不再只谈 APR：质押之后，你的 ETH 到底是谁的？

After staking 32 ETH into a validator, is that money still "yours"?

In today's world filled with various staking products, this sounds like an extremely basic question—yet it's one that everyone tends to skip over by default.

In the past, when choosing a staking solution, people would habitually pull out a magnifying glass to compare: whose APR is 0.2% higher? Is the fee cut 5% or 10%? Does it support auto-compounding? When can I withdraw?

But today, with the benchmark staking yield across the entire network being flattened to below 3%, the tiny gaps in book yields between various platforms are no longer worth fussing over. Compared to jumping through hoops for a few tenths of a percent in interest, another question that has been hiding beneath the product interface matters far more:

After your ETH is staked, who actually controls it?

1. The Underlying Logic of Staking: Those Who Do the Work Cannot Manage the Money

To truly understand non-custodial staking, the key lies in grasping a remarkably elegant design that Ethereum employs at the consensus layer.

Running a validator has never been about just one key. At the protocol level, permissions are split into two entirely distinct halves.

The first type is the Signing Key—the validator signing private key.

This key is specifically used for "doing the work." It must stay online 24/7 to participate in attestations, propose blocks, and complete various consensus tasks. It has to be directly attached to a server, constantly connected to the network. Whoever holds this key is responsible for running that machine.

However, it can only be used to prove that you're faithfully participating in consensus. Even if you sign a million times with this key, it can never touch the principal. Moreover, if the machine goes offline or engages in malicious double-signing, Ethereum penalizes the validator's rewards or principal accordingly.

The second type is the Withdrawal Credentials—the withdrawal control rights pointed to by those credentials.

This is the true "withdrawal password." It is inscribed on the Beacon Chain at the moment staking takes effect, determining where the staked ETH and accrued rewards can ultimately be withdrawn to.

This key can safely rest in your cold wallet or mnemonic phrase for a lifetime without ever needing to go online.

In fact, the Ethereum Foundation's positioning of the two is quite clear: the validator signing key is a "hot" permission that needs to remain online, while the withdrawal credentials represent the "cold" permission at the level of fund ownership.

This means that a third party can run a validator on behalf of a user without thereby owning the user's ETH.

This is precisely why non-custodial staking solutions like imToken work—node service providers (such as InfStones) hold the Signing Key, handling data center operations, network attack defense, and maintaining 24/7 uptime. They determine whether the node runs smoothly and how much block reward it earns, but no matter how thoroughly they search through the code, they will never find a single instruction that allows them to withdraw staked funds to themselves.

Even after Ethereum's upgrade introduced EIP-7002 (execution-layer triggerable exits), this closed loop of control has become even more absolute.

Previously, if a node operator went offline or became uncooperative, while they couldn't take your funds, users would still have to wait for the operator to broadcast an exit message using the Signing Key—leaving users in a passive position. But with EIP-7002, as long as the withdrawal credentials (0x01 / 0x02) are in your hands, you can use your own imToken wallet to send a transaction directly on the execution layer, forcibly shutting down the validator and queuing up the refund.

In other words, even if a node service provider completely vanishes into thin air one day, your funds will not be trapped on the chain.

This is truly what "non-custodial" means in the context that matters.The entire staking process does involve third parties, but those responsible for doing the work do not simultaneously hold the power to take the money away.

2. What Can Users, Wallets, Node Service Providers, and Ethereum Each Actually Do?

Continuing to break this down along the same line, a seemingly simple ETH staking operation actually involves at least four participants.

Namely: the user, the wallet, the node service provider, and the Ethereum protocol itself—except that the permissions each of them holds are not the same.

First is the user.

In a truly non-custodial architecture, the user retains the most critical fund control rights.

Taking imToken's non-custodial ETH staking as an example, users hold withdrawal-related permissions, and service providers cannot arbitrarily transfer staked assets to their own accounts. Validator status can also be directly verified on-chain.

This is fundamentally different from what many people commonly understand as "handing your coins to someone else for investment management." Although the ETH no longer sits in the user's wallet balance—having entered Ethereum's Deposit Contract and become validator balance—it has not thereby become an asset of the relevant node operator.

The node maintains the Validator on your behalf, controlling its operational permissions—not asset withdrawal rights.

Second is the wallet.

The wallet acts more like an entry point for users to manage this set of permissions, rather than an owner of the staked assets.

It helps users initiate staking, manage addresses, sign operations, and check validator status and rewards. However, as long as the underlying design remains non-custodial, the wallet service provider does not automatically gain withdrawal rights to user assets simply by providing this interface.

Therefore, "staking through a wallet" and "custodying ETH with that wallet" are two completely different concepts. What truly determines the nature of the arrangement is still how the underlying keys and Withdrawal Credentials are configured.

