Institutional Staking Risks and How to Manage Them

TL;DR

• Institutional staking risks include slashing, downtime, key compromise, exit delays, and incidents affecting validators that share infrastructure.
• Staking models differ in custody and withdrawal control, while both remain subject to protocol and operational risks which is why choosing validator infrastructure provider is paramount.
• Risk controls, provider security assessments, incident reporting, and contractual terms vary by provider and may affect how incidents are handled.
• Staking outcomes depend on network rules, exit queues, infrastructure dependencies, and applicable regulatory requirements.
• Security certifications demonstrate an infrastructure operator’s commitment to established security practices, but do not eliminate protocol-level or operational risks.

What does institutional staking risk cover?

Institutional staking risk includes any event that can reduce the value of staked assets or delay access to them. The specific risks depend on how staking is managed and who controls the assets.

Native (non-custodial) staking

• Asset control: The institution retains control of withdrawals through its withdrawal credentials.
• Validator operations: The institution or a third-party operator runs the validator.
• Key risks: Operator outages, infrastructure failures, and delays in exiting staking.

Custodial staking

• Asset control: A custodian holds the assets.
• Validator operations: The custodian or its service provider operates the validator.
• Key risks: Custodian compromise, insolvency, and loss of access to assets.

Both models remain exposed to protocol-level and operational risks. Non-custodial staking reduces reliance on a custodian, but it does not eliminate the risks associated with validator operations or network rules.

What are the major institutional staking risks?

The main institutional staking risks include:

• protocol penalties, including slashing;
• unauthorized access to signing or withdrawal keys;
• network exit queues that delay access to staked assets
• incidents affecting multiple validators or operators at the same time;
• operator compromise;
• reliance on third-party relays that can introduce availability, censorship, or operational risks.

Can a validator go offline without being slashed?

Yes. On most major networks, a validator can go offline without being slashed. On Ethereum, slashing applies to specific provable offenses, such as proposing conflicting blocks or casting conflicting votes. Ordinary downtime generally results in missed rewards or inactivity penalties instead.

The consequences depend on the network. Ethereum applies inactivity penalties and increases them if the network stops finalizing. Solana currently has no enforced slashing, so downtime mainly means missed rewards, while proposed changes would introduce penalties for certain violations. On Cosmos Hub, double-signing can result in a 5% stake penalty and permanent removal from service, while prolonged downtime can trigger a smaller penalty and temporary jail.

Infrastructure failures or key compromises can create additional risks and may lead to slashing where network rules allow it. Because penalties and enforcement mechanisms vary by network and can change with upgrades, institutions should verify the current rules before staking.

Is active-active failover safe for validators?

No. Running 1 key set on 2 live machines is a common cause of slashing, because both instances can sign conflicting messages.

Safe failover combines:

• active-passive setups with fencing, so the standby signs only after the primary is confirmed down;
• persistent slashing-protection databases migrated together with the keys;
• signer-level double-sign protection that refuses conflicting messages;
• network-specific procedures, such as preserving the last-signed-height state file on Cosmos SDK chains.

Distributed validator technology (DVT) splits 1 key across operators with threshold signing. It is an option with its own coordination and client risks.

Who controls the keys in institutional staking?

Withdrawal authority (aka the institution) decides who can move staked principal, and signing authority decides who produces blocks and attestations.

Asset custody and withdrawal credentials typically rely on:

• multisig or MPC;
• HSM-backed custody;
• tiered approvals;
• address allow-lists.

Multisig protects assets and withdrawals only. Validator signing keys rely on:

• a remote signer;
• an HSM or KMS where the client supports it;
• slashing protection mechanisms.

Cover these risks in both controls:

• key compromise;
• loss of control over the withdrawal address;
• unauthorized transactions;
• untested recovery procedures;
• contractual loss allocation.

