Metamask's Big Exit: Less Than $1,000 Stolen, 523k ETH on the Move

Metamask recently initiated an exit protocol for its validators after discovering that less than $1,000 in Ethereum block tips was diverted from 18 of its validator rewards. The incident prompted a response much larger than the apparent theft itself, with around 17,000 validators holding about 523,000 ETH being sent towards exits.

According to security researcher Kaden's onchain reconstruction, the attacker exploited the fee-recipient address, which had been funded through the ether mixing service Tornado Cash. This resulted in a total of approximately 0.36 ETH being diverted from Metamask-operated validators.

Metamask emphasized that customer funds were not affected by the incident and that wallets showed no signs of compromise. However, the company's staking operation is non-custodial, meaning it doesn't control customers' withdrawal keys. This limits an attacker's ability to access and withdraw funds directly.

Liquid staking infrastructure provider Lido estimates that the entire process of exiting, withdrawing, and rejoining through the entry queue could take up to 45 days, resulting in lost earnings for validators during this time.