MetaMask began exiting affected Ethereum validators on September 30 after identifying a security incident within its infrastructure. The wallet provider said the incident affected part of its systems but posed no immediate threat to MetaMask wallets. The company said it is investigating the incident with external partners and security advisers. MetaMask has not identified the affected systems or explained how attackers accessed its infrastructure.
MetaMask has not confirmed the number of affected validators or the amount of ETH connected to them. The company said its staking service does not control withdrawal keys for clients’ staked ETH. The company also said it began exiting affected validators to reduce potential risks during its investigation.
Ethereum security researcher Kaden reported that several MetaMask validators redirected their block-production payments. Kaden said 18 of 19 MetaMask-operated validators sent those payments to an unexpected wallet. He estimated that the redirected payments totalled about 0.36 ETH. MetaMask has not confirmed the figure or explained the reported payment movements.
Kaden also estimated that MetaMask could exit about 17,000 validators holding roughly 523,000 ETH. MetaMask has not confirmed that estimate or disclosed the total ETH connected to the incident. The company has also not reported any theft of customers’ staked ETH.
Ethereum Validator Exits Could Keep Staked ETH Out of Service for Weeks
Lido said the wallet provider has started exiting validators that operate within Lido’s Ethereum staking system. Lido expects MetaMask to complete the final validator exits by October 7. However, an Ethereum validator exit does not immediately return its underlying ETH to the owner. Ethereum processes validator exits through a queue before removing validators from active staking.
Lido warned that operators could face downtime penalties if they take affected validators offline before completing their exits. The staking provider also warned that the exits could cause lost rewards and possible downtime penalties. Neither Lido nor MetaMask has reported any validator slashing linked to the incident.
Questions Remain Over the Scope of the MetaMask Infrastructure Breach
The crypto wallet provider has not identified the compromised infrastructure component or explained how attackers accessed it. The number of affected validators alone cannot establish the total ETH exposure. Ethereum validators can hold different balances, so a validator count cannot determine the total ETH involved. MetaMask has not confirmed whether the reported 17,000 validators share the same operational setup. It also has not confirmed whether the reported 523,000 ETH represents the full amount connected to the affected validators.
Lookonchain separately reported that a wallet linked to Ethereum co-founder Joseph Lubin transferred 133,298 ETH worth about $356 million. No evidence currently links that transaction to the crypto wallet issuer’s security incident. Ethena also withdrew funds from Morpho as a precaution after the security disclosure. The company later redeployed those funds after receiving more information about the incident.
