MetaMask Pulls Lido-Linked Ethereum Validators During Infrastructure Security Probe

MetaMask is in the process of exiting its Ethereum validators from Lido's staking setup as a precaution while a security incident affecting part of its infrastructure is investigated. The company said it has not identified any immediate risk to MetaMask wallets. It added that it is working on the issue internally alongside external partners and security advisers, while removing the affected validators tied to its noncustodial staking operations. Lido said the root cause is an infrastructure compromise that remains under investigation. It said the relevant validators have begun exiting and expects the final ones to have exited—though not fully withdrawn—by the end of October 7. Lido warned the exits will likely reduce rewards and could trigger downtime penalties if validators go offline in the coming days. Lido said the stake that exits should return to the protocol gradually through the exit, withdrawal and reentry cycle, which it estimates could take up to 45 days due to Ethereum's extended entry queue. Neither MetaMask nor Lido said whether any validators MetaMask operates outside of Lido were involved. Both firms reiterated the staking arrangement is noncustodial and that MetaMask does not hold withdrawal keys for client stake. Lido said stETH holders do not need to take any action. It also cited its diversified set of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers against disruption. Separately, researcher Kaden reported onchain findings that were not confirmed by either company. Kaden said 19 MetaMask validators had won block rewards, and that 18 of those payments were sent to an address funded via the Tornado Cash mixer rather than the intended fee recipient, totaling about 0.36 ETH, or less than $1,000 at current prices. Kaden's analysis indicates roughly 17,000 validators holding about 523,000 ETH—worth around $1.4 billion—are being exited as a precaution. The analysis also flagged 821 potentially affected validators that had not yet exited. Kaden said it remains unclear whether an attacker could change fee recipients across the full set. Kaden added the attacker likely never had the ability to withdraw staked ETH. Still, validators could theoretically be deliberately slashed, depending on how any signing access was obtained. Aave founder Stani Kulechov said Aave is monitoring developments with Lido and that Aave markets have not been affected. Ethena founder Guy Young said the collateral backing its USDe synthetic dollar currently has no direct exposure to stETH or any other liquid staking token, and he expects no impact. The incident follows a separate case involving validator operator Kiln, which exited all its Ethereum validators in September 2025 after identifying what its chief executive described as a potential infrastructure compromise. MetaMask and Lido have not disclosed what was compromised, how it occurred, or who may be responsible. Both said an investigation is ongoing and that additional updates will be provided.