MetaMask Exits Affected Ethereum Validators After Infrastructure Security Incident

MetaMask is exiting its affected Ethereum validators operated through its non-custodial staking business after an infrastructure security incident. The incident affects validators operated through Lido, with the final validators expected to exit by October 7, 2026. The complete exit, withdrawal, and re-entry cycle could take up to approximately 45 days.

Lido has disclosed the incident in a governance forum post, stating that MetaMask Staking (formerly ConsenSys Staking) began exiting its Ethereum validators after investigating an infrastructure compromise. MetaMask signs for the validators it operates, but does not manage clients' withdrawal keys, so the operator cannot move the underlying stake on their behalf.

According to Lido, no action is required from stETH holders. However, affected validators may forgo rewards, and taking them offline before they complete the exit could bring downtime penalties if done to reduce network-penalty risks.

The incident adds to the operational risks facing crypto infrastructure, where a security problem at a service provider can trigger disruption even without a disclosed protocol exploit.

The number of affected validators and the quantity of ETH involved have not been made public as of now. Lido has a diverse node-operator set and security systems in place to contain disruptions, including an ad hoc reserve fund holding more than 6,750 stETH.

There are precedents for precautionary exits, with staking provider Kiln exiting 5,726 validators across networks after a compromised GitHub token enabled an attacker to access its infrastructure; Lido later estimated that the exits cost about 207 ETH in missed protocol rewards.