At 06:42:59 UTC on 15 September 2022, Ethereum produced block 15,537,394, its first block under proof of stake, and nobody had mined it. It sat inside slot 4,700,013 of the beacon chain, a separate chain that had been running since December 2020, and it was proposed by a validator chosen at random among the people who had locked ether in a deposit contract. The blockchain and earns a reward, which makes rewriting history very expensive.">proof-of-work chain did not fork away or shut down with a bang. It simply stopped asking for hashes. Balances, contracts and the whole transaction history carried on as before. This switch, known as the Merge, is the best place to see how the mechanism works in practice.
The change in energy was the headline. Ethereum.org says the Merge cut the network’s energy consumption by an estimated 99.95%. The change in machinery behind proof of stake was larger and got less attention. Under proof of work, anyone with hardware can try to find a block, and the chain with the most work wins. Under the new rules, the right to write the next block is handed out by the protocol itself, by lot, to holders of a deposit that the protocol can confiscate.
On 8 November 2026, at 09:45 UTC, a public beacon node queried by Coindaro counted 814,254 active validators holding 44,379,790 ETH of effective stake between them. Every 12 seconds one of them is asked to build the next block of Ethereum and tens of thousands of others are asked to vote on it. Who does the asking? How does a public chain draw lots that nobody can rig? And what stops a rich participant from cheating?
If you come from the previous lesson, how hashrate is estimated and how difficulty adjusts, keep its central idea in mind: in Bitcoin, security is bought with electricity spent on hashes, and the difficulty target keeps blocks at about ten minutes whatever the hashrate. Our guide to proof of work in depth covers the target, nBits and the retarget rule. Ethereum’s design has none of that. There is no difficulty to adjust, because blocks are not found: they are scheduled. Where proof-of-work security rests on the cost of hardware and power, proof-of-stake security rests on the value of the deposits that can be destroyed. Our introduction to blockchain consensus and its families places both in the wider map.
From coin age to the Merge: a short history of the idea
Peercoin, which went live in August 2012, is usually cited as the first cryptocurrency to put proof of stake into service. Its paper, dated 19 August 2012, is credited to Sunny King, a pseudonym, and Scott Nadal. It used “coin age” (coins held multiplied by the time they had been held) to give owners a chance to mint blocks, while proof of work still handled the early distribution of coins. It was a hybrid, and it showed the idea could run.
The hard questions came next. In a blog post of 25 November 2014, Vitalik Buterin set out the two problems that every later design had to answer. The first is now called nothing at stake: since signing a block costs nothing, a validator facing two competing forks has every reason to back both. In his words, “if there are multiple forks, the optimal strategy is to vote on all forks at once”. The second is the long-range problem, which led him to accept what he called weak subjectivity: new nodes would need some recent trusted reference, and the rule would be that nodes refuse to revert history beyond a certain depth.
Three years later, Buterin and Virgil Griffith published Casper the Friendly Finality Gadget (arXiv, first version 25 October 2017), a voting layer meant to sit on top of a block-producing chain and make its checkpoints final. On the academic side, Aggelos Kiayias, Alexander Russell, Bernardo David and Roman Oliynykov had described Ouroboros, which they presented as “the first blockchain protocol based on proof of stake with rigorous security guarantees”; it became the basis of Cardano.
Ethereum then moved in steps. The beacon chain started on 1 December 2020 at 12:00:23 UTC, once enough deposits had arrived: the specification required at least 16,384 validators, or 524,288 ETH, at genesis. For 21 months it ran alongside the proof-of-work chain, reaching consensus on nothing but itself. The Merge joined the two. Each fork since then has changed something in a validator’s working life.
| Upgrade | Date | What it changed for validators |
|---|---|---|
| Beacon chain genesis | 1 December 2020 | proof-of-stake chain starts, deposits locked with no way out |
| Altair | 27 October 2021 | sync committees for light clients, new reward accounting |
| Bellatrix | 6 September 2022 | prepares the beacon chain for the Merge |
| The Merge (Paris) | 15 September 2022 | proof of stake produces Ethereum’s blocks |
| Shapella (Capella) | 12 April 2023 | withdrawals of rewards and exits become possible |
| Deneb | 13 March 2024 | blob data for rollups (Dencun) |
| Pectra (Electra) | 7 May 2025 | balances up to 2,048 ETH per validator, exits from the execution layer |
| Fulu (Fusaka) | 3 December 2025 | data availability sampling for blobs |
The dates come from the fork epochs of the consensus specifications, converted from the beacon chain’s genesis time. The next fork, Glamsterdam, has run on the Sepolia testnet since 6 October 2026, but as of 8 November 2026 the mainnet configuration still leaves its epoch unset, so there is no date for it.
