MetaMask Removes Thousands of Ethereum Validators Following Security Incident

MetaMask has started removing thousands of Ethereum validators after a security incident, but the company claims that customer wallets and funds were not compromised. The incident, which occurred on October 1, involved part of MetaMask's infrastructure, and the company said it was actively investigating. MetaMask has not confirmed the exact number of validators being removed, but security researcher Kaden estimated that around 17,000 validators, holding approximately 523,000 ETH, were sent towards the exit process.

The company emphasized that its staking operations are non-custodial, meaning it does not manage withdrawal keys for clients' staked assets. A compromised fee-recipient configuration can redirect block-production rewards without providing access to the underlying staked ETH. Kaden estimated that approximately 0.36 ETH in validator tips was diverted during the incident.

Lido, a separate protocol, confirmed that MetaMask Staking validators were being removed from its protocol. Lido estimated that the full process of exiting, withdrawing, and potentially re-entering staking could take up to 45 days due to the Ethereum staking-entry queue.