What happens if a liquid staking provider gets hacked?

13 November 2026

If a liquid staking provider gets hacked, the most immediate consequence is that the underlying staked assets - and therefore the liquid staking tokens (LSTs) meant to represent them - lose their peg to the original cryptocurrency. You do not automatically lose everything, but you do face a complex situation that can result in partial or total loss of value, depending on the nature of the hack and the provider’s response.

How the Attack Affects the Liquid Staking Token

Liquid staking providers like Lido, Rocket Pool, or similar platforms issue LSTs (e.g., stETH, rETH) in exchange for deposited assets. These tokens are supposed to trade close to the value of the underlying staked cryptocurrency, minus fees. A hack disrupts this mechanism in several ways:

• Smart contract exploit: If the provider’s smart contract is drained of deposited funds, the LST no longer represents a claim on a full reserve. The token’s market price will likely drop immediately as traders sell, and it may trade at a significant discount to the underlying asset.
• Validator key theft: If the hacker gains control of the validator keys used by the provider’s nodes, they could initiate actions like withdrawing staked funds to a malicious address, or worse, trigger slashing events that destroy staked ETH. This is more damaging because it directly reduces the total staked assets.
• Governance or admin key compromise: Many liquid staking protocols have admin keys that can upgrade contracts or pause operations. If those are stolen, the hacker can redirect future rewards or even drain remaining reserves.

In all cases, the LST’s price will reflect the market’s best guess at what fraction of the original stake can be recovered. That price can fall to near zero if the hack is total and insurance is inadequate.

What happens to your staking rewards

If the hack occurs after you have already earned staking rewards, those rewards are typically held within the protocol’s smart contract and distributed as the LST’s underlying value grows. A hack that drains the contract also takes future rewards. Past rewards that were already distributed as yield (e.g., paid out in LST or native tokens) are yours to keep, but their value is now tied to the compromised token’s market price.

Recovery options and their realities

No two hacks play out the same way, but common recovery paths include:

1. Pause and fork: The provider may pause withdrawals and propose a governance vote to fork the protocol, creating a new version of the LST with a different contract and a snapshot of the pre-hack balances. This is what happened after the 2022 Wormhole bridge hack, though that was not a liquid staking provider. The new token typically trades at a fraction of the original value, and the old token may become worthless.
2. Insurance payouts: Some protocols hold insurance funds or have third-party coverage (e.g., Nexus Mutual, Unslashed). If the hack is covered, you may file a claim. Payouts are rarely 100% and can take months. The protocol’s documentation should state whether it holds insurance, but the fine print often excludes certain attack types.
3. White-hat recovery: Occasionally, the hacker returns funds after negotiations or a bounty. This is unpredictable and not something you should count on.
4. Legal action: If the provider is a registered company in a jurisdiction with strong laws, you may have legal recourse. This is slow, expensive, and often fails against anonymous or offshore attackers.

The Risk of Slashing from a Hacked Validator

If the hack compromises validator keys and the attacker causes the validator to be slashed, the slashed ETH is permanently destroyed by the protocol. Liquid staking providers usually pool multiple validators, so a single slashing event affects only a portion of the total stake. But if the attacker controls many validators or orchestrates a coordinated slash, the damage can be severe. The LST’s value will drop by roughly the amount of slashed ETH, plus any penalty for the provider’s failure to secure its keys.

How to prepare before it happens

You cannot prevent a hack, but you can reduce your exposure:

• Check the provider’s security history. Have they been audited by reputable firms? Have they experienced past incidents? Look for post-mortem reports.
• Understand the LST’s redemption mechanism. Some LSTs have a built-in “unstake” function that lets you redeem the token for the underlying asset directly from the protocol, bypassing the open market. If the protocol is hacked, that function may be paused or drained. Know the difference between a token that is redeemable on-chain and one that only trades on exchanges.
• Diversify across providers. No single liquid staking provider is too big to fail. Spreading your stake across two or three reduces the impact of any single hack.
• Monitor the provider’s governance. If the protocol has a timelock on contract upgrades, you have a window to exit if a malicious proposal passes. Set alerts for governance votes.

The Bottom Line

A liquid staking provider hack does not mean your coins vanish instantly, but it does mean the value of your liquid staking token becomes uncertain and likely lower. The recovery process is messy, often partial, and never quick. The safest approach is to treat liquid staking as a higher-risk activity than native staking, and to size your position accordingly. If you are not comfortable with the possibility of losing a significant fraction of your stake in a single incident, consider native staking or a simple cold wallet instead.

Back to staking