SSV Network (SSV): distributed validators for Ethereum staking, steered by a 5-of-9 multisig with no timelock

SSV Network token holders have until 19:10 UTC on 11 November 2026 to decide how much SSV Labs, the company that writes most of the protocol’s code, gets paid until mid-2027. The proposal, DIP-59, asks for 1.5 million USDC for 2026 and 2.7 million SSV for 2027, and it says in plain terms that the money covers no new products. At 19:45 UTC on 10 November, with the vote still open, Snapshot showed about 378,800 SSV voting for, 118,971 against and 15,681 abstaining, from 32 addresses.

The vote lands on a protocol that carries a lot of Ethereum. DefiLlama counted 5.29 million ETH, worth about $10.91 billion, on validators registered with the SSV Network contract in its reading timestamped 14:28 UTC on 10 November. Over the 30 days to the same date, the fees it records came to $286,134. This page explains how SSV Network works, what the SSV token and its staked form cSSV give holders, who can change the contracts, what the audits found, and where the risks sit, with every figure dated.

What is SSV Network? Ethereum validators run by several operators at once

An Ethereum validator is a single BLS signing key with 32 ETH or more behind it. In a classic setup the key lives on one server. If that machine goes down, the validator misses its duties and loses rewards; if the key is copied and runs twice, the validator can be slashed. SSV Network attacks the first problem with distributed validator technology (DVT): the key is cut into shares, each share goes to a different node operator, and the operators sign together.

SSV stands for Secret Shared Validator, the cryptographic method the network is named after. The project started at Blox, a staking company, and its contracts and node software are now maintained by SSV Labs. SSV Network describes itself as a decentralized, open-source staking network: anyone can register as an operator and set a fee, and anyone with a validator key can pick operators, split the key and register the validator on chain. The staker keeps control of the key and can store the original offline once the shares are distributed.

The protocol issues no liquid staking token of its own. It sits one layer down: staking providers and liquid staking protocols run their validators on it. Its homepage lists Lido, ether.fi, Kraken’s institutional staking arm, P2P.org, Kiln, Stader, Renzo, A41 and Stakin among the partners. Readers holding stETH or eETH may therefore already rely on SSV clusters without having chosen them.

How SSV distributed validator technology works: shares, clusters and a 3-of-4 threshold

A group of operators that runs validators together is called a cluster. The usual size is four, and the signing threshold is three: Quantstamp’s 2026 audit describes a four-operator cluster as running with a “3-of-4 threshold”. Each operator runs the SSV node software next to its own Ethereum clients. When a duty arrives, such as an attestation or a block proposal, the nodes agree on what to sign through a consensus round, each signs with its share, and the partial signatures are combined into one valid validator signature. The full key is never rebuilt on any single machine.

The gain is resilience. One of the four operators can go offline, upgrade its clients or suffer a hardware failure while the validator keeps attesting. Operators also choose their own execution and consensus clients, so a bug in one client is less likely to take the whole validator down. Larger clusters exist and tolerate more failures, at the cost of more operator fees.

The limits are just as concrete. A 3-of-4 cluster survives one missing operator, not two. Quantstamp flagged in its v2.0.0 report that when an operator leaves the protocol, the cluster owner cannot simply swap in a replacement: the only way out is to remove the validators and register them again with a new set of operators. The finding was acknowledged by SSV, not fixed. And DVT does nothing against a key that runs in two places at once, as an incident in September 2025 showed (see below).

Since the Pectra upgrade, an Ethereum validator can hold up to 2,048 ETH of effective balance instead of 32 ETH. That changes the economics for SSV: one key can now carry the stake of 64 old validators. Our news piece on Lido’s move to 2,048 ETH validators shows how quickly large operators are consolidating. A larger key raises the cost of every minute of downtime, which is the case DVT providers make for spreading such keys over several machines.

Fees moved from SSV to ETH in April 2026

Until 2026, everything on SSV Network was paid in the SSV token. Each cluster kept an SSV balance in the contract, and fees ran down that balance block by block: an operator fee per validator to each operator, plus a network fee set by the DAO. A cluster whose balance ran too low could be liquidated by anyone, which removes its validators from the network.

The v2.0.0 upgrade, approved by the DAO as DIP-50 in a Snapshot vote that closed on 20 March 2026 with no votes against, rebuilt that model. Fees are now paid in ETH, and they are charged on each validator’s effective balance rather than per key, so a 2,048 ETH validator pays more than a 32 ETH one. When the DAO discussed the design, the ETH network fee was set at 0.00928 ETH per validator per year, about 0.5% of staking rewards, and operators charged by default about 0.5% each, roughly 2% for a four-operator cluster, according to a technical analysis on the SSV forum. The DAO publishes later adjustments on its forum; the SSV-denominated fee has stayed at about 6.33 SSV a year per validator through 2026.

