MetaMask Security Incident Triggers Ethereum Staking Exits

Key Takeaways

• MetaMask began exiting Ethereum validators as a precaution after a security incident diverted an estimated 0.36 ETH in block-production payments.
• A researcher estimated that about 17,000 validators holding roughly 523,000 ETH were being withdrawn, but MetaMask said it found no immediate threat to users’ wallets and has not confirmed the figures.
• Lido expected the exit-and-re-entry cycle to take up to about 45 days, and no action is required from stETH holders.

MetaMask has begun exiting affected Ethereum validators after a security incident involving part of its infrastructure, while Lido warned that the precautionary withdrawals could cause missed staking rewards and possible downtime penalties.

In a September 30 update, the cryptocurrency wallet provider said it was investigating the incident with external partners and security advisers. It also said it has exited affected validators, or the computers that help check Ethereum transactions, as a precaution.

“At this time, we have identified no immediate threat to MetaMask wallets,” MetaMask said.

— MetaMask (@MetaMask) Oct 1, 2026

The incident affects its noncustodial staking operations. MetaMask said it does not manage clients’ withdrawal keys, which control where they can withdraw their staked ETH.

Reward Diversion Reported

Ethereum security researcher Kaden said on X that about 0.36 ETH in block-production payments had been diverted to an unexpected address. He also found that 18 of 19 MetaMask-operated validators that had earned payments for producing blocks sent those payments to an unexpected address.

Kaden also estimated that the precautionary exits involved roughly 17,000 validators holding about 523,000 ETH. However, MetaMask has not confirmed these figures, nor has the company explained how its infrastructure was compromised.

The 523,000 ETH figure describes stake associated with the reported exits. It does not represent an amount reported stolen.

Ethereum validators help verify transactions and secure the network. Their block-production payment destination is separate from the destination for withdrawing the original stake. This means the diverted income does not, by itself, establish that the underlying ETH was taken.

Lido Warns of Lost Rewards

Lido, a service that pools users’ ETH for staking, said that MetaMask-operated validators had begun exiting its system.

The final affected validators are expected to stop staking by October 7, 2026. The deadline does not mean all associated ETH will have been withdrawn by then.

Lido estimates that withdrawing the coins and putting them back into staking could take up to approximately 45 days because of Ethereum’s extended staking entry queue.

The affected validators would miss rewards while out of service. They could also incur downtime penalties if taken offline before completing their exits.

“No action is required from stETH holders,” Lido said.

It also pointed to its diverse node operators and a reserve exceeding 6,750 stETH as safeguards intended to help contain and mitigate operational disruptions.

Neither MetaMask nor Lido had reported a slashing event, CoinDesk reported.

Slashing is an Ethereum penalty that destroys part of a validator’s stake for certain violations. The investigation remains ongoing.

Get started on WEEX with a simple 40 USDT reward. Deposit 100 USDT, make your trade, and claim the bonus. 

Disclaimer: All content on The Moon Show is for informational and educational purposes only. The opinions expressed do not constitute financial advice or recommendations to buy, sell, or trade cryptocurrencies. Trading involves significant risk and may result in substantial losses. Always seek independent financial advice before making investment decisions. The Moon Show is not responsible for any financial losses or decisions made based on the information provided.

Please view the full disclaimer at: https://themoonshow.com/disclaimer