SKN | MetaMask Security Incident Triggers Ethereum Staking Exits, but Staked Funds Remain Secure

Key Points:

• MetaMask is exiting affected Ethereum validators after a security incident diverted an estimated 0.36 ETH in block-production payments.
• A researcher estimated that roughly 17,000 validators holding about 523,000 ETH were subject to precautionary exits, although MetaMask has not confirmed those figures.
• Lido warned that exiting and re-entering Ethereum staking could take up to 45 days, creating lost-reward costs even though no immediate threat to user wallets has been identified.

MetaMask has begun removing affected Ethereum validators from staking operations following a security incident that appears to have redirected a small amount of block-production income to an unexpected address. The incident has not been reported as a loss of customers’ staked ETH, but the precautionary response highlights the operational and infrastructure risks surrounding institutional-scale Ethereum staking.

Small Reward Diversion, Large Validator Response

Ethereum security researcher Kaden reported that 18 of 19 MetaMask-operated validators that earned payments for producing blocks sent those payments to an unexpected wallet. Kaden estimated that approximately 0.36 ETH in rewards had been diverted. MetaMask confirmed that part of its infrastructure was affected but said it had identified no immediate threat to MetaMask wallets.

The distinction between staking principal and validator rewards is important. Ethereum uses separate addresses for staked assets and transaction-fee payments generated when a validator proposes a block. As a result, compromising credentials associated with the payment destination can redirect income without necessarily providing access to the underlying stake.

523,000 ETH Potentially Covered by Exits

The scale of the precautionary response is considerably larger than the reported financial loss. Kaden estimated that roughly 17,000 validators holding about 523,000 ETH were being exited. MetaMask had not confirmed those figures or disclosed how its infrastructure was compromised as of the time of CoinDesk’s report.

The affected ETH therefore represents a substantial amount of staking infrastructure temporarily being taken offline, rather than a reported theft of that amount. MetaMask’s non-custodial staking model also means customers retain separate control over where their staked coins can ultimately be withdrawn.

Another risk is slashing. If an attacker controlled validator credentials sufficiently to make conflicting records, Ethereum could destroy part of the associated stake and remove the validator from service. Neither MetaMask nor Lido reported that slashing had occurred in connection with the incident.

Lido Warns of Lost Rewards During Re-entry

The immediate economic consequence is therefore primarily related to staking rewards. Lido said MetaMask-operated validators had begun leaving its system, with the final validators expected to stop staking by Oct. 7. Returning the ETH to active staking could take approximately 45 days because of Ethereum’s queue for entering the validator set.

During that period, affected validators can miss staking rewards and may incur penalties if taken offline before completing their exits. Lido emphasized that stETH holders do not need to take action, because stETH represents pooled ETH staking positions and accumulated rewards.

Broader Crypto Infrastructure Comes Under Scrutiny

The incident also prompted precautionary movements elsewhere. Lookonchain reported that a wallet linked to Ethereum co-founder Joseph Lubin transferred 133,298 ETH worth approximately $356 million to a new address, although CoinDesk reported that it was unclear whether the transfer was connected to MetaMask’s response.

Ethena also temporarily withdrew approximately $75 million from an RLUSD vault and $60 million from a PYUSD vault at Morpho. A source close to Ethena described the withdrawals as precautionary, with onchain data showing the funds were subsequently redeployed after the company received additional clarity.

For Ethereum investors and institutions, the episode illustrates how a relatively small security event can generate a much larger operational response when significant amounts of capital depend on shared infrastructure. The next focus will be MetaMask’s explanation of the compromise, the completion of validator exits and the eventual return of affected ETH to staking. The incident also reinforces the importance of separating custody risk, validator-operator risk and smart-contract risk when evaluating Ethereum’s expanding staking ecosystem.