Older clusters can keep paying in SSV for now, but their incentives ended on 30 June 2026, and the staking app offers a “Switch to ETH” migration. Rewards from the Incentivized Mainnet Program that were never claimed can be collected until 2 January 2027, after which they return to the DAO treasury. Fees from clusters still paying in SSV do not feed the ETH reward pool described below.

$10.9 billion on the contract, about $286,000 of fees in 30 days

The DefiLlama figure needs care. Its methodology adds up the beacon chain balances of all validators registered on the SSV contract. That is ETH staked through SSV operators, not ETH deposited into an SSV smart contract that could be withdrawn or stolen from it. The number moves with the ether price and with validators joining or leaving.

DefiLlama reading	Value	Date
ETH on SSV validators	5,292,965 ETH	10 November 2026, 14:28 UTC
Dollar value	$10.91 billion	10 November 2026, 14:28 UTC
Dollar value a week earlier	$11.77 billion	3 November 2026
Peak of the series	$17.83 billion	18 April 2026
Fees, last 30 days	$286,134	to 10 November 2026
Revenue (network fees), last 30 days	$277,143	to 10 November 2026
Fees since tracking began	$6.02 million	to 10 November 2026

The project’s homepage gives larger numbers: more than 7 million ETH staked, more than 120,000 validators and more than 1,800 operators, with a dollar total quoted as both “$15B+” and “$16B+” on the same page on 10 November. Those are the project’s claims. DefiLlama’s count is the independent one and is lower.

Fees are small next to the stake because they are a slice of rewards, not of principal. DefiLlama splits its fee total into network fees, which it books as revenue and which now go to cSSV stakers, and operator fees. On its count for the 30 days to 10 November, network fees came to $277,143, about 97% of the total, and operator fees to $8,991, about 3%.

SSV Staking and cSSV: what SSV token holders get

Token staking went live on mainnet at the end of April 2026, under the name SSV Staking. A holder stakes SSV and receives cSSV one for one. cSSV is a transferable ERC-20 token; it earns a pro-rata share of the ETH network fees, which can be claimed at any time without unstaking, and it keeps the holder’s voting power. Unstaking took seven days in the design discussed on the forum. To start the system, SSV ran a “Genesis Boost” from 29 April to 29 May 2026: up to 50% extra rewards paid in SSV from a $75,000 pool, with a 50 SSV minimum and a 90-day lock after the boost, according to the launch post. Uses of cSSV as collateral or in vaults were described as planned, not live.

The homepage advertises a staking APR of “20%+”. That rate depends on the ETH fees collected, on the amount of SSV staked and on the token’s price, so it can change quickly; it is not a promised yield. An earlier budget decision, DIP-41, provided for burning half of the network fee until the end of 2026; DIP-52, approved on 2 May 2026, stopped that burn. Holders now get ETH payouts and governance rights rather than a shrinking supply.

Four oracles decide effective balances

Charging fees on effective balance requires someone to report those balances from the beacon chain to the contract. SSV uses a permissioned set of four Effective Balance Oracles, named in the genesis post as Kraken, InfStones, Ethernodes and SSV Labs. Three of the four must agree: each commits a Merkle root of cluster balances, and once a root is accepted anyone can submit a proof against it to update a cluster. Staked SSV is delegated to the oracles, split evenly across them at first, and the DAO can replace an oracle.

This is a trust point. If the oracles stall, balances go stale; until a cluster is updated, its validators count as 32 ETH, so consolidated validators underpay. Quantstamp found a high-severity bug in the oracle vote, where the live cSSV supply used to weigh votes could be manipulated to block or force a quorum; it was fixed before launch. The forum analysis also notes that pay for oracles beyond the first phase was not yet defined.

Who controls SSV Network: SSV Labs, the DAO and a 5-of-9 multisig

Three bodies matter. SSV Labs builds the software; Alon Muroch, quoted by CoinDesk in 2022 as a core contributor and since then as CEO of SSV Labs, is its public face. The ssv.network DAO votes with SSV tokens on Snapshot. And the SSV Foundation, a Cayman Islands foundation set up under DIP-13 in 2023 with a professional director, handles legal and treasury tasks; it also has a subsidiary in the British Virgin Islands.

