MetaMask security incident prompts exit of about 17,000 Ethereum validators

MetaMask said it is responding to a security incident that affected part of its infrastructure on Sept. 30, prompting the firm to begin proactively exiting validators tied to its noncustodial staking operations. The wallet provider said it is working with external partners and security advisers to investigate and remediate the issue, but has not disclosed the root cause, the systems impacted, or how initial access occurred. MetaMask added that it has identified no immediate threat to MetaMask user wallets, indicating the incident relates to staking and validator infrastructure rather than customers' self-custodial funds. In a post on X, MetaMask wrote: "We are responding to a security incident affecting part of our infrastructure. At this time, we have identified no immediate threat to MetaMask wallets. As a precaution, we are proactively exiting affected validators within our noncustodial staking operations, in coordination with clients, partners and security advisors." Lido protocol exposure and potential penalties Some of the affected validators were Ethereum validators operated via the Lido protocol. Lido said MetaMask Staking began exiting relevant validators as a precaution after an investigation into an infrastructure compromise. Lido warned that taking validators offline before exits complete could trigger downtime penalties and result in foregone rewards. Based on current estimates, the final validators are expected to complete the exit stage by the end of Oct. 7, 2026, though that does not necessarily mean the ETH will be fully withdrawn by that date. Lido said staked Ether (stETH) holders do not need to take any action. ETH associated with MetaMask Staking-operated validators is expected to flow back to the protocol gradually as validators move through exit, withdrawal, and re-entry. Lido estimated the full cycle could take up to about 45 days. It also pointed to protocol safeguards, including a diverse set of node operators and other security mechanisms, plus an ad hoc reserve fund holding more than 6,750 stETH. Large ETH transfer draws attention Separately, blockchain tracker Lookonchain reported that a wallet attributed to Ethereum co-founder Joseph Lubin moved 133,298 ETH, worth about $356 million, to a new address. It was not immediately clear whether the transfer was connected to MetaMask's incident response. Key details remain unconfirmed MetaMask has not disclosed how many validators were affected, how much ETH was involved, whether the incident stemmed from unauthorized access or a software vulnerability, or whether investigators have confirmed attacker activity. Independent researcher Kaden estimated that roughly 0.36 ETH in block-production payments was diverted after 18 of 19 MetaMask-operated validators that earned such rewards sent them to an unexpected address. Kaden also estimated that around 17,000 validators were exited, representing roughly 523,000 ETH. The researcher said it remains unclear whether an attacker could have changed all fee recipients, and noted that three validators identified as affected had not yet exited at the time of posting. Kaden added that 821 potentially impacted validators in total had yet to exit, with the reason unclear. The episode underscores the separation between wallet custody and staking infrastructure. A compromise involving validator hosting, signing systems, monitoring tools, or administrative environments does not automatically provide access to users' seed phrases, private keys, or withdrawal credentials for staked assets. With investigations ongoing, the full scope and severity of the incident remains uncertain.