MetaMask Security Incident: Company Experiences Ongoing Infrastructure Issue

The company has not disclosed full details about the nature of the incident, but it has emphasized that no immediate threat to MetaMask wallets has been identified, which is a positive sign for ordinary users. However, the lack of information has raised concerns in the community.

As a precautionary measure, MetaMask announced that it is moving forward with the exit of affected validators from its non-custodial staking operations, in coordination with customers and partners. The company recalled that staking operations are non-custodial in nature, meaning that the service does not manage withdrawal keys for stakes on behalf of its customers.

Lido, a decentralized liquid staking solution for Ethereum, has confirmed that MetaMask has taken steps to protect customer assets associated with the Ethereum validators it operates. These measures include the exit of ETH validators from the Lido protocol. The process of exiting the validators has already begun, with the last validators expected to exit (but not be fully retired) by October 7, 2026.

MetaMask security and the importance of non-custodial stakingOne of the key points that MetaMask is highlighting is the non-custodial nature of its staking functions. In a non-custodial system, the user maintains full control over their private keys and, by extension, their funds. This means that even if the provider's infrastructure is compromised, users' funds are not directly at risk, as long as the private keys are not exposed.

This incident is a reminder of the risks associated with participating in DeFi protocols and staking operations, even when they are non-custodial. The infrastructure supporting these operations can be the target of attacks or experience technical issues, with consequences for users. Diversifying investments and using multiple platforms can reduce this risk.

How to Protect Yourself: Tips for MetaMask UsersIn times of uncertainty like this, it is essential for MetaMask users to take proactive steps to protect their digital assets. First, make sure your seed phrase is stored securely offline and not shared with anyone. Second, enable two-factor authentication (2FA) on all connected platforms. Third, regularly monitor MetaMask's official announcements through official communication channels.