InvestigationEthereumEigenLayerether.fi

ether.fi was 71% of EigenLayer's native ETH. By July it was gone.

In the summer of 2025, 3.5 million ETH sat restaked on EigenLayer. By September 2026 only a fifth of it was left. We followed the exit on-chain, day by day, to see who left and what became of the ETH.

At a glance
EigenLayer lets staked ETH be pledged a second time, to secure other services for extra yield. Its largest customer was ether.fi, the project behind eETH and weETH. On March 30, 2026, node firms working for ether.fi held 2.26 million of the 3.18 million native ETH staked there. Between April 21 and July 8 that fell to 5,869. The validators kept running and eETH kept trading. Only the pledge to EigenLayer ended. Kraken and P2P.org now hold most of what is left.
71%
ether.fi's share of EigenLayer's native stake, March 30, 2026
2.25M ETH
Net fall in ether.fi's stake, April 21 to July 8, 2026
745,594 ETH
Stake pulled in under two hours on the night of July 7
643K ETH
Native stake left on EigenLayer, September 30, 2026
Key findingsEach line has its own share link
  1. 71%

    Of EigenLayer's native ETH sat with ether.fi's node firms on March 30, 2026. That was 2.26 million of 3.18 million.

  2. 5,869

    ETH of that stake was left on July 8, 2026, after four rounds of cuts that began on April 21.

  3. 745,594

    ETH of stake was pulled from 3 node firms in under two hours on the night of July 7, in 72 transactions from one address.

  4. 23,653

    Validators were still live in ether.fi's EigenLayer pods on September 30, down from 43,201 in March. The stake behind them is no longer pledged.

  5. 43%

    Of the 643,132 native ETH left on EigenLayer on September 30 sits with node firms named Kraken. P2P.org holds another 18%.

  6. 30 days

    Passed between ether.fi's stake reaching near zero on-chain and CoinDesk reporting, on August 7, that weETH had dropped restaking.

01 · One night in JulyOne address, 72 transactions, under two hours

Late on July 7, one Ethereum address began sending transactions that pulled stake off EigenLayer. It sent 72 of them in under two hours. When it stopped, three firms that run validators had lost three quarters of a million ETH of stake between them.

By the next afternoon the job was done. All of that stake had belonged to one customer, ether.fi, and almost none of it was left.

ether.fi is a staking project. You give it ETH, it stakes that for you, and you get a token back, eETH, that you can trade or use in DeFi. EigenLayer, or Eigen for short, is where ether.fi sent the stake to earn a second yield, a practice called restaking. Nobody sent more. At the end of March 2026, ether.fi accounted for 71% of the native ETH on Eigen, meaning ETH staked straight into validators.

So the short answer to what happened to EigenLayer in 2026 is that one customer left. The exit took less than three months from the first cut to the last, and every step of it is on-chain.

02 · The basicsRestaking in one minute

Staking is the simple part. You lock ETH in a validator to help run Ethereum, and it earns a yield. Our piece on the MetaMask Staking incident shows what that job looks like when it goes wrong.

Restaking gives the same ETH a second job. On EigenLayer, which now calls itself EigenCloud, the stake is pledged to secure other services, such as oracles and data layers. Eigen calls them AVSs. They are meant to pay for that security, which would give the staker a second yield on top of the first. The pledge has a cost, though. If the firm running those services breaks the rules, part of the stake can be slashed.

The firms that do this are specialists. We call them node firms, meaning companies that run the validators and the extra services for a staker. The staker picks one and delegates its stake to it.

A liquid restaking token, or LRT, wraps all of this in one token. ether.fi has eETH and its wrapped form, weETH, while Renzo has ezETH and Kelp has rsETH. People trade them and post them as collateral to borrow.