Becoming a validator: 32 ETH, three programs, two keys
A validator is not a person or a machine. It is an entry in the beacon chain’s registry, created by a deposit of at least 32 ETH to the deposit contract, and it is identified by a public key. One person can run hundreds of validators on one server; one validator can belong to a smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool of thousands of people. To perform its duties, a validator needs three pieces of software, according to ethereum.org: an execution client that runs transactions, a consensus client that follows the beacon chain, and a validator client that holds the signing key and signs on time.
What 32 ETH buys, and what Pectra changed
For four and a half years, 32 ETH was both the entry ticket and the ceiling. A validator’s “effective balance”, the rounded figure in whole ether that the protocol uses to weigh its votes and size its rewards, could never exceed 32. Anyone staking 3,200 ETH had to run 100 validators, which bloated the registry and the number of signatures the network had to carry.
The Pectra upgrade of 7 May 2025 kept the 32 ETH minimum but raised the ceiling to 2,048 ETH through EIP-7251, as ethereum.org’s Pectra page explains. The switch is in the withdrawal credentials. A validator with type 0x01 credentials keeps the old 32 ETH cap, and anything above it is swept to its withdrawal address automatically. A validator with type 0x02 credentials, called compounding, keeps its rewards inside the stake, up to 2,048 ETH, so they earn rewards in turn. Existing validators can merge into one through a consolidation request.
Adoption is real but still partial. On 8 November 2026 at 09:45 UTC, 24,498 of the 814,254 active validators had 0x02 credentials, and 16,623 held more than 32 ETH of effective balance, by Coindaro’s count on a public beacon node. Large operators are moving: Lido opened a module for 2,048 ETH validators in late October, as Coindaro reported on 26 October. Pectra also added EIP-7002, which lets the withdrawal address trigger an exit from the execution layer, and EIP-6110, which delivers deposits to the beacon chain through the execution layer’s own blocks.
The keys: one that signs, one that owns
Every validator lives with two kinds of authority. The validator key signs blocks and votes, so it must sit online on the server, which makes it the exposed one. The withdrawal credentials decide where the money goes when it leaves; since 0x01 and 0x02 they point to an ordinary Ethereum address, which can stay in cold storage. That split is what makes staking services possible: an operator can hold your signing key and run the machine while the money can only ever be paid to your address, as ethereum.org’s withdrawals page describes. It also limits what a stolen signing key can do. A thief can get the validator slashed, but not redirect its funds.
The life of a validator: deposit, queue, duty, exit
The deposit contract and the entry queue
A deposit does not make a validator active at once. Since Pectra, the protocol admits new stake by amount: at most 256 ETH may enter per epoch, and at most 256 ETH may leave. An epoch lasts 6.4 minutes and there are 225 of them a day, so at full speed about 57,600 ETH can join the validator set each day, and the same amount can leave. Before Pectra the limit was counted in validators: at least four per epoch, and since the Deneb upgrade of March 2024 no more than eight new ones per epoch. The cap is deliberate. A validator set that changes slowly is harder to take over in a hurry, and it keeps the checkpoints that new nodes start from trustworthy for longer.
When more ether arrives than the gate lets through, a queue forms. On the morning of 8 November 2026, validatorqueue.com showed about 944,812 ETH waiting to enter, for an estimated wait of 16 days and 21 hours, and 36.37% of the ether supply staked. The queue was longer a few weeks earlier: on 19 October Coindaro reported about 1.2 million ETH in line and a 21-day wait. The exit side looked almost empty. About 8,700 ETH was waiting to leave, all of it partial withdrawals rather than full exits, for a wait of about a day.
Duty and effective balance
Once active, a validator has one standing job and a few occasional ones. The standing job is to attest once per epoch, a vote on the head of the chain and on the epoch’s checkpoints. Now and then it is chosen to propose a block, and from time to time it sits on the sync committee for about 27 hours. Its weight in all this is its effective balance, which moves in whole-ether steps and lags slightly behind the real balance, so that small daily rewards do not make it jitter. If penalties ever drag the effective balance down to 16 ETH, the protocol ejects the validator from the active set.
Leaving: exit queue, delay, withdrawals
Exiting is the reverse trip with one more wait. A validator signs a voluntary exit (or, since Pectra, its withdrawal address requests one), joins the exit queue, stops its duties when its turn comes, and then waits a further 256 epochs, about 27.3 hours, before its balance can be withdrawn. That delay gives the network time to catch any offence committed just before leaving.