On chain, control is simpler. On 10 November 2026 the owner of the main SSVNetwork contract was a Safe multisig with nine signers and a threshold of five, the same address that owns the SSV token contract. No timelock contract sits between that Safe and the protocol, and on that day the Safe had no module or guard enabled. Quantstamp’s report states that the owner of SSVNetwork is “the DAO multisig”. Snapshot votes are not executed automatically: the multisig committee created under DIP-2 carries them out, and a majority of its members may act alone in a declared emergency, with an obligation to publish what they did.

The 6 May 2026 emergency fix

That power was used weeks after the v2.0.0 launch. According to the multisig’s own publication of 7 May, a bug left the effective-balance snapshot of an SSV-paying cluster in place after all its validators had been removed. A user could then migrate that cluster to ETH and add phantom balance to the accounting. The committee replaced two contract modules through a prepared Safe transaction on 6 May and described the move as preventive, saying no evidence of exploitation had been found. The bug was outside what the audit had caught.

The episode cuts both ways. The fix was fast and documented. It also shows that five signers can change the logic of a contract holding the registration of billions of dollars of validators, with no delay that would let users react. The nine signer addresses are public on chain; the committee’s membership is set by DAO votes, and one member resigned in December 2025.

SSV token supply: about 17.4 million on chain, and the DAO can mint more

The token is an ERC-20 on Ethereum at 0x9d65ff81a3c488d585bbfb0bfe3c7707c7917f54. Calling its totalSupply function on 10 November 2026 returned about 17,361,674 SSV. CoinGecko listed about 14.7 million as circulating on the same day and shows no maximum supply. The difference is not explained on either page; part of the supply sits with the DAO.

The supply has grown. In June 2022 a core contributor wrote on the SSV forum that total supply was 10,978,232 SSV, including the token sale. Today’s on-chain figure is about 58% higher, after DAO-approved mints that funded mostly the Incentivized Mainnet Program and operations. A proposal to cap supply at 13 million in April 2025 never reached a vote result.

Minting is still possible. The token’s owner is the 5-of-9 Safe. DIP-52, approved on Snapshot on 2 May 2026 with 455,498 SSV for and none against, stopped what it calls “Market Minting” but lets the Foundation ask the multisig for new SSV worth up to $2 million a year, with a ceiling of 1,000,000 SSV a year. The same policy invests the DAO’s stable assets in Aave USDC lending and tokenised treasuries and keeps ETH as a strategic reserve.

No full allocation table for SSV has been published by the project, and there is no public figure for the team’s share. Known pieces are partial: about one million tokens sold in 2022 with a one-year cliff and two years of linear vesting, and a DAO programme that sells up to 3 million SSV to strategic partners with a cliff and vesting. The DAO also pays market makers; a proposal of 4 November 2026 adds a second one.

Audits: five Quantstamp reports and 21 findings on v2.0.0

The audit reports sit in the contracts repository on GitHub. All five are by Quantstamp: v1.0.0-rc3 (24 March 2023), v1.0.2 (30 October 2023), v1.1.0 (15 February 2024), v1.2.0 (4 July 2024) and v2.0.0 (10 April 2026). An Immunefi bug bounty runs alongside them and was kept when the grants programme stopped.

The v2.0.0 report covers the ETH payments, effective-balance accounting and SSV Staking, reviewed from 16 to 26 February 2026 by three Quantstamp engineers. It lists 21 findings: two high (both fixed), seven medium (four fixed, two acknowledged, one mitigated), ten low and two informational. Acknowledged items include the cluster fault-tolerance issue above, a way to register the same validator key under two owners that exposes it to slashing, and a warning that operator onboarding may increase centralisation. Quantstamp notes that older findings from the SSV-only contracts were mostly acknowledged rather than fixed, because SSV did not see them as a significant threat, and that they still apply. It also credits the team with adding 992 tests during the review.

Slashings in September 2025: an operator mistake, not a protocol fault

On 10 September 2025, 40 validators connected to SSV were slashed in two events, at 11:51 and 13:17 UTC. According to SSV’s post-mortem, 39 belonged to a single cluster owned by Ankr, which confirmed that during internal maintenance a validator instance had run in parallel outside SSV, so the same keys signed from two places. The other case was a single validator that double-signed; SSV said it found only one attestation from its own infrastructure. SSV said the protocol was not compromised and repeated its advice: one instance per key and slashing protection always on.

The lesson applies to every DVT design. Splitting a key protects against a machine failing. It does not protect against an operator copying a full key elsewhere. Our guide to Ethereum slashing and validator rewards explains why a double signature is punished so hard.

