MetaMask Security Incident: Staking Validators Exited

MetaMask disclosed on 30 September 2026 that it is responding to an ongoing security incident affecting part of its infrastructure, and that its staking business has begun pulling Ethereum validators out of service as a precaution. In a brief user update, the company said it has found no immediate threat to MetaMask wallets. It has not said what was compromised, how attackers got in, or when the intrusion was discovered.

The incident sits with MetaMask Staking, the business formerly known as Consensys Staking. It runs validators, the machines that propose and vote on Ethereum blocks, for clients and for the liquid staking protocol Lido. MetaMask said it is exiting affected validators in its non-custodial staking operations in coordination with clients and partners, and is working with external partners and security advisors to remediate the issue.

MetaMask stressed that it does not manage withdrawal keys for its clients’ stake. An Ethereum validator relies on two kinds of credentials. A signing key is used day-to-day to vote on blocks, and withdrawal credentials control where the staked ETH ultimately goes. Because clients keep the withdrawal side, an operator’s compromise should not, by itself, allow an attacker to move the underlying funds.

Signing keys carry their own risk. A validator caught signing conflicting messages can be slashed, meaning the network destroys part of its stake and forcibly removes it. Exiting validators before their keys can be misused closes off that exposure, at the cost of the rewards those validators would otherwise earn.

Lido sets a 7 October deadline

Lido gave the fullest account of the operational fallout in a security disclosure on its governance forum, posted late on 30 September. According to the post, MetaMask Staking acted after an investigation into an infrastructure compromise and has begun exiting its validators in the Lido protocol. The last of them are expected to exit, though not to be fully withdrawn, by the end of 7 October 2026.

Lido said holders of stETH, the token it issues in exchange for staked ETH, do not need to do anything. The post warned that the exits will likely mean foregone rewards. It also flagged possible downtime penalties if validators are taken offline early to avoid potentially larger network penalties.

The ETH will not go straight back to work. Lido expects it to return to the protocol gradually as validators complete the exit, withdrawal, and re-entry cycle. It is estimated that the process takes about 45 days, due to what it calls “the extended entry queue.” Leaving Ethereum staking has been quick for most of 2026, while joining has not: in mid-August, more than 2.2 million ETH sat in the entry queue with a wait of around 39 days, according to CryptoTicker.

The incident also affected Aave, the lending protocol where Lido’s staked ETH serves as collateral. Aave founder Stani Kulechov said on X on 1 October that his team was monitoring the situation with Lido and that Aave markets were unaffected and operating normally, PANews reported.

MetaMask is not the first Lido node operator to pull out over security concerns. Staking provider Kiln carried out precautionary exits in September 2025 after infrastructure compromises, in accordance with Lido’s standard exit procedures.

MetaMask wallet users and stETH holders do not need to take any action, according to MetaMask and Lido. Several questions remain open, however. MetaMask has not disclosed how many validators are affected or how much ETH they hold. It has also not said whether any keys were misused, whether systems beyond staking were reached, or who is behind the intrusion. The company said it will continue to monitor the situation and provide further updates as appropriate.