MetaMask Investigates Infrastructure Security Incident

MetaMask stated that it is addressing a security incident affecting some infrastructure and has found no immediate threat to wallets at this time.

The official statement indicates that the company is working with external partners and security consultants to manage and repair the affected systems. As a precaution, MetaMask has proactively withdrawn affected validators from its non-custodial staking operations and is coordinating with customers and partners. The staking operations are emphasized as non-custodial: the company does not manage withdrawal keys for customers, thus cannot directly control the withdrawal of staked assets.

The announcement did not provide details on the attack method, names of affected systems, number of validators, or figures for financial losses. The product page refers to the entity as "former Consensys Software Inc.", covering self-custodial wallets in about 190 countries; in September, the company announced that it would brand its consumer-facing product as MetaMask, while the protocol and institutional business would be separated into a new Consensys, with a split target set for the end of 2026. During the same period, the status page also noted interruptions in Money Account registrations and issues with stablecoin deposits and withdrawals, which are not part of this security announcement.

User-side risks are divided into two layers: the private keys of browser/mobile wallets remain local; the infrastructure being addressed involves staking validators. Aave's founder publicly stated that he is closely monitoring this staking-related incident and mentioned that the Aave market has not been affected. There have been isolated complaints on social media about "wallets being emptied", but the official stance maintains that no direct threat to wallets has been found, nor has large-scale theft been confirmed.

From March to April this year, a contractor linked to North Korea, accessed through a third-party vendor, entered the core code of MetaMask for about a month, primarily interacting with fiat deposit and withdrawal components; the company then cut off access, paused releases, and stated that no malicious code was found online or user assets stolen. This new announcement does not equate it with that supply chain incident.

In market mechanisms, the seller is MetaMask and its staking operations stack, while the buyer is users and institutions that hand over assets like ETH to its non-custodial staking routes. The incident was triggered by infrastructure alerts, not by mass cracking of wallet private keys. Funds may temporarily shift from MetaMask staking and related DeFi entry points to self-built validators, Lido, Coinbase, and other alternative paths; those benefiting are still able to prove they do not hold withdrawal keys, while the trust in validator operations and the brand security reputation post-split is under pressure.

Source: Public Information