MetaMask Removes Affected Validators Amid $1.4B Loss
A security incident has affected MetaMask's infrastructure, prompting the company to remove affected Ethereum validators from the network. The incident, which occurred on September 30, 2026, resulted in a loss of approximately 0.36 ETH, with an estimated 523,000 ether being idled by October 7, 2026.
The incident was discovered by security researcher Kaden, who found that 18 of 19 MetaMask-operated validators sent block rewards to an unexpected address, which had been funded through the Tornado Cash mixer.
MetaMask's non-custodial staking operation, which allows customers to maintain control over their withdrawal keys, has been affected by the incident. The company has stated that it has found no immediate threat to MetaMask wallets, but has taken the precaution of exiting the affected validators to prevent further potential harm.
Lido, the service that pools users' ether for staking, has stated that the last of the affected validators are expected to cease staking by October 7, 2026, with the balance not being paid out until after the exit and withdrawal process has been completed, which may take up to 45 days.