MetaMask disclosed a security incident on October 1, affecting part of its staking infrastructure and triggering a large-scale precautionary exit of Ethereum validators. The company said it h
MetaMask disclosed a security incident on October 1, affecting part of its staking infrastructure and triggering a large-scale precautionary exit of Ethereum validators. The company said it had found no indication that customer wallets or funds were compromised.
MetaMask said it is responding to what it described as an "ongoing security incident" impacting part of its infrastructure.As a precautionary measure, MetaMask said it is proactively exiting affected validators within its non-custodial staking operations, in coordination with clients and partners.The company stressed that its staking operations are non-custodial in nature, and that it does not manage withdrawal keys for stake on behalf of its clients.
The incident sits with MetaMask Staking, the business formerly known as Consensys Staking, which runs validators for clients and for the liquid staking protocol Lido. Security researcher Kaden estimated that around 17,000 validators holding roughly 523,000 $ETH were sent toward exits. At prices on October 1, that would be worth something in the order of $1.4 billion.MetaMask had neither confirmed nor denied those figures as of the afternoon of October 1.
The quantified loss reported stands at 0.36 $ETH in diverted validator tips during the incident, a relatively contained figure given the scale of the exit. An attacker who controls only the fee recipient can take rewards but cannot redirect the stake itself, which is why MetaMask says wallets face no immediate threat and why the reported loss has stayed small.
Lido, a decentralized liquid staking solution for Ethereum, confirmed that MetaMask has taken steps to protect client assets related to its operated validators, including exiting its $ETH validators from the Lido protocol, which will likely incur foregone rewards and possible downtime penalties.Relevant validators have begun the exit process, with the final validators expected to be exited, though not fully withdrawn, by the end of October 7, 2026.
ETH will be returned to the protocol over approximately 45 days, and stETH holders need take no action.MetaMask has not disclosed which systems were affected or whether data was compromised.MetaMask and Lido said their investigation is ongoing and that additional updates will be provided when more information is available, with the main outstanding questions concerning which part of MetaMask's infrastructure was compromised and whether the incident extended beyond the systems supporting its staking operation.
Sources:The Hacker News: MetaMask Security Incident Prompts Exit of Affected Ethereum ValidatorsCrypto Times: MetaMask Says Wallets Are Safe After a Staking Issue Forced an Exit From Lido ValidatorsCryptoPotato: MetaMask Confirms Security Incident and Begins Validator Exits to Protect Client Assets
