MetaMask disclosed that a security incident occurred in part of its infrastructure, proactively exiting affected Ethereum validators from its non-custodial staking business, stating that no direct threat to MetaMask wallets has been found.

On-chain analyst Kaden noted that 19 MetaMask-operated validators received block rewards, with 18 transaction fees not sent to the correct receiving address but instead directed to an address funded by Tornado Cash; he estimated that approximately 0.36 ETH in rewards were misappropriated. Additionally, he identified that the anomalous block production occurred between 12:12 and 16:46 UTC on September 30, with funding timestamps recorded at 10:27. MetaMask has not confirmed the number of validators nor disclosed how the system was compromised.

Kaden estimated that the proactive exit involves about 17,000 validators, totaling approximately 523,000 ETH, and stated it is unclear whether the attackers can change all fee receiving addresses. He also mentioned that three suspected affected validators have not yet exited, and about 821 potential affected validators remain in the system for unknown reasons. The company stated it is coordinating the exit with customers, partners, and security advisors.

Lido governance posts indicated that MetaMask Staking (formerly Consensys Staking) has begun exiting its validators in Lido, with the last batch expected to complete the exit by October 7, but not all have withdrawn yet; stETH holders do not need to take action. The exit and withdrawal re-entry cycle can take up to 45 days due to a lengthy queue; if validators go offline early to reduce penalty risks, they may incur downtime penalties.

The fee receiving address and staking withdrawal address are set separately on Ethereum. The former can only transfer block income and cannot reroute the staked principal; Kaden assessed that the attackers likely do not have the ability to withdraw staked ETH. If they gain signature permissions, they could theoretically allow validators to sign conflicting records, triggering penalties, which would lead to the destruction of part of the stake and removal from service. Ethereum cannot rotate signature keys in place; it can only exit, withdraw, and restake with new keys.

From a market mechanism perspective, this is an event-driven operational risk mitigation, not a spot trading action. What is sold is the still-online signature environment, and what is bought is the re-entry qualification under new keys; the capital flow involves approximately 523,000 ETH leaving validation and then returning to Lido after a maximum of about 45 days. The beneficiaries are the operators who have removed the signature surface, while the pressure is on stETH holders who receive fewer rewards during this window and the block income that has been rerouted. In September 2025, Kiln exited Lido validators due to similar risks, missing out on rewards of approximately 207.312 ETH, affecting 5726 validators.

Source: Public Information