One deposit, three layersWhat a staker gets when the ETH goes through a liquid restaking project such as ether.fi1 · StakeETH goes into a validator.It earns Ethereum's basestaking yield.The same ETH is pledged toEigenLayer. Node firms run extraservices for a second yield.The staker holds one token forall of it: eETH, or weETH oncewrapped. It works across DeFi.2 · Restake3 · TokenIn 2026 ether.fi took away layer 2. Layers 1 and 3 are still there.

03 · The riseHow ether.fi became most of EigenLayer

Native ETH on EigenLayer: ether.fi against everyone elseETH staked directly and delegated to node firms, in millions, April 9, 2024 to September 30, 2026ether.fi's node firmsEveryone else0M1M2M3M4MJul 2024Jan 2025Jul 2025Jan 2026Jul 2026Apr 18, 2026: Kelp hackMar 30, 2026: 3.18MJul 19, 2025: 3.49MJul 8, 2026: 465KSep 30, 2026643K

Eigen let stakers pick node firms from April 2024, and ETH poured in. Within three months about 2.5 million native ETH was staked with them, just under half of it with firms working for ether.fi. Those firms are easy to spot, because each lists itself under ether.fi's name plus its own, such as "ether.fi-8 - DSRV". In March 2026 there were 11 of them holding stake.

The total peaked in July 2025 at just under 3.5 million ETH. After that everyone else slowly shrank while ether.fi held steady, so its share kept growing. By the following March it stood at 71%.

Points did much of the early work, since both projects handed them out to early users ahead of their token launches. Those programs wound down through 2025, and slashing went live in April of that year, CoinDesk reported. From then on restaking carried a real risk, and the open question was whether the second yield paid for it.

04 · The exitFour rounds of cuts in 78 days

The first cut came in April 2026, days after a hack at another restaking project. On April 18, an attacker used Kelp's bridge to mint rsETH with nothing behind it, then borrowed real ETH against it on Aave. Eigen itself was untouched, but it was a bad week to hold an LRT, and billions left Aave.

Three days later, on April 21, ether.fi's node firms lost about a tenth of their stake, in a long run of small transactions spread across the day. Two more big cuts followed that week.

The exit, step by stepNative ETH delegated to ether.fi's node firms at the end of each day, in millions, April 1 to July 15, 20260.0M0.5M1.0M1.5M2.0M2.5MApr 1May 1Jun 1Jul 1Apr 18: Kelp hack5,869 leftApril 1: 2.26MApr 21 to 24: -508KMay 13 and 16: -189KJun 5 to 12: -558KJun 23: +330KJul 7 and 8: -1.13M

Then it went quiet, and came back in rounds. There were two cuts in mid-May, then six in eight days in June, each between about 80,000 and 100,000 ETH. On June 23 the stake went the other way, and about a third of a million ETH was added back. We do not know why.

Two weeks later came the big one. On July 7 and 8, more than 1.1 million ETH of stake was pulled in under a day, which left ether.fi's firms with a few thousand.

Day, 2026Change, ETHFirmsLeft, ETH
Apr 21-224,83222,035,041
Apr 23-181,99761,838,772
Apr 24-86,47321,752,298
May 13-88,16911,620,826
May 16-100,50011,520,326
Jun 5-91,73331,381,465
Jun 8-94,37921,287,087
Jun 9-97,44121,189,645
Jun 10-79,94511,109,700
Jun 11-100,82611,008,873
Jun 12-93,5602915,313
Jun 23+330,17071,248,226
Jul 7-548,9907589,318
Jul 8-583,44935,869
Every day from April to July 2026 on which ether.fi's node firms gained or lost 50,000 ETH or more of native stake. Firms: how many of them moved more than 1,000 ETH that day. Left: their combined stake at the end of the day. Days are UTC.

Who did the pulling? The stake sat in 341 small contracts, and each one points to ether.fi's main pool, the contract that issues eETH. The transactions went through ether.fi's own node manager, a contract that pool names. We ranked the 400 stakers that pulled the most out of Eigen this year, and four fifths of what they took came from those contracts. Every one of its node firms ended up close to zero.

