TL;DR
Lido converts ETH into stETH, a rebasing claim on a pool of about 9.47M staked ETH run by roughly 295,500 validators. The core has run since December 2020 with no protocol-level exploit, and the governance posture is genuinely the strongest of any protocol this size: a 96h timelock and a stETH holder veto, both read off the contracts this run rather than off the docs. Three things belong up front. Staking Router v3 shipped in July, and on 25 July the Accounting Oracle published a report that undercounted the pool by one 32 ETH deposit; the official disclosure says the cause was never established. A Community Staking Module operator was slashed in March, and the operator's bond paid, not stakers. And in April a third-party bridge hack at KelpDAO left about $21M stranded in Lido's EarnETH vault, which the DAO backstopped. None of the three cost a stETH holder anything. Exit today is normal rather than exceptional: a short queue that takes about five days and is served by exiting validators, not by spare cash sitting in the protocol.
Checklist
Audits & contracts. 99 reports in the Lido on Ethereum section of the audits page, 120 once the multichain and Polygon deployments are counted. The most recent indexed work is Cyfrin and MixBytes on the CircuitBreaker pause manager (April 2026) and Composable Security on Oracle v7.1 (March 2026), on top of Certora, Statemind, ChainSecurity, OpenZeppelin, Sigma Prime, Ackee, Oxorio, Hexens and Nethermind reviews across prior years. Every firm named here was checked against that page and actually engaged this protocol. Press coverage says Certora, Statemind, MixBytes and Composable Security reviewed the Staking Router v3 bundle before its 7 July mainnet deployment, but those reports were not on the official page this run, so treat that sign-off as reported rather than confirmed.
Admin control. Read off the contracts, not the docs. Dual Governance is live and sitting in state Normal. The EmergencyProtectedTimelock enforces 259,200 seconds after submit plus 86,400 seconds after schedule, which is exactly the 96h the previous report claimed. stETH holders escalate by locking into the signalling escrow: 1% of supply is the first seal and stretches the delay from 5 days toward 45, and 10% is the second seal and triggers rage quit, blocking execution until dissenters have exited. LDO holders cannot simply outvote stETH holders on a hostile change, which is the point of the design, and it matters more than usual here because LDO's market cap is roughly 1.4% of the value it would otherwise govern. The honest limit on the "no single multisig" line is the committee layer: an Emergency Activation multisig (4 of 7) and Emergency Execution multisig (5 of 7) can pause Dual Governance and temporarily hand control back to LDO governance, a Reseal Committee can extend GateSeal's 11-day withdrawal pause, and a Tiebreaker built as three subcommittees can force execution of stuck proposals. Those are real powers held by small groups, and they are the reason this is a strong green rather than a perfect one.
Oracle. 5-of-9, read straight off the HashConsensus contract, with nine member addresses returned; the exit bus oracle uses the same threshold. Five compromised keys can move the reported balance that drives every rebase. This is not hypothetical: in May 2025 one operator's oracle hot wallet was compromised, and the 5-of-9 threshold is precisely what made it a 1.46 ETH nuisance instead of an incident. Then on 25 July 2026 a report went out missing one 32 ETH pending deposit and pushed the daily rebase to 2.04% APR against an expected 2.15%. Lido's own alerting caught it at 13:41 UTC, the next report corrected it, and no funds moved. The uncomfortable part is in the disclosure itself: the cause "was not established, as the issue cannot be reproduced using historical data," with a race condition the working assumption and oracle logs too thin to confirm it. It landed during the Staking Router v3 migration window, which is the most plausible context but not a proven cause. Invariant checks that reject a report with a mismatched deposit count were added afterwards.
