Restaking and shared security: what the yield is actually paid for

The problem with a restaking yield

An institution offered a restaking yield on staked ETH, staked SOL or staked BTC is not being paid simply for locking capital. It is being paid, in part, for underwriting services it may never have evaluated: a data availability network, an oracle, a bridge, a rollup sequencer, or a finality layer for someone else's chain. The yield is a premium for taking on a second, separate set of failure conditions, set by a party the capital provider did not choose and often cannot audit directly. Institutional staking risk and reward covers the base layer: validator economics, custody and jurisdictional treatment. This piece assumes that ground and moves to what changes once staked capital is committed a second time.

How the commitment actually works

Capital committed to additional services

In each architecture examined here, a staker or an intermediary holding staked capital agrees to expose some or all of it to a second set of penalty conditions, defined by a service that is not the base chain's own validator set. On EigenLayer, an operator's restaked ETH is divided into operator sets created by each AVS, an actively validated service, that the operator joins; EigenLayer describes the design as Unique Stake, which "guarantees that an Operator's specific slashable stake can be allocated only to one AVS at a particular time, minimizing systemic risk" (eigenlabs.org, 20 December 2024). On Symbiotic, capital sits in a vault, and the vault delegates it to one or more networks, each of which defines its own collateral, operator and slashing terms (docs.symbiotic.fi, accessed September 2026). On Babylon, the committed asset is native bitcoin, locked in a self-custodial staking script on the Bitcoin blockchain itself rather than moved anywhere: the staked bitcoin "are not transferred to the finality provider", and it is voting power, not custody, that is delegated (babylonlabs.io, 16 August 2024). On Jito, staked SPL tokens are deposited into a vault and delegated to one or more Node Consensus Networks, Solana-based services that borrow that stake for their own security; the live example the protocol names is TipRouter, which decentralises the distribution of MEV tips across the Jito ecosystem (solanacompass.com, accessed September 2026).

Who sets the conditions that can take it

The condition-setter is the service, not the base protocol and, in most of these architectures, not the staker either. EigenLayer's own account of the mechanism is direct: "AVSs can design robust systems around slashings, like governance, fraud proofs, or other management mechanisms that work for their protocols and communities" (eigenlabs.org, 20 December 2024), meaning the AVS writes its own rulebook for when an operator's allocated stake is confiscated. Symbiotic's vault contracts can be configured with an instant slasher, a module the documentation describes as "validate and execute in a single step", with no on-chain dispute window; a veto slasher, where resolvers have a configured number of seconds to veto a penalty before it executes; or no slasher at all, in which case "the vault cannot be slashed at all" (docs.symbiotic.fi, accessed September 2026). Babylon runs the logic the other way: the staker pre-signs a slashing transaction that requires a signature from the delegator, a quorum of the covenant committee and the finality provider, and it becomes executable only if the staker's chosen finality provider double-signs on the chain it secures (babylonlabs.io, 16 August 2024; Figment, 12 September 2024).

The operator's role

The operator is the entity doing the work a service actually requires: running validator software, signing data-availability attestations, relaying prices, or producing blocks. It is the operator's allocated stake, not necessarily its own capital, that is at risk. Symbiotic states the position plainly: "Operators do not provide collateral directly", and "if an operator violates an application's rules or fails to satisfy its obligations, the delegated collateral may be subject to slashing according to the application's slashing conditions" (docs.symbiotic.fi, accessed September 2026). That is the structural point to hold in view. The party whose conduct determines whether an institution's capital is confiscated is, in most of these systems, a third party it did not select and cannot remove mid-term.