Node firmMar 30Jul 12Sep 30
Node.Monster424,7831,6052,249
Chainnodes407,2208732,333
DSRV (8)270,1053601,346
Finoa244,6419931,339
P2P.org217,8304872,804
Pier Two189,196491534
Validation Cloud144,147137192
Cosmostation142,1956061,055
DSRV (3)109,3661959,374
Allnodes80,370240484
Nethermind30,020282692
Stake delegated to each node firm that lists itself under ether.fi's name, on three days in 2026, in ETH. Together they held 2,259,873, then 6,269, then 22,402. Each is listed as ether.fi plus a number and its own name, for example "ether.fi-10 - Node.Monster". DSRV runs two, numbered 8 and 3.

The news came later. On August 7, CoinDesk reported that ether.fi had removed restaking from weETH that week. In late September it reported that under 1% of the project's assets were still restaked as of August. On-chain, the stake had been about that low since July 8.

On-chain, and in publicAbove the line: what the chain shows. Below: what made the news. April to September 2026On-chainIn the newsAprMayJunJulAugSepOctApr 21Jul 8first cutether.fi stake near zeroKelp is hackedJun 12six cuts in eight daysCoinDesk: weETH drops restakingApr 18Aug 7Sep 28CoinDesk: CEO explains the exit

05 · What movedThe pledge left and the validators stayed

It would be easy to read all that as 2.25 million ETH walking out of EigenLayer. The chain shows something less dramatic. When stake leaves Eigen, the ETH itself does not have to go anywhere, because a staker can take back the pledge and leave the validators running.

Inside ether.fi's EigenLayer pods341 node contracts that point at ether.fi's pool, read on March 31 and September 30, 2026Restaked balance, in ETHValidators still live2.25M21,44943,20123,653Mar 31Sep 30Mar 31Sep 30-99%-45%

ether.fi's contracts show just that. Their restaked balance fell 99% between the end of March and the end of September, while the count of live validators in their Eigen pods fell by less than half. A pod is the contract a validator pays out to, so those validators are still wired to Eigen. That last link is due to go by the end of the year, per ether.fi's docs as CoinDesk reported them.

Why the validator count fell at all, we cannot say. Some may have exited to pay out holders, and some may have been merged into bigger validators, which Ethereum has allowed since the Pectra upgrade.

eETH against ether.fi's stake on EigenLayereETH supply and the native stake held by ether.fi's node firms on EigenLayer, month ends, millions of ETHeETH supplyether.fi's native stake on EigenLayer0M1M2M3M4MJul 2024Jan 2025Jul 2025Jan 2026Jul 20262.30M22KJan 2026: 3.40MMay 2026: 1.87M

eETH holders did move, on their own clock. eETH supply, which tracks the ETH held with ether.fi, fell by more than a third in April and May, a net drop of over a million ETH. Then it turned. Four months later it had won back about 40% of that drop, while the pledge stayed near zero.

So the two came apart. In March, the stake on Eigen was equal to about three quarters of eETH supply, and at the end of June it was still close to two thirds. A month later it was 1%.

06 · The stETH sideThe stETH went first

stETH in EigenLayer's stETH poolstETH held by the pool at each month end, in thousands, June 2023 to September 20260K250K500K750K1,000K1,250KJul 2023Jan 2024Jul 2024Jan 2025Jul 2025Jan 2026Jul 2026Jan 2026: 1,180KSep 2026: 234K

Native stake was only part of what ether.fi had on Eigen. Eigen also runs a pool for Lido's stETH, and at the end of January one of its contracts owned two thirds of it.

It began pulling out in February, two months before the Kelp hack. By the end of April it owned none of the pool, and the pool itself has shrunk by four fifths since January.

The stETH did not go far. At the end of the quarter the same contract held more than half a million stETH in its own balance, outside Eigen.

