Understanding ETH Staking: Who Controls Your Funds?

Article by: imToken

After staking 32 ETH into a validator, is that money still considered “yours”?

In today’s landscape of countless Staking products, this is a question that sounds extremely basic but is often silently overlooked by everyone.

In the past, people would scrutinize staking options meticulously: Which one offered 0.2% higher APR? Was the fee cut 5% or 10%? Did it support auto-compounding? And when could they withdraw?

But today, with the global staking base yield having been pushed below 3%, the tiny differences in reported returns among platforms are no longer meaningful. Far more important—a issue long buried beneath the product interface—is:

Who controls your ETH after you stake it?

To understand non-custodial staking, the key is to grasp a very sophisticated design that Ethereum implements at the consensus layer.

Running a validator has never been about relying on a single key—it splits permissions into two entirely distinct parts at the protocol level.

One type is the Signing Key, which is the private key used to verify signatures.

This key is exclusively used for "work"—it stays online 24/7 to participate in attestations, propose blocks, and complete various consensus tasks, and must be directly connected to a server at all times, maintaining constant internet connectivity. Whoever holds this key is responsible for running this machine.

But it can only be used to prove that you are honestly participating in consensus; even if you sign with this key ten thousand times, you cannot touch the principal. If the machine goes offline or engages in违规 double-signing, Ethereum will slash the rewards or principal of this validator.

Another type is Withdrawal Credentials, which refer to the control over withdrawal rights.

It is the true "withdrawal password," permanently written into the beacon chain at the moment staking takes effect, determining where the staked ETH and its earned rewards can ultimately be withdrawn to.

This key can lie peacefully in your cold wallet or mnemonic phrase your entire life without ever needing to connect to the internet.

In fact, Ethereum's official positioning of the two is very clear: the signature verification key represents a "hot" permission that must remain online, while the withdrawal credential represents a "cold" permission tied to asset ownership.

This means that a third party can fully operate a validator on behalf of the user without needing to possess the user’s ETH.

This is why non-custodial staking solutions like imToken work—node service providers (such as InfStones) hold the signing key and are responsible for data center operations, network attack prevention, and maintaining 24/7 uptime; they determine how smoothly the node runs and how much block reward it earns, but even after thoroughly reviewing the code, they cannot find a single line that allows them to withdraw staked funds.

Even after Ethereum's upgrade and the introduction of EIP-7002 (Execution Layer Triggered Exits), this layer of control has become even more closed.

Previously, if a node operator went offline or acted maliciously, although they couldn’t withdraw your funds, users often had to wait for the operator to broadcast an exit message using their Signing Key, leaving them at a disadvantage. With EIP-7002, as long as you hold your withdrawal credentials (0x01 / 0x02), you can use your imToken wallet to send a direct instruction on the execution layer to forcibly shut down the validator and queue it for a refund.

In other words, even if a node provider were to disappear completely, your funds would not be locked on the chain.

This is precisely where the true focus of "non-custodial" lies: while third parties are involved in the staking process, the individuals doing the work do not simultaneously hold the power to withdraw the funds.

Continuing to break down this line reveals that what appears to be a simple ETH staking actually involves at least four participants.

That is, users, wallets, node service providers, and the Ethereum protocol itself, though they have different levels of access.

First, the user.

In a true non-custodial architecture, users retain full control over their funds.

Taking imToken's non-custodial ETH staking as an example, users retain control over withdrawal permissions, and the service provider cannot transfer staked assets to their own account. Validator status can also be directly queried on-chain.

This is fundamentally different from what many people commonly understand as “entrusting your coins to someone else for investment.” Although ETH is no longer sitting in a user’s wallet balance but has been deposited into the Ethereum Deposit Contract and become validator balance, it does not thereby become the asset of the associated node.

The node maintains a Validator on your behalf and controls its operational permissions, not the authority to withdraw assets.

Next is the wallet.

The wallet serves more as an entry point for managing user permissions rather than as the owner of staked assets.

It helps users initiate staking, manage addresses, sign operations, view validator status, and track rewards, but as long as the underlying system maintains a non-custodial design, the wallet service provider does not automatically gain withdrawal access to user assets simply by providing this interface.

Therefore, "staking through a certain wallet" and "depositing ETH to this wallet" are two completely different concepts; what truly determines the nature is still how the underlying key and withdrawal credentials are configured.

The third role is a node service provider.