Withdrawal and unbonding

Each protocol fixes a period during which committed capital stays slashable after a withdrawal is requested, precisely so misbehaviour cannot be outrun by a fast exit. On EigenLayer, a queued withdrawal is held for 100,800 blocks, about 14 days, before it becomes non-slashable and completable, and an operator's deallocation from an operator set carries the same 14-day delay; the separate delay governing changes to an operator's allocation-delay setting is longer, at 126,000 blocks or about 17.5 days, and ELIP-002 explains the arithmetic directly, the figure being "set to 17.5 days in order to give Stakers 3.5 days to withdraw (3.5 + 14 = 17.5) before new allocation delays take effect" (ELIP-002, eigenfoundation GitHub repository, created 12 December 2024, status merged). Symbiotic's delay is epoch-denominated rather than fixed in days: withdrawal requests "are collected and become claimable after the end of the next vault epoch", and "until that boundary, the requested amount remains eligible for slashing" (docs.symbiotic.fi, accessed September 2026). Babylon separates two clocks: during Phase-1 every delegation used the maximum timelock of 64,000 bitcoin blocks, roughly fifteen months, while an early exit instead runs through an on-demand unbonding transaction carrying the protocol minimum of 1,008 blocks, roughly seven days, which the covenant committee must approve and sign (babylonlabs.io, 16 August 2024; Figment, 12 September 2024). Jito's vaults impose a cooldown of two epochs, roughly four to five days on Solana's current schedule, between a withdrawal request and the underlying assets becoming claimable (jito.network, accessed September 2026).

Where the wrapper sits in the chain of claims

A liquid restaking token is a claim on a vault's assets, not a claim on any specific AVS, network or finality provider the vault has delegated to, and not, in most structures, a claim that ranks ahead of the slashing conditions those delegations carry. Holding the token gives pro rata exposure to whatever the vault's operators are doing at the time a slash lands, and to whatever discount the market applies to the token if a slash, or the fear of one, makes redemption uncertain. That is distinct from the staking-token discount already covered in the staking piece, and from the vault-and-curator risk mapped for lending markets in how DeFi lending yield is actually produced: here the underlying asset is not idle collateral earning interest, it is capital actively pledged against a named third party's operational conduct.

The risks, in the order they should be checked

Correlated slashing across services

Diversifying across several AVSs or networks does not remove risk if those AVSs or networks share operators. Academic work on liquid restaking frames the concern as cascading slashing, and locates the transmission point in concentration: "A single protocol acting as the primary issuer of LRTs would concentrate the power to delegate vast amounts of staked ETH. This concentration may create a single point of failure; misbehavior or compromise of a major operator or protocol could trigger the cascading slashing events previously described" (Sevim and Torres, "Financial Dynamics and Interconnected Risk of Liquid Restaking", arXiv, submitted 23 March 2026, revised 13 August 2026). EigenLayer's unique-stake design is a direct answer at the protocol layer: stake an operator allocates to one AVS's operator set cannot, by the protocol's own accounting, be taken by a slash ordered elsewhere (eigenlabs.org, 20 December 2024). The wall sits in the accounting. It does not stop the same small set of operators running infrastructure for many services at once, and that overlap is what the accounting cannot see.

Operator and issuer concentration

The same research measures concentration at the issuer level rather than the operator level, reporting that as of 9 October 2025 one protocol's liquid restaking token held 65.4% of total LRTs, and warning that "if one liquid-restaking protocol dominates the market, it may pose both restaker and node operator centralization risks" (Sevim and Torres, arXiv, 2026). That is a conditional about market structure, not a measured count of independent operators, and the distinction matters for diligence. An institution should ask a vault or issuer for the actual operator set behind its own allocation, because a long list of secured services does not imply a long list of independent operators standing behind them.

Contract risk

Restaking adds a further layer of smart contracts, a vault or delegation contract, a slasher contract, and the AVS's or network's own contracts, on top of the base chain's validator logic, and each is a separate audit surface. The threat-modelling approach set out in the institutional DeFi threat model applies without modification: an audit badge on one contract says nothing about the contracts it calls, and a restaking position typically calls through several.

