Provider review

Restaking products are reviewed on what exactly can be taken from you and who gets to decide (34%), how long until you have your ETH back on the worst day (26%), what has actually gone wrong, what it cost and whether the vendor owned it (26%), and whether the wrapper tells you what it runs on and whether that is still true today (14%). The slashing question leads because a depositor not told which venues the capital is allocated to, who holds the slashing key and where slashed funds go cannot bound the loss or identify who triggers it; a wrapper that has removed the second slashing layer and says so plainly scores at the top, because absence of exposure is the best possible answer.

What exactly can be taken from me?

That depends on whether you hold the base layer or a wrapper. The base platforms publish slashing parameters machine-readably, so the venues, the maximum fraction and the slashing key are all checkable before you deposit. Several liquid wrappers do not, and the sharper question for those is whether they can add a new slashing venue without depositor consent or notice. A wrapper that chooses your venues and does not name them is asking you to accept a risk it has not described.

Is ether.fi still a restaking product?

Largely not, and this is the most important thing in the category. In August 2026 ether.fi hardened weETH with what it describes as "a cryptographic hard-disable on slashing exposure, with no onchain re-enable" — so its flagship token is now plain liquid staking. Restaking moved to a separate, much smaller token. Its own documentation has not caught up and still calls weETH a "liquid restaking token", and the homepage still describes the protocol as "a decentralized, non-custodial liquid restaking protocol". If you want ETH exposure with the least added risk, that is the answer; just do not buy weETH believing it is restaking.

What happened in the $292M exploit, and is it resolved?

It is resolved, and the interesting part is what came after. In April 2026 roughly 116,500 rsETH was drained through a bridge configured with a single verifier — no second party had to agree. Recovery was announced within a month, withdrawals and bridging resumed, funded by an industry restitution raise, and the protocol now carries several hundred million in TVL and processes exits normally. What it does not carry is any incident notice on a page it controls: the live marketing line is "battle-tested, institutional grade", and the documentation that described the affected system now returns 404. Surviving the year’s largest hack is not the mark against it. Not saying so is.