This article is more than six months old

Illicit activity in Ethereum staking is low. It’s still enough to spook big finance firms

Illicit activity in Ethereum staking is low. It’s still enough to spook big finance firms
Northstake CEO Jesper Johansen weighs in on illicit activity in Ethereum staking. Credit: Andrés Tapia
  • A new report finds Ethereum liquid staking providers are exposed to illicit funds at a very low level.
  • 'The dark number is probably significantly higher,' Northstake head of compliance Sebastian Heine said.
  • Illicit funds could raise concerns for institutional investors.

DeFi protocols that pool users’ Ether for staking are exposed to funds tied to money laundering, scams, sanctioned addresses and malicious actors, according to a new report by digital asset infrastructure provider Northstake shared with DL News.

While the proportion of dirty to clean funds is small, it may still present challenges for institutional investors bound by stringent regulations.

The report looked at three of the top Ether liquid staking protocols and found each had been exposed to funds tied directly to illicit activities, as well as those connected to high-risk crypto exchanges and gambling sites that don’t require users to pass know-your-customer checks.

Dark number

Sebastian Heine, Northstake’s chief of risk and compliance, said they are likely underestimating exposure.

“The dark number is probably significantly higher,” Heine told DL News, referring to the actual amount of illicit or otherwise questionable crypto found in the staking protocols Northstake analysed.

“Even though we have good tracking tools on blockchain, it still needs human effort, time, and expertise to identify these addresses and clusters which are related to sanctioned transactions,” he said.

Northstake found that total illicit and high-risk exposure was small — between 0.46% and 1.56% across the three protocols the report examined. Still, according to Northstake, this creates a serious dilemma for regulated entities looking to dip their toes in liquid staking protocols.

The report doesn’t identify the liquid staking protocols it analysed. Lido and Rocket Pool, the two largest liquid staking protocols, did not immediately return DL News’ requests for comment.

Join the community to get our latest stories and updates

‘Regulated institutions have a matrix of issues to grapple with to access staking on the Ethereum blockchain.’

—  James Butterfill, CoinShares

“The level of exposure raises concerns and questions about acceptable thresholds for exposure to illicit funds, which an institutional investor is either willing to accept or legally allowed to carry,” the report said.

Liquid staking protocols remove complexity in Ether staking and increase market efficiency. They stake depositors’ Ether for them and give out placeholder tokens, called liquid staking tokens, in return. They are also sometimes called liquid staking derivatives, though some note that the term “derivatives” comes with regulatory baggage.

Staking rewards

These liquid staking tokens automatically accrue Ether staking rewards while also letting holders use them elsewhere, like as collateral for taking out DeFi loans.

This year, the Ether liquid staking market has exploded. In January, Lido, the largest Ether liquid staking provider, held $5.8 billion in deposits. Over the course of the year, that figure increased to $14.5 billion — a 150% gain.

Investor deposits in liquid staking derivatives protocols

‘A matrix of issues to grapple with’

There’s a lot institutional stakers must consider, according to James Butterfill, head of research at digital asset manager CoinShares.

“Regulated institutions have a matrix of issues to grapple with to access staking on the Ethereum blockchain, whether this is through the use of liquid staking, validators or crypto staking ETPs,” Butterfill said.

“Regulated institutions will bring rigorous due diligence to this analysis, helped by blockchain analytics, in an effort to select the platforms which present the lowest risk to them.”

But Northstake’s figures also have to be put in perspective. “If a rule is applied that an investor cannot invest if there are some rogue actors, then it may well exclude many investment asset classes,” he said.

According to estimates from the United Nations Office on Drugs and Crime, between 2% and 5% of global GDP is laundered every year. That equates to between $800 billion to $2 trillion a year.

Meanwhile, only $16 billion worth of crypto is locked in liquid staking protocols, according to DefiLlama data.

“If we assume the worst case that 1.5% is criminal behaviour, this equates to between 0.012% and 0.031% of global money laundering,” Butterfill told DL News. “This is remarkably low relative to other currencies, given that at one point according to SOCA [the UK’s Serious Organised Crime Agency], that 90% of all 500 Euro notes sold in the UK were in the hands of organised crime.”

Challenge for institutional investors

In traditional finance, it can be hard to ascertain one’s actual exposure to illicit or questionable funds. Crypto is different, according to Northstake CEO Jesper Johansen.

“We can actually document this on-chain,” he told DL News. “That’s the beauty of blockchain, the transparency. So the question is actually turned on its head: Would you, as an institutional investor, be willing to accept a half a percent documented exposure to sanctioned funds when making your investment? And I think the answer comes out at zero — as in, ‘no, I would not accept that.’ "

Ether liquid staking protocols usually do not require users to pass any form of know-your-customer or anti-money laundering checks — DeFi is largely permissionless after all.

While institutional investors may remain hesitant due to the counterparty risk involved with using liquid staking protocols, they are popular with retail investors, who aren’t affected by potential exposure to illicit funds.

“It’s purely from the institutional investor point of view that we see this issue,” Johansen said, “because they have a fiduciary obligation to their investors to record any exposure that they have in their investments to the relevant competent authorities.”

Tim Craig is DL News’ Edinburgh-based DeFi Correspondent. Reach out to him with tips at

Aleks Gilbert is DL News’ New York-based DeFi Correspondent. Reach out to him with tips at