🚀 Key Generation for Mainnet

0x01 keys only

This guide is for the live 0x01 CSM. Generate 0x01 withdrawal credentials with deposit data set to 32 ETH. Do not generate 0x02 keys for CSM yet; 0x02 CSM is not live on Mainnet.

Important

• It is highly recommended that you perform this step using an air-gapped machine (a device that has never connected to the public internet).
• If this is not available, turn off all internet and wireless connections (Ethernet, WiFi, Bluetooth) before proceeding.
• In both cases, ensure you’re in a safe environment with a trusted network and physically block all camera devices.
• Generate the keys using 0x01 Withdrawal Credentials with deposit amount set to 32 ETH.

Creating an air-gapped machine

1. Buy a cheap single-board computer (e.g., Raspberry Pi).
2. OS‑on‑a‑stick: Flash a USB drive with TailsOS and run from USB—no files persist after removal.

What you will need

1. Two new, empty USB drives
2. A paper notebook and pencil
3. 100% FOCUS

Download the validator keystore generation file

Wagyu Keygen

This GUI method generates keystores, deposit data, and mnemonic.

1. Download the Linux executable from wagyu.gg.
2. Copy it onto a new USB drive.

Executable binaries

Downloading the executable binary file

On your working laptop, get the latest release of the EthStaker validator key generation tool and it's corresponding sha256 checksum.

cd ~
# change the URL to the actual URL (right-click & copy link URL)
curl -LO https://github.com/ethstaker/ethstaker-deposit-cli/releases/download/v1.2.2/ethstaker_deposit-cli-b13dcb9-linux-amd64.tar.gz
# change the sha256 checksum to the actual checksum
echo "04af3f4fd2fdccf4ae060abde47637622a31114d9f2e53e62722a694a4d5b206 ethstaker_deposit-cli-b13dcb9-linux-amd64.tar.gz" | sha256sum --check

Expected output:

ethstaker_deposit-cli-b13dcb9-linux-amd64.tar.gz: OK

After verification, move the .tar.gz file onto a new USB drive.

Build from source

No action needed at this step.

Flash and install OS

1. Download latest TailsOS and verify checksums.
2. Flash a USB drive with your preferred OS using BalenaEtcher. See TailsOS on USB guide →

Boot menu keys for laptop models

• Non-Apple/Mac: consult [techofide guide] for keys.
• Apple/Mac: consult [Apple support].

3. Boot from the USB drive; you should see “Tails.”

4. Select Try or Install Tails
5. Click +, set an admin password, then Start Tails

Generate your validator signing keys

Wagyu Keygen

Wagyu Keygen

Before proceeding

1. Turn off Ethernet, WiFi, Bluetooth.
2. Physically cover all camera devices.

Load the USB drive with Wagyu Keygen to the fresh OS. Run the GUI and:

1. Create a secret recovery phrase.
2. Select network (Mainnet/Hoodi).
3. Write down and confirm the phrase.
4. Choose number of keys.
5. Encrypt keystores with a password.
6. IMPORTANT: Set withdrawal address to the Lido Withdrawal Vault in Ethereum Mainnet: 0xB9D7934878B5FB9610B3fE8A5e441e8fad7E293f
7. Confirm password.
8. Save keystores & deposit data to a USB drive.

Executable binaries

Executable binaries

Load the USB drive with the .tar.gz file to the fresh OS. Open terminal:

cd Desktop
tar xvf ethstaker_deposit-cli-b13dcb9-linux-amd64.tar.gz
cd ethstaker_deposit-cli-b13dcb9-linux-amd64

Before proceeding

1. Turn off Ethernet, WiFi, Bluetooth.
2. Cover camera devices.

Generate keys:

./deposit new-mnemonic --num_validators <number> --chain mainnet --eth1_withdrawal_address 0xB9D7934878B5FB9610B3fE8A5e441e8fad7E293f

Expected output:

Mnemonic generated—write it down on paper:

Verify by retyping phrase; you’ll see a Rhino ASCII art:

Store generated files on a new USB drive; remove OS-on-a-stick.

Build from source

Build from source

On the fresh OS, install dependencies:

sudo apt-get update -y && sudo apt-get upgrade -y
sudo apt install python3-venv python3-pip python3-virtualenv git

Create venv & clone tool:

virtualenv venv
source venv/bin/activate
pip3 install -r requirements.txt

Before proceeding

1. Turn off Ethernet, WiFi, Bluetooth.
2. Cover camera devices.

Generate keys:

python -m ethstaker_deposit new-mnemonic --num_validators <number> --chain mainnet --eth1_withdrawal_address 0xB9D7934878B5FB9610B3fE8A5e441e8fad7E293f

Import Validator Key to your Node

Dappnode

Go to Stakers → Ethereum in Dappnode UI, click Upload Keystores. Import your keystores and enter passwords. Tag them “Lido”; fee recipient set to 0x388C818CA8B9251b393131C08a736A67ccB19297.

Import guide →

EthPillar

Locate keystore path:

cat $(find /var/lib -name "keystore*.json" 2>/dev/null)

Run:

ethpillar

Select Validator Client → Generate / Import Validator Keys → Import from backup and paste path.

Stereum

In Staking tab of Stereum Launcher, drag & drop keystores, enter password, click ✓.

Sedge

To import keys in sedge, you just have to run:

sedge import-key --from `path-to-keys` -n `network` --start-validator `name-of-validator-client`

This will copy the keys from the specified path, ensure are set to the correct network, and help Sedge know how to import them based on the used client.

Eth Docker

Move keystores into ~/eth-docker/.eth/validator_keys, adjust permissions, then:

ethd keys import

Systemd

Refer to Advanced → Systemd → Method 2 for systemd instructions:

Systemd Method 2 Guide