MetaMask Withdraws $1.4 Billion from Lido After Security Breach

MetaMask Staking has begun pulling its Ethereum validators out of Lido after a security incident diverted block rewards to an address linked to Tornado Cash. The stolen amount was relatively small, about 0.36 ETH, or under $1,000, but MetaMask is withdrawing roughly 523,000 ETH, worth around $1.4 billion, as a precautionary measure. The decision highlights the sensitivity around potential security risks, even if the immediate financial impact is minimal.

MetaMask announced the incident on September 30, stating that it had detected no immediate threat to user wallets but was exiting affected validators within its non-custodial staking operations. Lido confirmed the exits, describing the cause as an infrastructure compromise under investigation. The process of exiting validators is expected to complete by the end of October 7, though the full withdrawal and re-entry cycle could take up to 45 days due to Ethereum's long entry queue.

Independent researcher Kaden provided details on the theft, noting that 18 out of 19 block rewards from MetaMask validators were redirected to a Tornado-funded address. This suggests a compromise in validator configuration rather than an issue with MetaMask wallets. Neither MetaMask nor Lido has confirmed these findings, but the potential risk of validator slashing appears to be the primary concern behind the large-scale exits.

Despite the turmoil, other protocols such as Aave and Ethena reported no direct impact on their operations. Linea, a Consensys-built Layer 2 network, also announced the exit of validators supporting its Yield Boost vault but assured that funds and control remained unaffected. Joseph Lubin, founder of Consensys, emphasized that MetaMask wallets and customer funds were not compromised, though details of the incident remain undisclosed.