After depositing 32 ETH into a validator, is that ETH still truly yours?
With staking products now available everywhere, this sounds like an extremely basic question. Yet it is one that people often overlook entirely.
When comparing staking options, users have traditionally examined the numbers under a microscope: Does one provider offer an APR that is 0.2 percentage points higher? Is the service fee 5% or 10%? Do rewards compound automatically? How long does it take to exit?
But now that Ethereum’s network-wide baseline staking yield has fallen below 3%, the small differences in headline returns matter far less than they once did. Rather than chasing a few tenths of a percentage point in additional yield, there is a more important question—one that is often hidden beneath the product interface:
Once your ETH is staked, who actually controls it?
1. The Logic Behind Staking: The Operator Should Not Control the Money
To understand non-custodial staking, it is essential to understand one of Ethereum’s most elegant consensus-layer designs.
Operating a validator has never depended on just one key. At the protocol level, Ethereum separates authority into two distinctly different parts.
The first is the signing key, or validator signing private key.
This key is used to perform validator duties. It must remain online around the clock to submit attestations, propose blocks, and complete other consensus tasks. Whoever holds the signing key is responsible for operating the validator.
But the signing key cannot withdraw the principal. No matter how many messages it signs, it cannot transfer the staked ETH to another address. If the validator goes offline or commits a serious violation such as double-signing, however, its rewards or principal may be penalized.
The second component is the withdrawal credentials, which specify the address with authority over withdrawals.
This is the validator’s true “withdrawal authority.” Once configured on the Beacon Chain, the withdrawal credentials determine where the staked ETH and its rewards can ultimately be sent.
The key controlling that address can remain securely offline in a cold wallet or be derived from a seed phrase without ever being exposed to an internet-connected validator machine.
Ethereum’s distinction between these two forms of authority is clear: the signing key is a “hot” key that must remain online, while the withdrawal credentials represent the “cold” authority that determines where the staked ETH can be withdrawn.
This means that a third party can operate a validator on a user’s behalf without owning the user’s ETH.
That is what makes a non-custodial staking service such as imToken possible. A node provider such as InfStones holds the signing key and handles infrastructure maintenance, network security, and round-the-clock validator availability. Its performance affects how reliably the validator runs and how much it earns in rewards, but it does not have the authority required to withdraw the staked funds to itself.
The control model became even stronger after Ethereum introduced EIP-7002, or execution-layer triggerable withdrawals.
Previously, if a node operator became unresponsive or refused to cooperate, it still could not take the ETH. But the user might have had to wait for the operator to sign and broadcast a voluntary exit message with the validator’s signing key.
EIP-7002 changed this. If a user controls the execution-layer address specified by the validator’s 0x01 or 0x02 withdrawal credentials, they can submit an execution-layer request to exit the validator and enter the withdrawal queue.
In other words, even if the node provider disappears entirely, the user’s ETH does not have to remain trapped in staking.
This is the defining feature of non-custodial staking. A third party may participate in the staking process, but the party responsible for operating the validator does not simultaneously hold the authority to take the money.
2. What Can the User, Wallet, Node Provider, and Ethereum Actually Do?
Following this separation of responsibilities reveals that even a seemingly simple ETH staking operation involves at least four parties:
The user, the wallet, the node provider, and the Ethereum protocol itself. Each has a different set of permissions.
The User
In a genuinely non-custodial architecture, the user retains the most important authority: control over the funds.
Take imToken’s non-custodial ETH staking service as an example. The user retains withdrawal authority, meaning the service provider cannot unilaterally transfer the staked ETH into its own account. The validator and its operating status can also be verified directly onchain.
This is fundamentally different from handing tokens to someone else to manage on your behalf.
The ETH no longer appears as an ordinary balance in the user’s wallet. It has been deposited into Ethereum’s Deposit Contract and now forms part of a validator balance. But that does not make it an asset belonging to the node operator.
The operator maintains the validator and handles its day-to-day duties—it does not control withdrawals.
The Wallet
A wallet acts as the user’s interface for managing these permissions. It is not the owner of the staked assets.
It helps the user initiate staking, manage addresses, sign operations, and view validator status and rewards. But as long as the underlying system follows a non-custodial design, the wallet provider does not automatically receive withdrawal authority simply because it provides the interface.
“Staking through a wallet” and “giving custody of ETH to a wallet provider” are therefore two entirely different arrangements.
What ultimately determines the custody model is how the signing keys and withdrawal credentials are configured beneath the interface.