Slashing conditions that are not yet live everywhere

Not every protocol enforces the penalties its documentation describes, and enforcement has arrived at different times in different places. EigenLayer proposed its slashing mechanism, ELIP-002, in December 2024 with mainnet deployment proposed for late Q1 2025 and the caveat that "dates are subject to change" (eigenlabs.org, 20 December 2024); slashing went live on mainnet a few weeks after that window, on 17 April 2025, the protocol stating that "Today marks a breakthrough moment for EigenLayer, Slashing is now live on Mainnet" (eigenlabs.org, 17 April 2025). Symbiotic's architecture separates slashing's design from its enforcement, and an independent review found that "the live status of slashing mechanisms within the Symbiotic protocol depends on specific implementations and activations by network builders" (LlamaRisk, "Current State of Symbiotic", 15 August 2024; no more recent independent assessment of enforcement across Symbiotic's networks was located as of September 2026). Babylon was explicit about the same gap in its own documentation, stating that "there is no slashing of staked bitcoin during Phase-1", with the mechanism deferred to the Genesis phase that launched on 10 April 2025 and now applies a slashing ratio of 5% for BABY staking and 0.1% for bitcoin staking (babylonlabs.io, 16 August 2024; babylon.foundation, accessed September 2026). Because activation is decided service by service rather than once per protocol, the question is not whether a protocol supports slashing but whether the specific network or AVS being underwritten has switched it on.

Governance over the conditions themselves

The rules that decide when capital is confiscated are not fixed; they are set by governance that can change them, and that governance has itself moved. EigenLayer's earlier design anticipated a protocol-wide veto committee to stop a slashing event becoming systemic; the security model published in September 2024 removed the need for one, on the basis that localised slashing made it unnecessary: "Since slashing is localized to individual AVSs, there is no necessity for a common veto committee" (eigenlabs.org, 10 September 2024). What is left in its place is a permission, not a requirement. EigenLayer states only that an AVS "can design robust systems around slashings" (eigenlabs.org, 20 December 2024), so whether any given AVS built in a dispute window is a fact to check per AVS rather than to assume from the protocol's design. Symbiotic keeps a comparable choice at the vault level, and adds a second-order control: resolvers have a configured veto window in seconds, and a separate parameter requires newly appointed resolvers to wait a minimum number of vault epochs before they become active (docs.symbiotic.fi, accessed September 2026). A vault's actual exposure has to be read off its own configuration.

Liquidity of the wrapper

The wrapper's price is its own risk. The research cited above observes a liquid restaking token trading above both a liquid staking token and the native asset, and finds no significant statistical relationship between that price premium and the issuing protocol's revenue, which is to say the premium is not a reliable read on how the underlying business is performing (Sevim and Torres, arXiv, 2026). The same work models what happens when the wrapper travels: for bridged positions used as lending collateral at maximum loan-to-value, it calculates that "a decline of just 3.33% in bridged ezETH renders all maximum-LTV positions liquidatable". The wrapper's discount is an observable market price and a more current signal than a yield figure printed on a dashboard, but it is a price, not a redemption guarantee.

What regulators have said, and what they have not

No central bank, standard-setter or securities regulator commentary specifically addressing restaking or liquid-restaking-token concentration was located for this piece. The Financial Stability Board's thematic peer review, published on 16 October 2025, found "significant gaps and inconsistencies in implementing the FSB Global Framework for Crypto-Asset Activities, that could pose risks to financial stability and to the development of a resilient digital asset ecosystem", but the review does not name staking or restaking (fsb.org, 16 October 2025). The Bank for International Settlements' Annual Economic Report chapter trailed in June 2026 examines tokenisation and stablecoins, including reserve composition and redemption, but does not address staking, restaking or the layered claims a restaked asset sits inside (bis.org, press release 23 June 2026; report published 28 June 2026). Where a supervisor has not spoken to a structure, that silence is not a clearance, and it is not a finding either way.

The question the allocation actually poses

None of this is tax, legal, accounting or investment advice, and no restaking yield should be read as a return an institution is entitled to expect. What can be established, from the protocols' own published mechanics and the independent research available, is what the yield is paid for, who can take the capital back, on what notice, and whether the penalty being priced is switched on yet. Those are answerable before any question about the rate.