Withdrawals themselves arrived only with the Shapella upgrade of 12 April 2023. Before that date, staked ether could not leave the beacon chain at all, which was a real risk taken by everyone who deposited from December 2020 onwards. Withdrawals are not requested and processed one by one: proposers sweep through the registry in order, and each block can carry up to 16 of them, so up to 115,200 a day by ethereum.org’s count. A 0x01 validator receives its excess over 32 ETH this way, at regular intervals, without doing anything.
| Stage | Rule | Figure | Source |
|---|---|---|---|
| Minimum deposit | activation balance | 32 ETH | consensus specs |
| Maximum effective balance | 0x01 / 0x02 credentials | 32 ETH / 2,048 ETH | EIP-7251, Pectra, 7 May 2025 |
| Entry and exit limits | churn per epoch, each way | 256 ETH (about 57,600 ETH a day) | consensus specs |
| Entry queue | ether waiting to activate | about 944,812 ETH, about 16 days 21 hours | validatorqueue.com, morning of 8 Nov 2026 |
| Exit queue | ether waiting to leave | about 8,700 ETH, about 1 day | validatorqueue.com, morning of 8 Nov 2026 |
| Withdrawability delay | after the exit epoch | 256 epochs, about 27.3 hours | consensus specs |
| Ejection balance | forced exit below | 16 ETH | consensus specs |
| Withdrawals per block | automatic sweep | 16 (up to 115,200 a day) | ethereum.org |
How proof of stake works on Ethereum, one slot at a time
Time on the beacon chain is cut into 12-second slots, grouped into epochs of 32 slots. Each slot has one proposer, which may produce a block or miss it, and every active validator is assigned to exactly one slot per epoch in which to attest. Nothing in this schedule depends on computing power: a validator on a small home machine has the same chance per ether as one in a data centre.
Choosing the proposer: RANDAO and weighted sampling
A public blockchain cannot ask an outside server for a random number. Ethereum builds its own randomness with RANDAO. Each block proposer must include a “reveal”, its signature over the current epoch number, which nobody else can predict and which the proposer cannot choose freely. The protocol hashes that reveal and mixes it into a running value with an XOR. Every block adds a contribution, so the mix depends on hundreds of independent signatures.
From this mix the protocol draws candidates and accepts each one with a probability proportional to its effective balance, a rule that the Electra specification expresses against the 2,048 ETH maximum. A validator with 2,048 ETH is therefore 64 times as likely to propose as one with 32 ETH, exactly as if it were 64 separate validators.
Committees and attestations
Attestations are where most of the security work happens. The protocol shuffles the active validators each epoch, splits them over the 32 slots and then into committees, up to 64 per slot. With 814,254 active validators on 8 November 2026, that is about 25,445 attesters per slot, so the 64-committee ceiling is reached and each committee holds about 398 validators, by Coindaro’s arithmetic. Random committees mean no attacker can arrange to sit together in one place.
Each attestation carries three votes at once: which block is the head of the chain, which checkpoint is the source and which is the target for finality. Signatures within a committee are aggregated into a single BLS signature, so tens of thousands of votes per slot fit into a handful of aggregates in the next block. A separate sync committee of 512 validators, renewed about every 27 hours, signs every block header so that light clients, such as wallets on phones, can follow the chain without downloading it.
LMD-GHOST: what to do when two blocks compete
Sometimes two blocks appear for nearby slots, because a proposer was late or the network split for a moment. Each node then applies a fork-choice rule called LMD-GHOST, for “latest message driven, greedy heaviest observed subtree”. Starting from the last finalized checkpoint, it walks down the tree of blocks and, at each fork, follows the branch backed by the most stake, counting only the latest attestation of each validator. That last point matters: a validator that changes its mind is counted once, not twice.
The rule converges quickly when most validators see the same messages. A block that arrives on time and gathers the attestations of its slot is very unlikely to be dropped; one that arrives after the attestation deadline can be outvoted by the next proposer. Ethereum added a mechanism called proposer boost in 2022 to reduce such games at the head of the chain.
Finality in one page, and what reverting it would cost
Our lesson on finality and reorgs covers Gasper in detail: LMD-GHOST picks the head, Casper FFG finalizes checkpoints, a checkpoint is justified when validators holding two thirds of the stake vote for it and finalized when the next one is justified too, which takes at least two epochs or 12.8 minutes. It also tells the story of the May 2023 loss of finality and the inactivity leak that drains validators who stop voting after four epochs without finality. A live read on 8 November 2026 at 09:45 UTC showed the usual pattern, with the finalized epoch, 487,776, two epochs behind the head.
