MetaMask, one of the leading cryptocurrency wallets, recorded a security incident on September 30, which reportedly forced it to exit a large number of Ethereum (ETH) validators.
The company said it is investigating and remediating the incident with assistance from external partners and security advisers, although it did not disclose the precise nature of the issue, the systems involved, or the initial access method.
However, MetaMask stressed that it has found no immediate threat to user wallets. In other words, the incident appears to have involved infrastructure supporting its staking operations rather than customers’ self-custodial wallets.
“We are responding to a security incident affecting part of our infrastructure. At this time, we have identified no immediate threat to MetaMask wallets. As a precaution, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients, partners and security advisors,” MetaMask wrote on X.
Security Update: We are responding to a security incident affecting part of our infrastructure.
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…
— MetaMask 🦊 (@MetaMask) September 30, 2026
MetaMask said it is proactively exiting affected validators in coordination with clients and partners to reduce operational and network-level risks while the investigation continues.
MetaMask validator incident could have financial consequences
The affected validators include Ethereum validators operated through the Lido protocol, which first said that MetaMask Staking began exiting the relevant validators as a precaution following an investigation into an infrastructure compromise.
According to an update posted by Lido, the move could lead to downtime penalties if validators are taken offline before completing the exit process. Based on the current estimates, the final validators are expected to complete the exit stage by the end of October 7, 2026. However, the process will not necessarily mean the ETH has been fully withdrawn by that date.
“These steps include exiting its Ethereum (ETH) validators in the Lido protocol, and will likely incur foregone rewards as well as possible downtime penalties should validators be taken offline in the near future to reduce risks related to potential network penalties. Relevant validators have begun the exit process, with the final validators expected to be exited (but not fully withdrawn) by the end of October 7th, 2026,” Lido wrote.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
These steps include exiting its Ethereum (ETH) validators in the Lido… https://t.co/nsox7h0I5k
— Lido (@LidoFinance) September 30, 2026
Lido said no action is required from staked Ethereum (stETH) holders, and that ETH associated with MetaMask Staking-operated validators is expected to return to the protocol gradually as the validators move through the exit, withdrawal, and re-entry process. The full cycle could take up to approximately 45 days.
In addition, Lido ensured its diverse network of node operators and other security mechanisms are designed to help contain disruptions to the normal operations on the protocol. These measures include an ad hoc reserve fund containing more than 6,750 stETH.
Large Ethereum transfers amid the incident
A separate large wallet transfer also drew attention following the disclosure. For example, blockchain tracker Lookonchain reported that a wallet attributed to Ethereum co-founder Joseph Lubin transferred 133,298 ETH, worth approximately $356 million, to a new address. However, it was not immediately clear whether the transaction was related to MetaMask’s security response.
Several other details remain unknown, too. Namely, MetaMask itself has not disclosed how many validators were affected exactly, how much ETH was involved, whether the incident resulted from unauthorized access or a software vulnerability, or whether investigators have identified attacker activity.
Independent researcher Kaden also estimated that around 0.36 ETH in block-production payments had been diverted after 18 of 19 MetaMask-operated validators that earned such rewards sent them to an unexpected address.
Data presented by Kaden suggests that about 17,000 validators were exited, representing roughly 523,000 ETH. Nonetheless, Kaden made clear that it is still unknown whether the attacker had the ability to change all fee recipients. Likewise, the data suggested that three validators identified by Kaden as affected had not yet exited for unknown reasons at the time of posting.
“17k validators proactively exited, 523k eth total, unknown whether the attacker had the ability to change all fee recipients. It appears that 3 of the exploited validators have not yet been exited, and that 821 potentially impacted validators in total have yet to exit, unclear why,” Kaden wrote.
after some onchain sleuthing, i think this is what happened:
19 metamask validators had won block rewards, and 18 of the rewards were not paid to the correct fee recipient but instead to this tornado funded account: 0x98B9231de84334c1d48BA0b72CF13f92484924A3
~17k validators… https://t.co/qAlfkVNUW1
— kaden.eth (@0xKaden) October 1, 2026
Overall, the incident highlights the distinction between wallet custody and staking infrastructure. That is, a compromise such as this, involving validator hosting, signing infrastructure, monitoring systems, or administrative environments, does not automatically give an attacker access to users’ seed phrases, private keys, or withdrawal credentials for staked assets.
But, with full investigation pending, the reality (and severity) of the situation is still not clear.
Featured image via Shutterstock