The third participant is the node service provider.

This is the aspect of non-custodial staking most prone to misunderstanding. Since users don't run machines 24/7 themselves, someone has to maintain the validators.

Node service providers are responsible for running clients, maintaining uptime, completing validation tasks, and safeguarding the Signing Keys used for this work. This means they remain highly important—if they experience frequent downtime, users lose a portion of rewards they would have earned; if serious violations occur, there is slashing risk.

So "non-custodial" never means "no service provider risk." It simply means this risk is primarily confined to the quality of validator operations and reward levels—not "whether the service provider can transfer your 32 ETH away."

The final participant is the Ethereum protocol itself.

This layer is often the most easily overlooked. Once ETH enters a validator, no party can transfer it at will like a regular wallet balance.

It must adhere to the rules uniformly established by Ethereum—such as when it can be activated, when it can exit, whether exits require queuing, what behaviors result in penalties, and when withdrawals are finally completed. All of this is determined by the protocol.

The 0x02 Compounding Validator introduced after Pectra follows the same principle. It raises the effective balance of validators from the traditional 32 ETH cap to a maximum of 2048 ETH, allowing rewards to continue compounding—but withdrawals and exits still proceed according to protocol rules.

3. What About Lido? What Is Sacrificed in Exchange for Liquidity?

With this framework in place, the distinction becomes immediately apparent when looking at liquid staking solutions like Lido.

After depositing ETH into Lido, users receive stETH, and the stETH itself remains entirely owned by the user—it can be transferred, traded, or further utilized in DeFi.

This is the greatest value of liquid staking: it releases the liquidity that was previously locked within validators.

But at the same time, the control structure over the underlying ETH has changed.

Lido pools together ETH from a large number of users and distributes it via the protocol to various Node Operators who create and run validators. The Withdrawal Credentials for these validators are not each stETH user's own Ethereum address, but rather are set uniformly by the Lido protocol. The underlying withdrawal process is jointly executed by the protocol's smart contracts, oracles, node operators, and other components.

Thus, users hold the staking rights represented by stETH—not the Withdrawal Credentials of a "validator that belongs solely to them."

When users want to redeem ETH from the protocol, they need to submit their stETH to Lido's Withdrawal Queue, wait for the protocol to complete the corresponding exit and fund preparation, and then claim the ETH. Lido generates an NFT representing the withdrawal right for each request, and users can only claim the underlying ETH after the request is fully processed.

However, while it may appear that users still hold their own stETH and the protocol operates via smart contracts without any centralized institution that can arbitrarily take all user assets, it does have a different trust boundary compared to non-custodial native staking—where each person has their own validator and the withdrawal address belongs directly to the user.

The former offers a lower barrier to entry, better liquidity, and the extensive composability of stETH across DeFi.

The latter sacrifices some liquidity and requires at least 32 ETH, but makes the fund control relationship over the underlying validator far more direct.

Simply put, liquid staking is more like holding a freely tradable "staked asset certificate," while non-custodial native staking is closer to owning a validator that truly belongs to you—merely outsourcing its day-to-day operations.

There is no absolute superiority of one over the other.

For users who hold just a few ETH, need to trade at any time, or wish to participate in DeFi, liquid staking assets like stETH are clearly more convenient.

But if a user holds 32 ETH, 64 ETH, or more for the long term, without strong liquidity needs, then the yield differential is not significant enough to be the deciding factor. In such cases, the security consideration of "who controls the assets" carries far greater weight.

After all, staking rewards change every day—APR fluctuates as total network staking volume rises or falls, and fee structures may also be adjusted.

But where the Withdrawal Credentials point, who can withdraw the principal, and whether third-party cooperation is needed under extreme circumstances—these determine the most fundamental trust structure of the entire product.

This may also be an easily overlooked shift as ETH staking matures:

As rewards and user experiences across various products converge, what will truly set them apart may come back to the most basic question—who actually holds my ETH?

Final Thoughts

There is no absolute right or wrong in making this choice.

If you only have two or three ETH, or you're passionate about playing circular lending games in the DeFi Lego ecosystem, then liquid staking tokens like stETH are the more pragmatic choice—both in terms of capital efficiency and barrier to entry.

But if your goal is to build a medium-to-long-term core position within the Ethereum network—whether 32 ETH or more—the situation changes entirely. When the net yield difference between various products is reduced to mere tenths of a percent, or even a few basis points, taking on lengthy contract calls and governance risks for such marginal gains offers extremely poor value.

In the crypto industry, people often say, "Not your keys, not your coins."

But in the context of staking, perhaps it deserves an additional clause: "Not your withdrawal credentials, not your native stake."