What matters for this lesson is the price tag. Two conflicting checkpoints can only both be finalized if at least a third of the stake has signed contradictory votes, and such votes are self-incriminating: anyone can submit them, and the protocol slashes every validator involved. With 44.4 million ETH staked, a third is about 14.8 million ETH. Proof of work has no equivalent of that sentence: a miner who builds a competing chain loses only the electricity, and the hardware remains for the next attempt.
Rewards and slashing in short
Validators are paid in newly issued ether for doing their duties on time, and lose a little for missing them. The reward unit shrinks as the total stake grows, in proportion to the inverse of its square root: the more ether is staked, the less each ether earns. Coindaro ran the specification’s formula on the stake of 8 November 2026 (our own calculation, not an official figure): a 32 ETH validator that performs every duty would earn about 0.8 ETH a year from the consensus layer, roughly 2.5%, before priority tips and MEV, which vary from block to block. Across the whole network that comes to about 1.1 million new ETH a year.
Slashing is different from a missed-duty penalty. It punishes only provable cheating: proposing two different blocks for the same slot, or signing two attestations that contradict each other. The validator loses a small slice of its balance at once (Pectra cut that slice sharply), is forced out, and waits about 36 days before it can withdraw. Midway through that wait comes a second charge that grows with the total stake slashed around the same time. A lone mistake costs little; a coordinated attack by a third of the stake costs all of it.
Real cases are rare, and most come from operators running the same key on two machines rather than from attacks. Coindaro counted about 590 slashed validators in the whole history of the beacon chain on the morning of 8 November 2026, against about 2.4 million validator entries created since 2020, and none in the 36-day window then running. The basic vocabulary is in our glossary entry on staking.
Is proof of stake secure? The attacks it had to solve
Nothing at stake
Buterin’s 2014 objection was simple. A proof-of-work miner who splits its hashrate between two forks halves its chance on each, so it picks one. A proof-of-stake validator that signs on both forks loses nothing, so in a naive design it should sign everything, and forks would never resolve. Ethereum answers in two ways. Slashing turns double signing into an expensive mistake, and the fork-choice rule counts only the latest vote of each validator, so spreading votes adds nothing. The lazy strategy is no longer free.
Long-range attacks and weak subjectivity
The long-range attack is subtler. Take validators who staked years ago and have since withdrawn. Their old keys still sign valid messages for the old part of the chain, and they have nothing left to lose. In principle they could build an alternative history starting from a point far in the past and present it to a node that has been offline the whole time. In proof of work, that node would compare cumulative work and reject the forgery. Here, a fresh signature costs nothing, so the comparison does not settle it.
The answer is to refuse the comparison. As ethereum.org’s page on attacks puts it, “Ethereum clients simply will not reorg finalized blocks”. A node that is online never accepts a history that conflicts with what it has already seen finalized. A node that is new, or that has been offline too long, must start from a recent finalized checkpoint obtained from a source it trusts, a procedure called checkpoint sync. That is weak subjectivity: objective rules from the checkpoint on, but a small social input to pick the checkpoint.
How long is “too long”? The weak subjectivity period depends on how fast the validator set can change, hence on the churn limit. Since Pectra the formula in the consensus specifications gives 3,532 epochs for any stake above about 8.4 million ETH, which covers today’s 44.4 million: a little under 16 days. Ethereum.org admits the trade-off, saying that trusting the provider of a checkpoint can be considered as problematic as trusting the client developers, and it notes that the risk is spread over several independent client teams. Most users never notice, because their wallet relies on a node or a provider that keeps up to date.
What an attacker would need: the thresholds
The stake an attacker controls decides what it can do. The figures below come from ethereum.org’s attack-and-defense page; the share of 44.4 million ETH is Coindaro’s arithmetic for 8 November 2026.
| Share of stake | About (ETH) | What the attacker could do | What it costs or triggers |
|---|---|---|---|
| 33% | 14.6 million | stop finality by refusing to vote | the inactivity leak drains the non-voting stake until finality resumes |
| 34% | 15.1 million | cause two conflicting finalized chains, with network timing on its side | its entire stake destroyed by slashing; off-chain coordination to pick one fork |
| About 50% | 22.2 million | keep two forks alive by voting against the honest side | if both forks end up finalized, ethereum.org says only social recovery is left |
| 66% and above | 29.3 million | finalize its preferred chain, censor, revert history | only the value of the stake and a social-layer response remain |
The last line of defence is what ethereum.org calls the social layer. If an attacker ever finalized a dishonest chain, node operators, client teams, exchanges and users could agree to run software that follows an honest minority fork and treats the attacker’s validators as burned or forcibly exited. The attacker would then have to re-enter through the queue. This has never been needed on Ethereum mainnet, and it would be a major governance crisis; the page itself presents it as a fallback, not a routine tool.
