MetaMask has reiterated that its investigation has uncovered no indications that user wallets or customer funds faced imminent threats, according to a security update released as the newly independent company enters its second day managing the incident.
The platform confirmed it remains focused on containment and verification efforts. As of October 1, MetaMask found no evidence that customer funds had been accessed based on its investigations to date.
MetaMask's staking operations are non-custodial, meaning the company does not hold withdrawal keys for the staking it manages on behalf of clients.
Validator Removal From Lido
MetaMask Staking, which operates validators within Lido, the largest Ethereum liquid staking protocol, has begun removing validators from the platform as a precautionary measure. Affected validators are already in the exit queue, with the last expected to be offline by October 7, though full withdrawal will take longer.
Returning withdrawn Ethereum to validator positions will require at least 27 days and 18 hours due to the Ethereum validator queue, according to protocol timelines.
Lido confirmed in a governance forum post that no action is required from stETH holders.
First Test as Independent Company
The incident arrives as MetaMask operates independently following a September 9 announcement splitting the business into consumer wallet operations and Consensys, the protocols and institutional division. The separation is scheduled to finalize by year's end.
MetaMask has positioned itself as the world's largest self-custodial financial platform, with more than 100 million downloads across roughly 190 countries and trillions of dollars in cumulative transaction volume.
MetaMask has not disclosed whether validators it operates outside Lido are affected by the current incident. Neither MetaMask nor Lido has detailed the nature of the security compromise, though the company stated it will share verified information as it becomes available.
The platform urged users to avoid sharing Secret Recovery Phrases or private keys with anyone and to disregard communications that do not originate from official MetaMask channels.