Liquidity & exit. Measured, and the measurement contradicts the comfortable version of this story. The queue holds 48 unfinalized requests worth 19,729 ETH against 1,088 ETH of protocol buffer, so coverage is about 5.5%, not the near-total coverage a spot-check earlier in the day suggested. That buffer swings by thousands of ETH within a single day as deposits are batched out to the beacon chain, so it is not a durable guarantee of anything and should not be read as one. Lido's own estimator agrees: it returns a finalization date of 16 August for both 100 stETH and 10,000 stETH, and it labels the path "exitValidators", meaning the queue is being served by exiting validators rather than from cash on hand. That is the protocol working normally, and about five days is a fine number, but it is a queue, not a buffer. Ethereum's own exit queue is short at 13,120 ETH and about five and a half hours, while 2.38M ETH waits roughly 41 days to get in, so there is no network-level exit congestion adding to that. Secondary market is essentially at par at 0.99943, and the main Curve pool fills 10,000 stETH at 0.12% below par. It breaks at 50,000 stETH for a mechanical reason worth knowing: that pool holds about 18,858 ETH against 21,969 stETH, so a 50,000 stETH sale would take essentially the entire ETH side and prints a 62% loss. At size the queue is the exit and the pool is not.
Yield: real vs emission. Real, and thin. stETH pays consensus and execution rewards minus the protocol fee, which the contract reports as 999 basis points. The latest published net APR was 2.183%, with a 2.182% seven-day average, so the number is steady rather than a lucky print. No LDO emissions subsidise it, which is the right structure and also means nothing papers over a weak month.
Holder concentration. Two separate questions, and they point different ways. Lido holds 22.75% of all staked ETH, a little below the roughly 23% quoted last time, so the Ethereum-level concern eased rather than worsened. Inside Lido it is tighter than the headline suggests: the two DAO-curated modules run 90.01% of active validators, and the permissionless Community Staking Module sits at 8.30% against a 9% stake-share limit written into the module config on-chain, meaning it has consumed about 92% of the room the DAO allocated it. The permissionless module changed the picture, but a DAO-set cap decides how much further it can. LDO's own top-holder and unlock breakdown stayed behind paywalls this run.
Track record. No core-protocol exploit since launch in December 2020, and that still holds after five and a half years and a full cycle. But 2026 was not a quiet year, and the clean version of this section would be misleading. On 12 March a CSM operator had six validators slashed for 0.7973122 ETH all in, of which 0.3459189 ETH came automatically from the operator's bond and 0.4513933 ETH from a voluntary top-up, with no staker impact. On 18 April the KelpDAO rsETH bridge hack left Lido's EarnETH vault holding roughly $21M of impaired rsETH, about 9% of that vault; stETH and wstETH were untouched, but the DAO deployed about 2,644 ETH between a relief contribution and first-loss coverage, depositors were made whole, and the vault reopened on 15 May. On 25 July the oracle misreport cost nothing but explained nothing either. Add the May 2025 oracle key compromise at one operator and the pattern is consistent: Lido's own monitoring finds these first and discloses them in public post-mortems, and the losses land on operator bonds or the DAO treasury rather than on stakers. That is a good record. It is not a spotless one, which is why this sits at yellow.
Worst case
Five of nine oracle keys collude or get compromised and a false balance report clears the sanity checks. July was a benign rehearsal of precisely that failure mode: a wrong number was published and nobody could later reconstruct why. At 32 ETH out of 9.47M it was noise. At scale it would misprice every rebase and the finalization of the withdrawal queue, and the new invariant check guards the specific shape of the July bug rather than the class. Against that sits the 96h timelock and the stETH veto, verified on-chain, which give holders time to signal or rage quit before a hostile upgrade executes, with the caveat that the emergency and tiebreaker committees can act inside that structure and a Reseal Committee can extend an 11-day withdrawal pause. The likelier and duller loss is exit timing, and this run makes the shape of it clearer than last month's did: exit is a roughly five-day validator-exit queue, not cash on hand, so in a panic the queue lengthens, stETH trades under ETH, and anyone forced to sell size into the Curve pool eats slippage that turns brutal past about 10,000 stETH because the pool's ETH side is only around 19,000 ETH deep. Native redemption still pays 1:1 once your slot finalizes. Slashing is real but bounded and bond-backed, as March showed. The April episode is the reminder that Lido-branded does not mean Lido-core: a vault carrying third-party collateral can take a loss the staking protocol never could.