07 · Who is leftEigenLayer without ether.fi

Who holds the native stake that is leftThe ten largest node firms on September 30, 2026, in ETH. The grey tick is the same firm on March 30, 2026KrakenOthersKraken [2]P2P.org [no slashing AVS]KrakenKraken [1]FigmentKelp by LuganodesRenzo Operated by FigmentRenzo Operated By HashKey CloudstakefishAttestant118,477116,27988,50068,66553,08737,14022,28217,23915,70015,648

Six months on, the native stake on Eigen is a fifth of the March figure. Node firms named Kraken hold 43% of it. Add P2P.org and you are past 60%.

Kraken's own stake took a round trip, falling by almost nine tenths between March and mid-July and then coming nearly all the way back by the end of September. We have not traced why.

The other LRTs went their own ways. Renzo's node firms lost almost four fifths of their stake over those six months, while Kelp's barely moved. The field thinned out too. In March, 46 node firms held 1,000 ETH or more. Six months later, 27 did.

08 · WhyWhat happened to EigenLayer

Mike Silagadze, ether.fi's CEO, gave the reason to CoinDesk in late September. There were "no meaningful yield opportunities in restaking", he said, and stakers saw some risk in it. So ether.fi left.

The fee numbers in the same report back him on yield. Citing DefiLlama, CoinDesk said the whole restaking sector earned about $100,000 in fees in one week of early September. Plain liquid staking earned $27 million.

The project has not dropped restaking for good. CoinDesk reports that holders who want it can opt in to a separate token, weETHs, built on Symbiotic, a rival to Eigen. The weETHs token we found on Ethereum had a supply of about 8,000 at the end of the quarter.

On motive the chain is silent, but the order of events is clear. The stETH began leaving two months before the Kelp hack, and the native ETH three days after it. Whether Kelp sped up a plan already under way is a question for ether.fi.

So what happened to EigenLayer? Its biggest customer found the second yield too small for the risk, by its CEO's account, and took back 2.25 million ETH of stake in 78 days. If you hold eETH or weETH, your token now earns the base staking yield, and about 1% of the ETH behind it is still pledged to Eigen. If you count on Eigen to secure a service, the native stake behind it is a fifth of what it was in March, and most of it sits with two names.

09 · How we measuredWhat we counted, and what we left out

We read Ethereum's record of EigenLayer's own contracts. Each time stake is added to a node firm or taken from it, the contract logs an event. We added those up day by day from April 2024 to the end of September 2026. The running totals match what the contract itself reports on the four dates we checked.

A node firm counts as ether.fi's if the name it lists says so. We checked that against the contracts doing the staking, which all point to its pool. We did not measure validator balances or rewards, and on Symbiotic we looked only at the token's supply. Days are UTC.

10 · The recordThe contracts and transactions behind the numbers

WhatAddress or transaction
EigenLayer delegation0x3905…f37a
EigenLayer pod manager0x91e6…a338
EigenLayer stETH pool0x93c4…564d
ether.fi pool0x3088…f216
ether.fi node manager0x8b71…916f
eETH0x35fa…8ac2
weETHs0x917c…9d88
ether.fi stETH holder0x1b7a…6fff
ether.fi-10, Node.Monster0x6794…e051
ether.fi-7, Chainnodes0x8e7e…a56f
Sender, July 7 and 80x7835…6d2a
First cut, April 210x2401…d7e7
July 7, 23:00 UTC0x5f7d…492f
July 8, 00:17 UTC0x8a9b…ca54
July 8, 14:24 UTC0xe886…da19

FAQ

What happened to EigenLayer in 2026?

Its largest staker left. At the end of March 2026, node firms working for ether.fi held 71% of the native ETH restaked on EigenLayer. By July 8 almost none of that stake was left. Six months on from March, the total across all stakers was a fifth of what it had been.

Did ether.fi leave EigenLayer?

