MetaMask is removing affected Ethereum validators from service following a security incident involving part of its staking infrastructure, while Lido warned that the precautionary exits could result in lost staking rewards. MetaMask said it had identified no immediate threat to its wallets and exited the affected validators as a precaution.
Ethereum security researcher Kaden reported that 18 of 19 MetaMask-operated validators that had received payments for producing blocks sent those payments to an unexpected address. Kaden estimated that approximately 0.36 ETH had been diverted.
The researcher also estimated that roughly 17,000 validators holding about 523,000 ETH were being exited as a precaution. MetaMask had not confirmed those figures or disclosed how the infrastructure was compromised as of the Thursday timeframe covered by the report.
The incident highlights a distinction between the security of staked ETH and the separate payment destination used by Ethereum validators. Validators receive transaction-fee payments when they produce blocks, and that destination can be changed independently from the address controlling the underlying staked ETH.
As a result, an attacker who gains control of the relevant credentials could potentially redirect validator income without necessarily gaining control of the original stake. A separate risk exists if those credentials allow a validator to approve conflicting records, which can trigger slashing and cause part of the staked ETH to be destroyed. Neither MetaMask nor Lido reported that slashing had occurred.
For users, the immediate financial impact described in the report is therefore centered on staking income rather than reported loss of the underlying ETH. MetaMask said there was no immediate threat to its wallets, while Lido said no action was required from stETH holders.
The precautionary exits nevertheless create an operational cost. Lido said MetaMask-operated validators had begun leaving its system, with the final validators expected to exit by Oct. 7. Once exited, the ETH would not necessarily be immediately available for restaking because Ethereum's entry queue could take approximately 45 days.
During that period, affected validators would no longer generate normal staking rewards and could also face penalties associated with being taken offline before completing the required exit process. The incident therefore demonstrates how an infrastructure-level security event can affect staking economics even when the underlying customer assets remain protected.
The key issue for the market is now the scope and mechanism of the compromise. MetaMask's confirmation of the affected infrastructure, the final number of validators involved and any explanation of how the payment credentials were exposed will determine how broadly the incident needs to be viewed.
For Ethereum staking users, the distinction between validator operating infrastructure, withdrawal control and block-payment destinations will remain particularly important. The immediate evidence in the report points to diverted validator rewards and precautionary exits, while no reported slashing or direct wallet compromise has been identified.
