MetaMask Security Breach Triggers Surge in Ethereum Validator Exits

A security breach involving MetaMask has led to a surge in Ethereum validator exits, pushing them to a nine-month high. According to onchain security researcher Kaden, about 17,000 MetaMask-operated validators holding roughly 523,000 ETH were proactively exited after an analysis found that transaction-fee rewards from 18 of 19 validators had been diverted to an address funded through Tornado Cash.

The attacker appears to have captured only about 0.36 ETH, but the bigger concern is how the attacker gained enough access to alter fee recipients and whether that access extended to validator signing keys, which could trigger slashable behavior.

MetaMask has not confirmed those figures or disclosed the cause of the incident, but said part of its infrastructure had been compromised and that it was exiting affected validators as a precaution while working with clients, partners, and security advisers. It also stated that its staking operation is non-custodial and that it does not control clients' withdrawal keys.