MetaMask Nukes 17,000 Validators After $950 Heist

MetaMask, a leading Ethereum staking provider, has temporarily removed over 17,000 validators from the Ethereum network after a suspected security breach. The incident occurred on September 30, 2026, when an attacker stole a mere 0.36 ETH, worth around $950, from MetaMask's Ethereum staking operation.

The attack was characterized by the attacker changing the fee-recipient address on 18 of 19 MetaMask-operated validators, redirecting block tips to a wallet funded through Tornado Cash. However, the total haul was relatively small, and no validator stake was taken.

Despite the minimal damage, MetaMask chose to take a precautionary measure and remove the validators, potentially affecting over $1.4 billion in ETH. This drastic response was likely due to the fear of compromised signing keys, which cannot be rotated and require the validators to be exited and restarted with new keys.

The incident has caused a bottleneck in Ethereum's staking queue, with the withdrawal queue increasing from 200,000 ETH to over 700,000 ETH in a single day, pushing wait times from three and a half days to nearly two weeks.