MetaMask Initiates Validator Exits Following Security Incident

MetaMask has begun exiting Ethereum validators from its staking infrastructure following a security incident that resulted in the diversion of block-production payments. The company stated that it has identified no immediate threat to user wallets.

Ethereum security researcher Kaden reported on X that 18 out of 19 MetaMask-operated validators sent block-production payments to an unauthorized address. Kaden estimated that approximately 0.36 ETH was diverted in the incident. While MetaMask has not confirmed specific figures, Kaden’s analysis suggests that roughly 17,000 validators, holding about 523,000 ETH, are being withdrawn as a precautionary measure.

Lido, which pools user ETH for staking, confirmed that MetaMask-operated validators have begun leaving its system. The process is expected to conclude by Oct. 7. Lido noted that stETH holders do not need to take action, though affected validators may miss out on rewards during the exit and re-entry process, which could take up to 45 days due to the Ethereum staking queue.

The incident involves the destination addresses used for receiving transaction-fee payments when a validator produces a block. Changing these credentials allows for the diversion of income without impacting the underlying staked assets. Neither MetaMask nor Lido has reported any instances of slashing, which occurs if a validator approves conflicting records.

Following the disclosure, other market movements were observed. Lookonchain reported that a wallet linked to Ethereum cofounder Joseph Lubin moved 133,298 ETH, valued at approximately $356 million, to a new address. It remains unclear if this transfer is related to the MetaMask incident.

Additionally, Ethena withdrew funds from the lending platform Morpho as a precaution, including $75 million from a vault holding Ripple’s RLUSD and $60 million from a vault holding PayPal’s PYUSD. On-chain data indicates that Ethena has since redeployed these funds.