Pledge income is just a result; who holds the withdrawal key, how the validators operate, and whether ETH relies on additional smart contracts and liquidity structures are more important.

Written by: imToken

In recent times, security incidents in the Crypto industry have been almost incessant (extended reading "From Binance to PHP2Shell: In the AI era, the perimeter of web security urgently needs to be redefined").

From exchanges losing billions of dollars to wallet supply chains and third-party service providers being attacked, to smart contract vulnerabilities and on-chain assets being stolen, a series of events repeatedly remind us: in the Crypto world, asset security does not only depend on whether the underlying blockchain is reliable, but also on who safeguards the assets, who controls the keys, and how many trust links exist in the entire service chain.

For ETH holders, participating in staking is the same.

Ethereum has established a relatively mature native staking mechanism. Users can become network validators by staking ETH, earning protocol rewards while maintaining network security. However, as staking gradually develops various participation methods such as exchange custody, liquidity staking, and professional node services, an easily overlooked issue emerges:

For the same ETH staking, the asset control rights and security boundaries behind different schemes may be drastically different.

If ETH is entrusted to a third party, who ultimately has the withdrawal rights? If the validator is run by a professional service provider, can the user still independently control the principal? And what potential risks arise between native staking and liquidity staking?

Clarifying these issues may be more important than simply comparing the APY of different staking products.

1. The First Line of Defense for Staking Security: Who Holds the Withdrawal Rights to the Assets?

To understand the security mechanism of ETH staking, one must first clarify who controls the Ethereum validator nodes.

Ethereum uses a Proof of Stake (PoS) consensus mechanism. Users can activate a validator node by depositing at least 32 ETH into a deposit contract, participating in block proposals, transaction verification, and consensus proof, and earning rewards according to network rules.

However, a validator node is not governed by a single key. In the Ethereum staking system, core authority is divided into two categories:

• Signing Key: Used for the daily operation of the validator, including submitting block proposals and validating proofs; it is the operational authority for participating in network consensus;
• Withdrawal Key: Used to control the ownership of staked principal and income, determining to which designated address (usually directly linked to the user's self-custodied wallet address) funds can ultimately be returned, representing the final control of the assets;

The responsibilities of both are very clear: the signing key determines whether the validator can operate normally, while the withdrawal key determines who can ultimately withdraw the funds. This means that the one responsible for operating the validator does not necessarily need to possess the final control of the assets.

Understanding this layer of authority division reveals the essential differences between custody and non-custody models:

• In fully custodial staking, both types of permissions are often centralized within the platform. Users deposit ETH into an exchange or custody institution, where the platform is responsible for node operations and holds withdrawal rights. What users see on the front end is merely a balance, and whether the assets can be smoothly redeemed depends directly on the platform's own fund management, withdrawal rules, and operational conditions;
• In a non-custodial staking model, the two types of permissions are physically isolated. Users control the withdrawal rights through their own wallets, and the professional service provider holds only the signing key, responsible for the day-to-day operation and maintenance of the node. Even if the service provider manages the cumbersome hardware and network maintenance, they cannot move the user's staked principal using the operational rights in hand;

This kind of separation design of “withdrawal rights belong to the user, operational rights belong to the service provider” aims to minimize trust boundaries—users do not need to relinquish control over the principal or bear the high costs of node maintenance alone.

Of course, non-custodial does not mean zero risk.

The signing key still affects the daily performance of the validator. If the service provider suffers from key leakage, double signing, or severe outages, the validator may still face penalties at the protocol level.

Therefore, the first step in evaluating a staking scheme is to see whether it strictly isolates withdrawal rights from operational rights, and whether users truly have the keys to reclaim their assets in hand.

2. How Does the Ethereum Native Protocol Protect Staked Assets?

Understanding key control rights leads to another crucial question: why does directly participating in Ethereum's native staking clearly outperform various types of third-party derivative staking products in terms of security structure?

The core reason is that ETH native staking is directly built on the underlying consensus protocol of Ethereum, eliminating the need for additional intermediary layers.

When users participate in native staking, ETH directly enters the Ethereum official validator system, and income distribution and violation penalties are fully executed by the underlying protocol code automatically.

It neither relies on a third-party fund pool to aggregate assets nor needs to create a derivative token (such as LST) to indirectly map staking rights, effectively eliminating the composite risks arising from third-party protocol contracts, cross-layer governance, and derivative disconnection from reality.

As of now, within the native protocol, Ethereum has also established clear security and exit boundaries through three mechanisms.

First, the protocol constrains validator behavior through rewards and penalties.

Validators need to remain online continuously, submitting block proposals and validation proofs as required. If a node experiences failure or remains offline for an extended period, it may miss rewards and incur corresponding balance penalties.

If validators engage in more severe violations, such as signing conflicting blocks, they may trigger Slashing (penalty mechanism), where a portion of staked ETH will be destroyed, and the validator will be forcibly exited from the network.

The purpose of this mechanism is to ensure that participants earn staking rewards while also mustering corresponding responsibilities. Thus, any attempt to undermine network consensus requires incurring a real economic cost.

Second, withdrawal rights and validator operation rights can be mutually independent.

