MetaMask Yanks Thousands of Validators Offline Over $950 Heist

The Ethereum staking operation of MetaMask was hit by a security incident that led to the removal of approximately 17,000 validators from the network. This drastic measure came after an attacker stole a small amount of ETH - just $950 worth - from MetaMask's staking operation.

The incident occurred on September 30, 2026, when an attacker changed the fee-recipient address on about 18 out of 19 MetaMask-operated validators that earned block rewards. The thief redirected block tips to a wallet funded through Tornado Cash over a period of four and a half hours.

The attacker's haul was relatively small - just $950 worth of ETH - but the response from MetaMask was severe. The company pulled 17,000 validators, which controlled approximately 523,000 ETH, worth around $1.4 billion at current prices.