Almost entirely. Its native stake fell by more than 99% between April 21 and July 8, 2026, and its stETH had left EigenLayer's stETH pool by the end of April. At the end of September, over 20,000 of its validators were still wired to EigenLayer pods, though the stake behind them is no longer pledged.

Is weETH still a restaking token?

CoinDesk reported on August 7, 2026 that ether.fi had removed restaking from weETH and moved it to a separate opt-in token, weETHs. On-chain, the stake its node firms hold on EigenLayer has been about 1% of eETH supply since July.

Why did ether.fi stop restaking?

CEO Mike Silagadze told CoinDesk in late September 2026 that restaking offered no yield worth having and that stakers saw some risk in it. The on-chain record shows when the stake left. It cannot show why.

How much ETH is restaked on EigenLayer now?

About 643,000 native ETH was staked with EigenLayer's node firms at the end of September 2026. That is less than a fifth of the peak the summer before. EigenLayer's stETH pool has shrunk by a similar share.

Who holds the most stake on EigenLayer now?

Node firms named Kraken hold 43% of the native stake on EigenLayer, and P2P.org holds 18%. The five largest node firms hold more than two thirds between them. These are end-of-September figures.

What is native restaking?

Native restaking means pledging ETH that is staked directly in Ethereum validators, as opposed to pledging a staking token such as stETH. The validator is set to pay out to an EigenLayer contract called a pod.

Run it yourself

Ask about any staker or node firm in plain English

Every figure above came from data anyone can query. The Bitquery MCP server puts it behind an AI assistant, so you can ask how much stake a node firm holds on EigenLayer today, which wallets pulled out this week, or what a contract did on a given day, without writing the query yourself.

Pull the events a contract logged on any dayList the biggest holders of eETH, weETH or stETHFollow a wallet's transfers in and outCheck when a contract was created and by whom
Explore Bitquery MCP →Figures measured October 1, 2026, against Bitquery's Ethereum data from April 9, 2024 to September 30, 2026. Reported by Gaurav Agarwal for Bitquery Research; AI tools ran the queries and drafted the text, and every figure was worked out again from the data before publishing.
Limits on these figures

All figures run to September 30, 2026. Stake on EigenLayer changes daily, so later counts will differ.

Native ETH here means ETH delegated to a node firm on EigenLayer, summed from the delegation contract's own events. ETH held in pods without a node firm is not counted, and neither are staking tokens other than the stETH pool covered in section 06.

A node firm is counted as ether.fi's when its published name contains ether.fi. As a second check, the 341 contracts that held the stake each name ether.fi's pool. A node firm working for ether.fi under another name would be missed.

Pod and validator counts were read from the contracts at two blocks, March 31 and September 30, 2026. The pods' restaked balance on March 31 (2.25 million ETH) is read from the pod contracts, so it differs slightly from the 2.26 million delegated to node firms, which is summed from events. We did not measure validator balances, so we cannot say how much ETH sits in the validators still live in those pods.

Statements attributed to ether.fi or its chief executive are as reported by CoinDesk on August 7 and September 28, 2026. We did not speak to ether.fi, EigenLayer, Kraken or any other party named here.

The article places the Kelp hack and the first cut three days apart. It does not claim that one caused the other. One ether.fi node firm lost about 80,000 ETH of stake on February 26, 2026; the combined stake was then flat until April 21, which is where the article starts counting.

Legal disclaimer

This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell, hold or stake any token or asset.

The findings describe stake, contracts and transactions observed in Ethereum data between April 9, 2024 and September 30, 2026. Attributions come from names that node firms published on-chain and from contract state; they may be incomplete or incorrect and may be revised as more data becomes available.

References to ether.fi, EigenLayer, EigenCloud, Kraken, P2P.org, Renzo, Kelp, Lido, Symbiotic or any other named party describe what the record shows about contracts and addresses linked to them. They are not statements about any company's solvency, security practices, disclosures or conduct, and nothing here asserts that any party acted unlawfully or improperly.

Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.

Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.