This is a crucial design aspect for asset security in native staking. Even if a validator's signing key encounters issues, as long as the withdrawal key remains securely held by the user, attackers cannot simply use the signing key to withdraw the user's staked principal directly.

Ethereum further improved this mechanism after the Pectra upgrade, allowing withdrawal addresses to directly initiate validator exit operations, no longer fully relying on the validator's signing key. This grants non-custodial users the underlying guarantee of “forcibly withdrawing funds” in extreme situations.

Lastly, the exit from native staking is also bound by protocol rules.

Native staking supports reward extraction and complete withdrawal of the principal but does not allow for instant transactions like regular wallet transfers. After initiating an exit, the validator must enter the network-wide exit queue according to protocol rules (the duration of the queue depends on the number of validators exiting simultaneously) before both principal and remaining rewards are automatically settled to the bound withdrawal address (extended reading "Why do I have to queue for a month to participate in Ethereum's native staking now?").

From this perspective, the value of native staking lies not only in earning ETH rewards but also in providing a fully open rule set, transparently verifiable on-chain, and not relying on any centralized institution for settlement.

3. Comparison of Four Mainstream Schemes: What Are the Security Boundaries of Different Staking Models?

By combining “key control rights” with “protocol reliance,” the current four types of ETH staking schemes in the market essentially place risks in different baskets.

1. Fully Custodial Staking (Centralized Exchanges / Custody Institutions)

The staking services provided by exchanges and custody institutions generally have the lowest barriers to entry, support small-scale staking, and offer a user experience close to traditional wealth management, meaning users do not have to deal with complex technical operations.

However, the control rights over the principal are entirely transferred to the platform. Even if the underlying ETH ultimately enters the official staking contract of Ethereum, users still need to bear the platform's credit risk, internal risk control risks, and withdrawal restrictions in extreme market conditions.

2. Liquidity Staking (Represented by Lido and other LST protocols)

Taking Lido and other liquidity staking protocols as examples, users can receive LST, representing staking rights, such as stETH, after depositing ETH, allowing for secondary income generation in DeFi or cashing out in secondary markets at any time.

The greatest advantage of this type of scheme is that it lowers the participation threshold and allows users to engage in other applications such as DeFi while staked, but the risk level significantly increases. Holding LST does not equal holding the validator's withdrawal rights but rather holding a claim based on a smart contract.

In addition to the underlying node penalty risks, users also bear the additional risks of smart contract vulnerabilities, protocol governance, and secondary market discount (disconnection) and redemption runs during extreme conditions—which have occurred multiple times in LST's history.

3. Non-Custodial Native Staking (Self-Held Withdrawal Rights + Professional Node Operations)

Non-custodial native staking seeks to resolve the contradiction between asset autonomy and node maintenance.

Users participate in the network through Ethereum's native staking mechanism, holding the withdrawal key themselves, while professional service providers manage, monitor, and maintain the validators. This does not require users to bear the disconnection risks of liquidity staking tokens, nor does it add extra risks from third-party staking pool smart contracts and governance mechanisms.

4. Independent Staking (Solo Staking)

If users have enough ETH and technical abilities, they can build their own validator nodes. In this model, the signing key, withdrawal key, and node equipment are all managed by the users themselves, without relying on third-party node service providers.

However, this does not mean it is the lowest risk—node hardware failures, network interruptions, client configuration errors, improper key backups, and even double signing can lead to income losses or penalties. Thus, for ordinary users without long-term node maintenance experience, technical and maintenance costs are also a barrier.

In summary, the security differences among several models can be encapsulated as:

In conclusion, different staking models cater to different capital volumes and risk preferences. For users who value absolute control over their principal and do not wish to expend energy maintaining servers, "non-custodial native staking" undoubtedly offers a more suitable security solution.

This is also the core design idea of the imToken non-custodial ETH staking scheme—keeping withdrawal rights that should never be given away in the user's own wallet while assigning the node operations that require high availability to professional infrastructure.

In practical implementation, this scheme also provides two modes: compounding validator nodes and automatic withdrawal validator nodes, allowing users to flexibly choose different asset management methods:

• Compounding Validator Nodes: All rewards generated from staking will automatically remain in the validator's balance for compounding investment, improving long-term capital compound efficiency (the maximum effective staking limit for a single validator node can be expanded up to 2048 ETH);
• Automatic Withdrawal Validator Nodes: The effective balance of the validator node is maintained at 32 ETH, with excess consensus layer staking rewards automatically returned to the user's withdrawal address periodically without manual claims, suitable for users with periodic cash flow needs;

Of course, choosing a non-custodial model does not mean one can be an "arms-off manager." Since the ultimate control of the assets is entirely in one's own hands, users still need to fulfill their personal security responsibilities—properly offline backing up the wallet mnemonic, carefully verifying the withdrawal address before initiating staking, and maintaining a clear understanding of Ethereum's exit queue mechanism, service fees, and potential underlying penalty rules.

Final Thoughts

As an increasing amount of ETH enters long-term income systems, as holders, what we truly need to focus on may not just be how much income our assets can generate, but rather whether we still have the ultimate initiative to reclaim our principal when any one external service link encounters extreme conditions.

Keep the final control of the assets in your own hands, while letting professionals handle professional matters.

This may well be the most noteworthy security value of non-custodial native staking.