MetaMask began withdrawing affected Ethereum validators following a security incident that diverted an estimated 0.36 ETH in block-production payments. The company stated it found no immediate threat to users' wallets.
According to Ethereum security researcher Kaden, 18 of 19 MetaMask-operated validators that earned block rewards sent those payments to an unexpected address. Kaden's analysis estimated that roughly 17,000 validators holding approximately 523,000 ETH were being withdrawn as a precaution, though MetaMask has not confirmed these figures or disclosed how its systems were compromised.
Staking allows ETH holders to earn rewards by committing their coins to help secure the Ethereum network. Wallet providers like MetaMask operate the validator computers that perform this work, while customers retain separate control over withdrawal addresses for their staked coins.
Validators have a separate address for receiving transaction-fee payments when producing blocks. An attacker with access to these credentials could redirect income without affecting where the original stake goes upon withdrawal.
Impact on Rewards and Timeline
Lido, which pools users' ETH for staking, reported that MetaMask-operated validators began exiting its system early Wednesday, with the final exits expected by October 7. Withdrawing coins and re-entering staking could take up to approximately 45 days due to queuing in Ethereum's staking system.
During this period, affected validators would miss rewards and could face penalties if taken offline before completing exits. Lido stated that no action is required from stETH token holders, whose tokens represent pooled stakes and accumulated rewards.
Neither MetaMask nor Lido reported that validators were slashed, the Ethereum protocol's punishment for approving conflicting records, which destroys a portion of stake and removes validators from service.