Pectra‘s EIP-7002 lets the withdrawal-credential owner trigger an exit from the execution layer without operator cooperation. Non-custodial staking reduces custody risk, while protocol and operational risk remain.

What is correlated staking risk?

Validators that share infrastructure go down together, so spreading stake across them adds no diversification. Common shared dependencies are:

• a cloud provider;
• a client;
• a signer;
• an operations team.

Ethereum applies a correlation penalty about 18 days after slashing, scaled by the total stake slashed in the same window.

Pectra cut the initial penalty to 1/4096 of effective balance, about 0.0078 ETH on 32 ETH. Validators can now hold up to 2,048 ETH, so a joint slashing of a few consolidated validators raises the correlation penalty for everyone involved (LlamaRisk).

Measure concentration at 2 levels:

• institution level, measuring stake per:
  • provider;
  • cloud;
  • client;
  • region;
• network level: each provider’s share of total network stake.

Potential risks of MEV relay infrastructure

Validators using MEV-Boost trust off-chain relays to deliver valid blocks and pay the correct fee recipient. Relay controls include:

• fee-recipient monitoring against an allow-list;
• documented relay selection;
• alerts on payment mismatches and missed blocks.

Glamsterdam‘s ePBS (EIP-7732) would replace trusted relays with in-protocol builder bids. It activated on Sepolia on October 6, 2026, and its mainnet date is not set (Ethereum Foundation).

How can institutions reduce staking risk?

Institutions reduce staking risk by giving each risk an owner and 2 controls, 1 preventive and 1 detective, then testing recovery before an incident.

Risk event	Cause	Impact	Preventive control	Detective control	Residual risk (illustrative)	Owner
Operator compromise forces a precautionary exit during a long exit queue	Unauthorized access to fee-recipient settings, validator configuration, or operator APIs	3+ weeks without rewards, then a re-entry wait	Client-held withdrawal credentials; least-privilege access to configuration; tested EIP-7002 exit path	Fee-recipient monitoring; operator incident notice within the contractual deadline	Medium: rewards lost, principal protected	Treasury operations, vendor risk
Double-sign slashing	1 key set active on 2 machines during failover	Stake burned, forced exit, possible correlation penalty	Active-passive fencing; slashing-protection database; remote signer	Signer alerts; on-chain slashing monitor	Low	Operator; reviewed by technology risk
Extended downtime	Cloud or region outage, client bug	Inactivity penalties, missed rewards	Multi-region hosting; client diversity	Attestation-rate and uptime alerts	Low	Operator
Liquidity shortfall	Redemption need during a long exit queue	Obligations unmet on time	Liquidity buffer; staggered exits	Queue-length monitoring	Medium	Treasury
Regulatory change	New rule, interpretation, or license requirement	Forced restructuring or exit	Legal review per staking model and jurisdiction	Regulatory watch with designated owner	Medium	Compliance, Legal

Incident response and recovery testing should cover:

• designated escalation owners at the institution and at each operator;
• defined approval authority for:
  • exits;
  • fee-recipient changes;
  • key rotation;
• recorded recovery drills for:
  • key restoration;
  • signer failover;
  • a withdrawal-credential exit.

Which regulatory, accounting, and contractual rules apply to staking?

As of October 21, 2026, US staking treatment rests on a Commission interpretation and staff views, with no market-structure statute, while the EU requires MiCA authorization.

Date	Jurisdiction	Instrument	Status	What it says
October 1, 2026	US	SEC crypto custody proposal	Proposal	Custody framework for SEC-registered advisers and regulated funds, covering crypto assets that are client funds or securities under the custody rules
September 15, 2026	US	CLARITY Act (H.R. 3633)	Stalled	Senate cloture vote did not pass, 49–50
July 1, 2026	EU	End of MiCA transitional period	Effective	Unauthorized CASPs must wind down, and CASPs cannot outsource custody to entities without CASP authorization
March 17, 2026	US	SEC interpretive release 33-11412, joined by the CFTC	Commission interpretation	Protocol staking, including self and custodial staking, involves no securities transaction under the described conditions; the release creates no safe harbor and does not bind courts
May 2025	US	SEC staff statement on protocol staking	Staff view	Treated provider activities as administrative or ministerial
January 17, 2025	EU	DORA	Effective	EU-regulated clients must manage staking providers as ICT third parties, with contract terms and exit plans

Staking treatment depends on jurisdiction and staking model, so confirm it with legal and tax advisers.

