MetaMask updates September security incident, about 0.385 ETH in staking rewards was transferred
MetaMask said in a security incident update released on November 5 that on September 28 some of its infrastructure was accessed without authorization, and that an attacker transferred about 0.385 ETH in staking rewards by modifying the reward receiving addresses of some Ethereum validators.
MetaMask said the relevant issue was fixed that day, and all affected Ethereum validators have now exited. The incident caused temporary delays in withdrawals for some customers and may have caused staking reward losses. The company stressed that there is currently no evidence that users’ wallets, private keys, or customers’ staked principal were leaked or withdrawn without authorization. Rewards are separated from customers’ staked principal, and MetaMask does not control withdrawal keys.
Original source:
Title: MetaMask user update on recent security incident Publisher: MetaMask Publication date: November 5, 2026 URL: https://metamask.com/news/user-update Nature of source: official company announcement Verification status: full original text read; core facts (unauthorized access on September 28, modification of reward receiving addresses for some validators, transfer of about 0.385 ETH in rewards, fix made the same day, all affected validators exited, delays in some customer withdrawals and possible reward losses, no evidence that wallets/private keys/staked principal were leaked or withdrawn without authorization) all directly correspond to the original wording Supporting content: security incident details, scope of impact, and response measures
ABAB AI Insight
The attack surface was the operational infrastructure storing reward receiving addresses, rather than user wallets or withdrawal keys. The amount of rewards transferred was limited, but it triggered a precautionary validator exit, leading to delays in some customer withdrawals and potential interruption of rewards.
The non-custodial architecture separates the flow of staked principal and rewards. MetaMask clearly does not control the withdrawal keys for customers’ staked ETH, which limits the direct impact of unauthorized access on principal.
From incident detection to completion of all validator exits, several weeks passed. The exit process itself takes time at the Ethereum protocol level, during which validators cannot continue to earn rewards.
Changing addresses at the operational layer can alter the flow of execution-layer rewards, while principal protection depends on key separation. In this incident, the asymmetry between the accounting loss and the subsequent operational response costs is reflected in the liquidity and reward impact caused by the precautionary exits.
ABAB News · Cognitive Law
Reward receiving addresses are stored in centralized infrastructure, allowing even limited unauthorized access to change the flow.
In a non-custodial design, withdrawal keys are separated from operational keys, limiting the path by which principal can be transferred directly.