MetaMask exits Ethereum validators after security incident diverts rewards

MetaMask has begun pulling its Ethereum staking validators out of service after a security incident affected part of its infrastructure, while saying it has found no immediate threat to users' wallets.

The cryptocurrency wallet provider, which also runs staking services, disclosed on Wednesday that it was exiting affected validators, the computers that help check Ethereum transactions, as a precaution. "At this time, we have identified no immediate threat to MetaMask wallets," the company said. MetaMask manages over $3 billion of staked ether through its infrastructure, according to its website, Cointelegraph reported.

Ethereum security researcher Kaden said on X that 18 of 19 MetaMask-operated validators that had earned payments for producing blocks sent those payments to an unexpected address. He estimated that about 0.36 ETH had been diverted, and that about 17,000 validators holding roughly 523,000 ETH were being withdrawn. MetaMask has not confirmed those figures or explained how its systems were compromised, CoinDesk reported.

Validators have a separate address for receiving fee payments when they produce a block, so changing it can divert income without touching where the original stake goes on withdrawal. Someone controlling those credentials could also trigger a penalty known as slashing, in which Ethereum destroys part of a validator's stake. Neither MetaMask nor Lido has reported that this happened.

Lido, which pools users' ETH for staking, said MetaMask-operated validators had begun leaving its system and that the last were expected to stop staking by 7 October. Lido Finance developer Will Shannon said the exit, withdrawal and re-entry cycle could take up to about 45 days because of the queue to enter Ethereum staking, during which affected validators would miss rewards. "No action is required from stETH holders," Lido said.

Large wallet movements also drew attention. Blockchain tracker Lookonchain reported that a wallet it linked to Ethereum cofounder Joseph Lubin moved 133,298 ETH, worth about $356 million, to a new address; it was not clear whether this was connected to the incident. Ethena also withdrew funds from lending platform Morpho as a precaution and later redeployed them, according to onchain data cited by CoinDesk.

Sources

• CoinDesk
• Cointelegraph