains at 32 ETH, and any excess consensus layer staking rewards will be periodically and automatically returned to the user's withdrawal address by the Ethereum protocol without the need for manual claims, suitable for users with periodic cash flow needs;

Of course, choosing a non-custodial model does not mean one can act as a "hands-off manager." Since the ultimate control over the assets is entirely in the user's hands, users still need to fulfill their individual security responsibilities—properly offline back up their wallet mnemonic, carefully verify the withdrawal address before initiating staking, and maintain a clear understanding of the Ethereum protocol's exit queuing mechanism, service fee rates, and potential underlying slashing rules.

Final Thoughts

As more and more ETH enters long-term earning systems, as holders, what we truly need to focus on may not only be how much returns our assets can earn but more importantly, whether I still retain the final active control to reclaim the principal when any external service link encounters extreme situations?

Keep ultimate control of the assets in your own hands and let professionals handle professional tasks.

This may be the most noteworthy security value of non-custodial native staking.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。