# Validator signing keys and withdrawal credentials: different powers An Ethereum validator uses a signing key for consensus duties such as votes and block proposals. Withdrawal credentials separately determine withdrawal authority and destination. An attacker with only the signing key can disrupt or slash the validator even when unable to spend withdrawals sent to your address. Protect both forms of authority according to their different roles. Evidence: [Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/); [Staking as a service](https://ethereum.org/en/staking/saas/); [Ethereum staking launchpad FAQ source](https://raw.githubusercontent.com/ethereum/staking-launchpad/dev/src/pages/FAQ/index.jsx) Canonical: https://degreesofsatoshi.com/encyclopedia/ethereum-validator-keys/ Published: 2026-10-02 Substantively modified: 2026-10-02 Independently verified by an automated reviewer: 2026-10-02T19:27:58.939Z Data current through: 2026-10-02 AI-assisted research and drafting with a separate automated source-verification pass; no external expert or named human review is implied. ## Key facts - **Signing:** Validator signing keys authorize proposals and attestations. ([Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/)) - **Credentials:** Withdrawal credentials belong to the validator’s consensus record. ([Ethereum staking launchpad FAQ source](https://raw.githubusercontent.com/ethereum/staking-launchpad/dev/src/pages/FAQ/index.jsx)) - **Online exposure:** Routine validator signing requires online signing capability. ([Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/)) ## Do not treat every staking key as a spending key Validator signatures use the BLS signature scheme designed for consensus participation. They are distinct from the ordinary Ethereum account key controlling an execution address. A public validator identifier is likewise different from a normal payment address. Older validators can have BLS withdrawal credentials that need a transition to an execution address. Modern withdrawal types point to an execution address, so recovery procedures must match the actual credentials. Evidence: [Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/); [Ethereum staking launchpad FAQ source](https://raw.githubusercontent.com/ethereum/staking-launchpad/dev/src/pages/FAQ/index.jsx) ## Signing compromise can hurt without redirecting withdrawals Suppose withdrawals point to an account you control, while an operator holds the validator signing key. If that key is misused to sign conflicting duties, the validator can be slashed. Keeping the withdrawal address does not undo the penalty. The separation still matters: signing authority alone is not the same as the private key that can spend funds already received by your withdrawal account. Evidence: [Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/); [Staking as a service](https://ethereum.org/en/staking/saas/) ## Record which recovery material restores which authority A validator keystore, its unlocking password, a staking mnemonic and an execution-account backup are not interchangeable. Document the setup while it works, including the public validator identifier and withdrawal credentials, without exposing secrets. Before a migration, also preserve signing history through the client’s slashing-protection process. Recovering the key alone does not tell a new client what it already signed. Evidence: [Ethereum staking launchpad FAQ source](https://raw.githubusercontent.com/ethereum/staking-launchpad/dev/src/pages/FAQ/index.jsx); [Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/); [Slashing protection interchange format](https://eips.ethereum.org/EIPS/eip-3076) ## Questions ### Is the validator public key a wallet address for payments? No. It identifies a validator in the consensus system. Execution withdrawals use the address specified by the validator’s withdrawal credentials. Evidence: [Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/); [Ethereum staking launchpad FAQ source](https://raw.githubusercontent.com/ethereum/staking-launchpad/dev/src/pages/FAQ/index.jsx) ### Does a keystore backup include all signing history? Not necessarily. EIP-3076 specifically addresses transferring signing history separately from the key material when changing validator clients. Evidence: [Slashing protection interchange format](https://eips.ethereum.org/EIPS/eip-3076) ## Claims and scope ### ethereum-validator-keys-quick-answer An Ethereum validator uses a signing key for consensus duties such as votes and block proposals. Withdrawal credentials separately determine withdrawal authority and destination. An attacker with only the signing key can disrupt or slash the validator even when unable to spend withdrawals sent to your address. Protect both forms of authority according to their different roles. Scope: {"collection":"ethereum","dataAsOf":"2026-10-02","blockHeight":null} ### ethereum-validator-keys-fact-signing Signing: Validator signing keys authorize proposals and attestations. Scope: {"collection":"ethereum","dataAsOf":"2026-10-02","blockHeight":null} ### ethereum-validator-keys-fact-credentials Credentials: Withdrawal credentials belong to the validator’s consensus record. Scope: {"collection":"ethereum","dataAsOf":"2026-10-02","blockHeight":null} ### ethereum-validator-keys-fact-online-exposure Online exposure: Routine validator signing requires online signing capability. Scope: {"collection":"ethereum","dataAsOf":"2026-10-02","blockHeight":null} ## Sources - [Ethereum proof-of-stake keys](https://ethereum.org/en/developers/docs/consensus-mechanisms/pos/keys/) — ethereum.org contributors. Online validator signing versus separate withdrawal authority and credentials. Locator: Validator key; withdrawal key. Retrieved: 2026-10-02T18:55:26.064Z. - [Staking as a service](https://ethereum.org/en/staking/saas/) — ethereum.org contributors. Outsourced validator operation and withdrawal-key control need separate assessment. Locator: How it works; keys; counterparty risk. Retrieved: 2026-10-02T18:55:26.034Z. - [Ethereum staking launchpad FAQ source](https://raw.githubusercontent.com/ethereum/staking-launchpad/dev/src/pages/FAQ/index.jsx) — Ethereum Foundation. Staking lifecycle, qualifying balances, network duties and deposit-data handling. Locator: Validators; deposits; activation; rewards; key management. Retrieved: 2026-10-02T18:58:48.434Z. - [Slashing protection interchange format](https://eips.ethereum.org/EIPS/eip-3076) — Ethereum Improvement Proposals. Signing-history transfer between validator clients does not authorize concurrent independent copies. Locator: Interchange format; import and export; safety. Retrieved: 2026-10-02T18:55:26.323Z. ## Revision history - 2026-10-02: First publication after primary-source research and separate automated verification. ## Cite this entry Degrees of Satoshi editorial project. “Validator signing keys and withdrawal credentials: different powers.” Published 2026-10-02; updated 2026-10-02. https://degreesofsatoshi.com/encyclopedia/ethereum-validator-keys/