MetaMask Exits Thousands of Validators Following Security Breach

MetaMask has initiated the exit of about 17,000 validators, representing roughly 523,000 ETH, following a security incident that saw transaction-fee rewards redirected to an address linked to Tornado Cash. Onchain security researcher Kaden reported that rewards from 18 of 19 block-proposing validators were diverted, though the attacker appears to have only captured about 0.36 ETH.

The company confirmed that a portion of its infrastructure was compromised and stated that it is exiting the affected validators as a precautionary measure. MetaMask noted that its staking operation is non-custodial and that it does not hold client withdrawal keys, which should prevent unauthorized withdrawals of the underlying stake. However, the firm has not yet disclosed whether validator signing keys were exposed, leaving the potential for slashing risks unresolved.

The mass exit has caused a bottleneck in Ethereum's staking infrastructure, pushing the validator exit queue to 773,447 ETH. This represents the largest backlog since December 2025, surpassing the 476,000 ETH seen in May. Data indicates a wait time of approximately 13 days and 10 hours for exiting validators to clear the queue, followed by an additional 7.6-day withdrawal sweep delay.

Ethereum utilizes a built-in churn limit to maintain network stability, processing exits gradually at a rate of 256 ETH per epoch. Because of these network safeguards, the process for affected validators is expected to be lengthy. For stake linked to Lido, where MetaMask operates validators, the total time for exiting, withdrawing, and potentially re-entering could reach 45 days.

Kaden noted that 821 potentially affected validators have not yet exited, and it remains unclear why these remain active or if the attacker still has the ability to alter fee recipients. MetaMask has not confirmed the total number of affected validators or whether any slashing has occurred as a result of the breach.