MetaMask Pulls Validators Amid Security Incident

A security incident has affected MetaMask's infrastructure, prompting the company to pull affected Ethereum validators out of the network. According to an analysis by Kaden, a security researcher, around 17,000 validators are being exited from the network, holding approximately 523,000 ether worth around $1.4 billion at current prices.

The incident is unusual because the quantified loss is tiny, with only 0.36 ETH (around $970) redirected to an unexpected address. The receiving address was funded through the Tornado Cash mixer, indicating outside access rather than a configuration error.

MetaMask has confirmed that its staking operation is non-custodial, meaning customers maintain control over their withdrawal keys and MetaMask does not manage them. This separation explains why only rewards were redirected, and the staked balance remains safe.