MetaMask, the cryptocurrency wallet operated by Consensys, is pulling its Ethereum staking infrastructure out of service after disclosing an ongoing security incident affecting part of its backend systems, with the last of its Lido-operated validators expected to stop staking by October 7.
The company disclosed the incident on September 30 and said it began exiting affected validators as a precaution. "At this time, we have identified no immediate threat to MetaMask wallets," MetaMask said. It has not yet published an explanation of how its systems were compromised.
What the on-chain record shows
Ethereum security researcher Kaden reported that 18 of 19 MetaMask-operated validators that earned payments for producing blocks had those payments sent to an unexpected address — an estimated 0.36 ETH in diverted block rewards, a small sum that nonetheless signals access to validator credentials. His analysis, not confirmed by MetaMask, puts the precautionary exits at roughly 17,000 validators holding about 523,000 ETH.
The mechanics matter: Ethereum sets a validator's fee-recipient address separately from its withdrawal credentials. Someone able to change the fee recipient can divert income without redirecting the underlying stake — which is consistent with a narrow credential compromise rather than a drain of staked funds. The same level of access, however, could in principle be used to sign conflicting attestations and trigger slashing, a punishment in which the network destroys part of the stake. Neither MetaMask nor Lido has reported that slashing occurred.
Lido's warning: up to 45 days out of service
Lido, whose pooled staking protocol hosted the MetaMask-operated validators, disclosed the out-of-order exits in its own security forum. The affected validators will miss rewards while out of service, and re-entering Ethereum's staking queue could take up to roughly 45 days after withdrawal. "No action is required from stETH holders," Lido said, as Decrypt reported.
The precautionary shutdown carries a real cost in lost staking income even if no staked coins were touched — a trade-off MetaMask appears to have accepted to remove the compromised credentials from service.
Contagion signals across DeFi
The disclosure rippled through adjacent protocols. Ethena, the issuer of the USDe dollar-linked token, withdrew about $135 million from lending platform Morpho as a precaution — roughly $75 million from a vault holding Ripple's RLUSD stablecoin and $60 million from one holding PayPal's PYUSD — and redeployed the funds after receiving clarity on the situation, according to on-chain data cited by CoinDesk.
Blockchain tracker Lookonchain separately reported that a wallet it linked to Ethereum co-founder Joseph Lubin moved 133,298 ETH, worth about $356 million, to a new address. It was not immediately clear whether the movement was connected to MetaMask's response.
The incident is a reminder that wallet and staking security is only as strong as the operational infrastructure around it. MetaMask has not confirmed the validator counts, identified the attacker, or detailed the intrusion path; a fuller account is expected as the response continues.
TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.