The Node Provider
The node provider is the most commonly misunderstood participant in non-custodial staking.
If the user is not running a machine around the clock, someone still needs to maintain the validator.
The node provider operates the clients, keeps the validator online, performs its validation duties, and safeguards the signing key used for those tasks. It therefore remains an important part of the arrangement.
Frequent downtime can cause the user to lose rewards they would otherwise have earned. Serious validator misconduct can also result in slashing.
“Non-custodial” has never meant “free of service-provider risk.” It means that the risks introduced by the provider are primarily related to validator performance and rewards, not custody of the user’s 32 ETH.
The Ethereum Protocol
The final participant is the Ethereum protocol itself, and its role is often the easiest to overlook.
Once ETH enters a validator, no party can transfer it at will as though it were an ordinary wallet balance.
The funds must follow Ethereum’s protocol rules. The protocol determines when the validator can be activated, when it may exit, whether it must wait in a queue, which behaviors result in penalties, and when the final withdrawal can be processed.
The same is true for the 0x02 compounding validators introduced through Pectra. They raise a validator’s maximum effective balance from the traditional 32 ETH to 2,048 ETH, allowing rewards to remain staked and compound. Withdrawals and exits, however, still follow protocol-defined procedures.
3. What About Lido? What Do Users Give Up for Liquidity?
Once this framework is clear, the distinction between non-custodial native staking and a liquid staking protocol such as Lido becomes much easier to understand.
When users deposit ETH into Lido, they receive stETH. The stETH belongs to the user and can be transferred, traded, or deployed across DeFi.
This is the core value of liquid staking: it releases liquidity that would otherwise remain locked inside validators.
At the same time, however, the control structure governing the underlying ETH changes.
Lido pools ETH from many users and allocates it through the protocol to different node operators, which create and maintain validators. The withdrawal credentials for these validators do not point to the individual Ethereum address of each stETH holder. They are configured by the Lido protocol, while the underlying withdrawal process involves its smart contracts, oracles, node operators, and other protocol components.
Users therefore hold the staking claim represented by stETH. They do not control the withdrawal credentials of an individual validator that belongs exclusively to them.
When users want to redeem stETH for ETH through the protocol, they submit a request to the Lido Withdrawal Queue. They must then wait while the protocol completes the relevant exits and prepares the funds.
Lido issues an NFT representing the withdrawal request. Once the request has been finalized, the NFT holder can claim the underlying ETH.
Users still hold their own stETH, and Lido operates through smart contracts rather than giving a single centralized institution unrestricted authority to take all user assets. Nevertheless, its trust boundaries differ from those of non-custodial native staking, where each user has a dedicated validator and directly controls its withdrawal address.
Liquid staking offers a lower participation threshold, greater liquidity, and broad composability for stETH across DeFi.
Non-custodial native staking requires at least 32 ETH and means giving up some liquidity, but it creates a more direct relationship between the user and control over the underlying validator funds.
Put simply, liquid staking is more like holding a transferable receipt for a share of staked assets.
Non-custodial native staking is closer to having a dedicated validator while outsourcing only its day-to-day operation.
Neither model is inherently superior.
For users who hold only a few ETH, need to trade at any time, or want to participate actively in DeFi, a liquid staking asset such as stETH is clearly more convenient.
But the calculation changes for someone holding 32, 64, or more ETH over the long term without significant liquidity needs. When yield differences are too small to determine the choice, the question of who controls the assets carries far greater weight.
Staking rewards change every day. APR rises or falls with the total amount of ETH staked, and service fees may also be adjusted.
But where the withdrawal credentials point, who can withdraw the principal, and whether a third party must cooperate during an emergency define the product’s underlying trust model.
This may be one of the most easily overlooked changes as ETH staking matures:
As the returns and user experience of different products converge, the factor that truly distinguishes them may return to the simplest question of all—who still controls my ETH?
Final Thoughts
There is no universally right or wrong choice.
If you hold only two or three ETH, or actively build leveraged positions across composable DeFi strategies, a liquid staking token such as stETH may be the more practical option in terms of both capital efficiency and accessibility.
But if your goal is to establish a medium- to long-term core position on Ethereum—whether 32 ETH or considerably more—the calculation changes completely.
When the difference in net yield between products has narrowed to a few tenths of a percentage point or even a few basis points, taking on additional layers of smart-contract and governance risk for that marginal return may offer little value.
The crypto industry often repeats the phrase:
“Not your keys, not your coins.”
In the context of staking, perhaps it deserves an additional line:
“Not your withdrawal credentials, not your native stake.”