This is the most commonly misunderstood part of non-custodial staking: if users aren’t running machines 24/7, someone must still maintain the validator.

Node service providers are responsible for running clients, maintaining online status, completing verification tasks, and safeguarding the Signing Key used for these operations, meaning they remain critically important; if they experience frequent downtime, users may lose a portion of their expected rewards, and in cases of serious misconduct, there is a risk of Slashing.

So "non-custodial" never means "no service provider risk"—it simply means that the risk is primarily limited to the quality and yield of the validator operation, rather than whether the service provider can transfer your 32 ETH.

The final role is the Ethereum protocol itself.

This layer is often the most overlooked: once ETH enters a validator, neither party can transfer it at will, as one would with a regular wallet balance.

It must adhere to the rules established by Ethereum, such as when activation is possible, when withdrawal is allowed, whether withdrawal requires a queue, what behaviors by validators result in penalties, and ultimately when the withdrawal is completed—all determined by the protocol.

The 0x02 Compounding Validator introduced after Pectra works similarly, allowing a validator's effective balance to increase from the traditional 32 ETH cap up to a maximum of 2048 ETH, enabling rewards to continue compounding, while withdrawals and exits still follow protocol rules.

Once this framework is established, the difference with liquid staking like Lido becomes very clear.

After users deposit ETH into Lido, they receive stETH, which remains fully owned by the user and can be transferred, traded, or used further in DeFi.

This is also the greatest value of Liquid Staking, as it releases liquidity that was previously locked in validators.

But at the same time, the underlying control structure of ETH has changed.

Lido aggregates large amounts of users' ETH and distributes them via the protocol to various Node Operators who create and operate validators. The withdrawal credentials for these validators are not each stETH user's own Ethereum address, but are uniformly set by the Lido protocol, and the underlying withdrawal process is carried out jointly by the protocol’s smart contracts, oracles, and node operators.

So users hold the staking rights represented by stETH, not the Withdrawal Credentials of a specific validator "belonging to them."

When a user wants to redeem ETH from the protocol, they must submit their stETH to the Lido Withdrawal Queue and wait for the protocol to complete the corresponding exit and fund preparation before claiming the ETH. Lido generates an NFT representing the withdrawal right for this request, and the underlying ETH can only be claimed once the request is fulfilled.

However, although it appears that users still hold their stETH and the protocol operates entirely through smart contracts without a centralized entity that can arbitrarily seize user funds, it does have a different trust boundary compared to non-custodial native staking, where each user operates their own validator and withdrawal address directly.

The former brought lower participation barriers, improved liquidity, and broad composability of stETH in DeFi;

The latter sacrifices some liquidity and requires at least 32 ETH, but establishes a more direct control relationship over the underlying validator funds.

In simple terms, Liquid Staking is like holding a freely tradable "staking asset receipt," while non-custodial native staking is more like owning your own Validator, only outsourcing its day-to-day operations.

Neither has an absolute advantage over the other.

For users with only a few ETH who need to trade frequently or want to participate in DeFi, liquid staking assets like stETH are clearly more convenient.

However, if a user holds 32 ETH, 64 ETH, or more over the long term and has no strong liquidity needs, the difference in yield is not significant enough to determine the choice—here, the security consideration of “who controls the assets” becomes the dominant factor.

Since Staking rewards change daily, the APR fluctuates with the total network staking amount, and rates may also be adjusted.

After all, where the Withdrawal Credentials point, who can withdraw the principal, and whether third-party cooperation is needed in extreme scenarios determine the most fundamental trust structure of the entire product.

This may also be a subtle change that is easily overlooked after ETH Staking has gradually matured:

As the yields and experiences of various products become increasingly similar, what will truly set them apart may come down to the most fundamental question—whose hands is my ETH really in?

There is no absolute right or wrong in choices.

If you only have two or three ETH, or enjoy playing with DeFi LEGO-style leveraged lending, stETH and similar liquid staking tokens are a more practical choice in terms of capital efficiency and accessibility.

But if your goal is to establish a core, medium- to long-term position on the Ethereum network—whether 32 or more—the situation changes entirely. When net yield differentials across products shrink to just a few basis points or less, the cost-benefit ratio of pursuing such minimal returns while bearing lengthy contract calls and governance risks becomes extremely low.

In the crypto industry, people often say, "Not your keys, not your coins."

But in the context of Staking, it might also need an additional half-sentence: «Not your withdrawal credentials, not your native stake.»