Bottom line
Solid, and the structural case is stronger than the draft's numbers were. Every governance and oracle claim carrying the verdict was re-read off the chain this run and held: 5-of-9 quorum, 96h timelock, Dual Governance in Normal state, 999 basis points of fee, module caps as documented. Two things did not hold. The withdrawal queue is not covered by the protocol buffer; it is served by exiting validators over about five days, which is normal but is a different claim. And the 2026 incident record is three events, not two, including a $21M third-party exposure in a Lido-branded vault that required a DAO backstop. Neither touches deposited stETH principal, which is why the verdict survives, but both move this from an inherited green to a checked one. The dimensions to re-check next month are the oracle, whose last failure has no established root cause, and the exit path, whose comfort depends on a queue rather than a balance. Nothing found here threatens stETH principal today.
Data appendix
- TVL: $17.900B (DeFiLlama, verified for this run). The same source's live field drifted to $17.65B within the day and Lido's own API printed stETH market cap $17.691B, so read the USD number as a band around $17.7B to $17.9B rather than a point; the ETH-denominated pool is the stable figure at 9,465,188.13 ETH, which the stETH contract confirms on-chain. 90d: $20.016B on 2026-05-13, so down 10.6%. ATH: $42.520B on 2025-08-23, so down 57.9%. Correction to the orientation supplied for this run: the previous report carried ~$14.36B, not $18.18B (verified in the prior report file), and DeFiLlama's own history for 2026-07-01 reads $14.326B, so USD TVL is up about 25% over six weeks rather than down 1.5%. In ETH terms the pool grew over the same window, so none of the 90-day USD decline is outflow, it is ETH price.
- Audits: 99 reports for Lido on Ethereum at docs.lido.fi/security/audits, 120 across all deployments. 2026 entries include Cyfrin and MixBytes on CircuitBreaker (04-2026), Composable Security on Oracle v7.1 (03-2026), Certora on the Lido V3 fix review (03-2026), MixBytes on Lido V3, EasyTrack stVaults, Triggerable Withdrawals Easy Track and MellowStrategyAdapter (03-2026), Cantina on the zkSync bridge fix review (03-2026), Sigma Prime on the BLS library and MixBytes on the CSM Performance Oracle (01-2026). Staking Router v3, Curated Module v2 and CSM v3 audits are press-attributed to Certora, Statemind, MixBytes and Composable Security ahead of a 7 July mainnet deployment, but were not indexed on that page this run: refresh.
- Admin/governance: DualGovernance 0xC1db28B3301331277e307FDCfF8DE28242A4486E returns persisted and effective state 1 (Normal). EmergencyProtectedTimelock 0xCE0425301C85c5Ea2A0873A2dEe44d78E02D2316 returns afterSubmitDelay 259,200s (72h) and afterScheduleDelay 86,400s (24h), totalling 96h. First seal 1% of stETH supply stretches the delay from 5 days toward 45; second seal 10% triggers rage quit. Committee structure per Lido's own explainer: Emergency Activation 4 of 7 and Emergency Execution 5 of 7 (can pause Dual Governance and temporarily restore LDO governance), Reseal Committee (extends GateSeal's 11-day withdrawal pause during veto signalling), Tiebreaker as three subcommittees (Ethereum Ecosystem 3 of 5, Builders 3 of 5, Node Operators 5 of 7, two of three required). Committee member addresses and whether the first-year emergency window is still open: refresh (the committee getters reverted against the deployed ABI this run). Onchain vote #203 (15 to 18 July 2026) bundled LIP-33 (Curated Module v2 and CSM v3) with LIP-35 (Staking Router v3, moving accounting from validator counts to balances) and was enacted 20 July through this process. LDO market cap is $242.6M against $17.9B secured, roughly 1.4%, which is a large part of why the stETH veto matters.
- Oracle: AccountingOracle HashConsensus 0xD624B08C83bAECF0807Dd2c6880C3154a5F0B288 returns getQuorum 5 and getMembers 9 addresses, so 5-of-9 confirmed. The ValidatorsExitBus HashConsensus also returns quorum 5. Member reference slots advance in 7,200-slot steps, consistent with a daily reporting frame. Mapping the 9 member addresses to named organisations: refresh.