A fee change that liquidated clusters in November 2024

An earlier episode came from the protocol’s own parameters. On 19 November 2024 an increase in the network fee, then paid in SSV, left some clusters short of balance, and they were liquidated. A DAO proposal to repay the full liquidated collateral in SSV to eligible clusters, those reactivated within seven days, closed on 26 December 2024 with 244,633 SSV for and none against. It said the parameters had worked as intended and blamed insufficient notice of the fee change. The staked ETH itself was not lost; the cost fell on the SSV balances and on the downtime.

A DAO under budget pressure: grants paused and the DIP-59 vote

On 15 August 2026 the DAO’s Grants Committee suspended the grants programme indefinitely; grants already approved continue. No regular grants are planned for 2026 or later unless the committee or the DAO decides otherwise, and committee members moved to a flat $250 a month in SSV. The post gave no reason and said the DAO would revisit the decision “when conditions allow”.

DIP-59 follows that line. Posted on 21 October 2026 by SSV Labs, it extends the funding agreement known as DIP-31 so that it runs from 1 January 2025 to 30 June 2027. It asks for 1,500,000 USDC for 2026, paid in the first scheduled batch of January 2027, and 2,700,000 SSV for 2027, paid from the first batch of July 2027. SSV Labs may take 900,000 USDC instead of 1,700,000 of those SSV; if it does not, that part arrives in six monthly instalments from July 2027. The proposal also restructures the unpaid third DIP-31 instalment of 1,736,111.11 SSV and gives SSV Labs a first-ranking security interest over $900,000 held by the SSV Foundation in its indemnity funds. The work covered is maintenance, monitoring, staking migration operations, checkpoint sync and readiness for two forks: Boole, an upgrade of the SSV protocol that every operator must install, and Glamsterdam, the next Ethereum upgrade. There is no marketing budget and no new product.

That last point matters for Compose, a project SSV Labs presented in October 2025 to use the SSV validator set for synchronous composability between rollups. Compose had no token design and no date, and DIP-59 does not fund it. On 9 November one forum participant said they were voting against until a table showed which payment covers which period. The 118,971 SSV voting against at 19:45 UTC on 10 November is the largest no vote on any ssv.network DAO Snapshot proposal since December 2024; earlier votes drew at most 5,512 SSV against. Votes for were above the proposal’s quorum of about 303,800 SSV, but the vote stays open until 19:10 UTC on 11 November and the result is only final at the close.

SSV Network vs Obol and the staking protocols that use it

Obol is the other large DVT provider on Ethereum, and Coindaro’s Obol page covers it in detail. On DefiLlama on 10 November 2026, SSV carried about $10.9 billion and Obol about $1.2 billion. Over the previous seven days DefiLlama showed SSV down about 8% and Obol up about 3%, while most large staking protocols lost value in dollars.

The designs differ. Obol’s Charon client works as middleware between each operator’s existing clients, and clusters are formed by operators who agree to run a distributed key generation together; there is no on-chain fee market. SSV is an on-chain registry: operators list themselves with a fee, stakers pick them, and the contract handles payments, liquidations and staking rewards. That gives SSV a market and a token that collects ETH fees. It also gives it more contract surface, a set of oracles and a multisig with the power to change the code, none of which a staker using Obol’s software depends on in the same way.

Both are used by Lido, which runs part of its validators on DVT clusters from either provider, and by ether.fi. For an individual, the realistic choice is rarely SSV directly. It is a staking provider or liquid staking protocol that may or may not use SSV underneath, which is worth asking about.

Why Coindaro rates SSV Network risk 3 out of 5

In favour: the network has run on mainnet for years, holds more DVT stake than anyone else by a wide margin, is audited release after release by the same firm, publishes its emergency actions, and no loss of staked ETH from a protocol fault has been reported. The 2026 move to ETH fees gave SSV holders a direct, if small, claim on network income.

Against: five of nine signers can upgrade the contracts without delay; four permissioned oracles feed the fee accounting; the token supply has grown about 58% since 2022 and can still grow; the DAO has paused grants and depends on one company for development; a post-audit bug needed an emergency fix in May 2026; a fee change liquidated clusters in November 2024; and several audit findings are acknowledged rather than fixed. The middle score reflects working, widely used infrastructure with governance and token risks that holders carry more than stakers.

Dates to watch

The DIP-59 vote closes at 19:10 UTC on 11 November 2026. Unclaimed Incentivized Mainnet Program rewards go back to the treasury after 2 January 2027. Under DIP-59, SSV Labs’ maintenance period runs from 1 January to 30 June 2027 and includes readiness for Glamsterdam, whose mainnet date has not been set; its testnet step on Hoodi was postponed in October.