Which contract terms should institutions negotiate?

Review these terms, which set who bears a loss after an incident:

• liability caps;
• slashing reimbursement clauses, including covered penalties and exclusions;
• potential SLAs and incident-notification deadlines;
• termination rights and subcontractor disclosure.

Staking provider risk assessment 

Institutions might assess staking providers by checking each claim against independent evidence, such as audit reports and on-chain data.

Institutions could verify provider claims using independent evidence, including audit reports and on-chain data. They should review uptime records, infrastructure redundancy and recovery plans, slashing safeguards, security certification scope, and key management procedures. 

They could also assess incident reporting, escalation processes, provider concentration across shared infrastructure, and whether documented compliance controls apply to the specific staking service and relevant jurisdictions.

What does each security certification or assessment prove?

Security certifications and assessments show control maturity, however none removes slashing or downtime risk, specifically look for: ISO/IEC 27001:2022, SOC 2 Type II, NIST CSF 2.0, DORA controls assessment, security audits.

For each instrument, institutions might want to confirm:

• the audited entity;
• in-scope services;
• the assessment period;
• the assessor;
• exclusions.

Everstake has been a reliable validator for institutions since 2018, with a long history of operating on 130+ networks to date. Over that time, its infrastructure, controls and reporting have grown with institutional demands, making operational excellence a standard that is independently verified rather than claimed.

Everstake institutional staking coverage as of October 2026:

• SOC 2 Type II and ISO/IEC 27001:2022;
• GDPR and CCPA compliance;
• NIST CSF 2.0 alignment since October 2025, with an independent maturity score of 4.16;
• an independent DORA controls assessment by Prescient Security under ISO 19011, with controls evaluated as of June 5, 2026. The full report is available to clients through the Everstake Trust Center.

Institutions evaluating a staking provider can review this evidence directly, the same way this guide recommends testing every provider claim.

How do institutions make staking risk measurable?

Institutional staking risk becomes measurable once each risk has an owner and a tested control. Institutions can act on this in 3 steps:

1. Keep custody and signing controls apart.
2. Test exits before they are needed.
3. Require proof for every provider claim.

Institutional staking FAQ

Is protocol staking a securities transaction in the US?

Generally no, under the conditions in the SEC‘s March 17, 2026 interpretive release 33-11412, which applies where the provider’s role is administrative and does not bind courts.

Is slashing live on Solana?

No: as of October 2026, SIMD-0204 records provable violations and SIMD-0212 proposes penalties, with no stake penalties enforced on Solana.

Can an institution exit an Ethereum validator without its operator?

Yes, since the Pectra upgrade of May 2025, EIP-7002 lets the withdrawal-credential owner trigger an exit from the execution layer.

Does a SOC 2 Type II report mean a validator cannot be slashed?

No, because SOC 2 Type II is an auditor’s opinion on controls over a defined period, and slashing exposure depends on signer design and network rules.

Does non-custodial staking remove staking risk?

No, it reduces custody risk only: in the September 30, 2026 MetaMask Staking incident, client-held withdrawal credentials protected principal, yet about 17,000 validators still exited.

How much ETH can a slashed validator lose?

Up to the full balance: the initial penalty is 1/4096 of effective balance (about 0.0078 ETH on 32 ETH), and missed-duty and correlation penalties follow, with the correlation penalty reaching the full balance when about 1/3 of all stake is slashed in the same window.