- Staking modules and node operators: four active modules read from StakingRouter 0xFdDf38947aFB03C621C71b06C9C70bce73f12999, active taken as deposited minus exited. curated-onchain-v1 263,676 active (89.24%, share limit 100%), Community Staking 24,526 (8.30%, limit 900bp), SimpleDVT 5,000 (1.69%, limit 430bp), curated-onchain-v2 2,268 (0.77%, limit 100%). Total 295,470 active validators, which at 32 ETH each gives 9,455,040 ETH against the 9,465,188 ETH pooled total, the gap being buffer and partial balances. Per-module node operator counts: refresh.
- Holder concentration: 22.75% of all staked ETH (9,465,188 Lido ETH against 41.6M staked network-wide per validatorqueue.com), versus roughly 23% cited in the prior report. 32.92% of validator count (295,470 of 897,432), higher than the stake share because Lido has largely not consolidated to larger validator balances. 620,535 unique stETH holders, 635,147 anytime. Lido is 50.6% of DeFiLlama's cross-chain Liquid Staking category ($34.90B across 287 protocols; next is Binance staked ETH at 19.9%). LDO top-holder and unlock breakdown: refresh (Etherscan and Nansen both returned Pro-tier errors this run).
- Peg and exit: stETH/ETH 0.99943 on CoinGecko, corroborated by the USD cross ($1,871.90 against $1,872.97). Curve pool 0xDC24316b9AE028F1497c275EB9192a3Ea0f67022 quotes 1 stETH at 0.027% below par, 1,000 at 0.033%, 10,000 at 0.115%, and 50,000 at 62.3% below par; pool balances are 18,857.5 ETH against 21,969.1 stETH, so the 50,000 quote is that one pool's ETH side being fully drained, not a market price. WithdrawalQueue 0x889edC2eDab5f40e902b864aD4d7AdE8E412F9B1: lastRequestId 132,175, lastFinalizedRequestId 132,127, unfinalizedRequestNumber 48, 19,729.22 ETH unfinalized against 1,087.80 ETH buffered on the stETH contract, so about 5.5% coverage, and not paused. Lido's estimator returns finalization at 2026-08-16 12:30 UTC for both 100 and 10,000 stETH, with path type "exitValidators". Ethereum-wide exit queue 13,120 ETH at about 5h28m; entry queue 2,379,549 ETH at about 41 days. Worst stETH:ETH deviation over the 90-day window: refresh (CoinGecko's ETH-denominated series is derived from two USD series and returned implausible values in both directions, so it was not trusted).
- Yield: net stETH APR 2.183% as of the report at 2026-08-11 12:21 UTC, 7-day SMA 2.182%, prior day 2.171% (Lido API). Protocol fee on-chain getFee 999 bp. Module fee splits read on-chain: curated v1 350/650 bp operator/treasury, curated v2 400/600, CSM 600/400, SimpleDVT 800/200.
- Recent-news scan (2026-08-11): No open protocol-level exploit and no active depeg. 25 July 2026 Accounting Oracle security disclosure: one 32 ETH pending deposit omitted, daily rebase 2.04% APR against 2.15% expected, corrected the next day, detected 13:41 UTC by Lido's own on-chain alerting, root cause not established and not reproducible, invariant and deposit-count checks added, "no funds were lost or frozen", post-mortem published August. 18 April 2026 KelpDAO rsETH bridge hack: about $21M and roughly 9% of the EarnETH vault impaired, stETH and wstETH untouched, DAO deployed about 2,644 ETH (2,500 ETH relief plus 143.98 ETH first-loss coverage), depositors made whole, vault reopened 15 May 2026. 12 March 2026 CSM slashing: six validators, 0.7973122 ETH total, 0.3459189 ETH from operator bond plus 0.4513933 ETH voluntary, no staker impact. 11 May 2025 Chorus One oracle key compromise: 1.46 ETH of gas drained from a deliberately minimal hot wallet, no user funds, address rotated by emergency DAO vote. One outlet referenced a February 2026 incident affecting roughly 5,572 validators; no primary source corroborated it, so it is not carried here: refresh. Maintained monthly. Methodology: DeFi Research Instruction v2.