Who actually stakes: solo stakers, pools, exchanges and Lido
The validator set is anonymous on paper but concentrated in practice. A large share of the stake is run by exchanges and by liquid staking protocols, which pool deposits and hand users a token in return. Our lesson on liquid staking tokens such as stETH and rETH covers how those tokens work and what can go wrong with them.
Lido remains the largest. DefiLlama showed about 9.72 million ETH held by Lido on Ethereum at 08:37 UTC on 8 November 2026, about 22% of the effective stake counted that morning (the protocol’s figure includes ether still buffered before deposit). Lido spreads that stake over many node operators, and its 0x02 module is meant to let it run fewer, larger validators. The concern raised for years is a different one: any single protocol or exchange approaching a third of the stake would come close to the threshold at which it could block finality.
Solo stakers, people running their own 32 ETH validator at home, are a minority by stake, but they matter because they cannot be pressured as a group. Pectra changed their arithmetic: a compounding validator no longer needs to wait for another full 32 ETH to put rewards to work.
The energy claim, checked
Two estimates are usually quoted. Ethereum.org gives a drop of about 99.95%. A report by the Crypto Carbon Ratings Institute, published in September 2022 and commissioned by ConsenSys, an Ethereum software company, went further: electricity use down by more than 99.988% and the carbon footprint by more than 99.992%. Its tables put the proof-of-work network at about 22.9 million MWh a year in August 2022 and the proof-of-stake network at about 2,601 MWh a year afterwards.
Both are estimates, and they measure the same thing: the electricity of the machines that keep the network running. They do not count the energy used by applications, exchanges or the people who use them. The reason the cut is so large is mechanical. A validator signs a few messages per epoch on ordinary hardware, while a miner has to try trillions of hashes for every chance at a block. How Bitcoin’s energy use is measured, and the debate around it, is the subject of a separate lesson.
Other proof-of-stake designs in one table
Ethereum’s design is not the only one. Cardano uses Ouroboros, the family of protocols that came out of the 2016 paper above. Tezos calls its version liquid proof of stake: bakers produce blocks, and holders can delegate baking rights while, according to the Tezos documentation, delegated funds stay liquid and unlocked; a baker needs at least 6,000 tez of baking power. Delegated proof of stake, in which holders elect a small set of block producers, and the broader comparison with other consensus families each have their own lesson later in this path.
| Chain | Protocol | Who produces blocks | How holders take part |
|---|---|---|---|
| Ethereum | Gasper (LMD-GHOST plus Casper FFG) | validators of 32 to 2,048 ETH, picked by RANDAO | run a validator, use a pool, liquid staking or an exchange |
| Cardano | Ouroboros | stake pool operators | delegate to a pool |
| Tezos | liquid proof of stake | bakers with at least 6,000 tez of baking power | delegate, funds stay unlocked |
| Peercoin (2012 design) | hybrid PoW and coin age | holders minting with coin age | hold coins and mint |
What staking rewards mean for your taxes in the US and UK
In the United States, the IRS set out its view in Revenue Ruling 2023-14, published in Internal Revenue Bulletin 2023-33 of 14 August 2023. A cash-method taxpayer who receives validation rewards includes their fair market value in gross income in the tax year in which they gain dominion and control over them, that is, when they can sell or move them. The ruling applies the same rule when the staking goes through an exchange. A later sale of those tokens is a separate event for capital gains. Our guide to crypto taxes in the United States covers reporting.
In the United Kingdom, HMRC’s Cryptoassets Manual at CRYPTO21200 says that when staking is not a trade, the value in pounds sterling of the tokens when they are received is taxable as miscellaneous income, reduced by allowable expenses, and that a later disposal of tokens kept can give rise to Capital Gains Tax. Whether staking amounts to a trade depends on factors such as the degree of activity, organisation, risk and commerciality. None of this is tax advice: rules and their reading change, and a tax adviser can apply them to your case.
The next lesson in this path, on validators, rewards and slashing, takes up the money side: what each duty pays, how penalties are calculated, and the slashing incidents recorded on Ethereum and other chains since 2020.
