MetaMask Staking Validators Exited Amid Ongoing Security Incident
MetaMask has disclosed a security incident affecting its staking business, MetaMask Staking, formerly known as Consensys Staking. The company said it is responding to an ongoing security incident and has begun pulling Ethereum validators out of service as a precaution.
In a brief user update, MetaMask stated that no immediate threat was found to MetaMask wallets. However, the company did not provide information on what was compromised or how attackers gained access.
The incident is limited to MetaMask Staking's non-custodial staking operations, and the company stressed that it does not manage withdrawal keys for its clients' stake. This means that even if a validator's signing key is compromised, an attacker cannot move the underlying funds.
Lido, the liquid staking protocol, has set a deadline of October 7 to exit affected validators. The company expects the Ethereum validators to return to the protocol gradually as they complete the exit, withdrawal, and re-entry cycle, which can take around 45 days due to the extended entry queue.