MetaMask Pulls Out Affected Validators Amid Security Incident
MetaMask has confirmed a security incident in its infrastructure, affecting part of its Ethereum staking operation. The incident led to a tiny loss of 0.36 ETH, but the company is pulling out the affected validators as a precautionary measure. The affected validators, estimated to be around 17,000, hold approximately 523,000 ether, worth around $1.4 billion at current prices.
The security incident was discovered on September 30, 2026, and MetaMask is working with external partners and security advisers to address the issue. The company has assured that no immediate threat to MetaMask wallets exists, but users who have staked Ethereum through MetaMask-operated validators should be aware that their stake will earn nothing for the coming weeks.
The incident highlights the imbalance between the reward and the stake in Ethereum staking, which allows an attacker to control the fee recipient and redirect rewards without touching the stake. The withdrawal key, which determines where the validator pays out its balance when it leaves the network, remains with the customer.
Lido, the service that pools users' ether for staking, has confirmed that the affected validators will exit the system by October 7, 2026. The balance will not be paid out on that date, and the affected stake will earn nothing until the issue is resolved. The network's queue, which is currently long, is the reason for the delay in resolving the issue.