MetaMask security incident forces Ethereum staking exits, no funds at risk

MetaMask security incident forces Ethereum staking exits, no funds at risk

An Ethereum security researcher estimates about 0.36 ETH in rewards was diverted, while precautionary exits cover validators holding roughly 523,000 ETH.

MetaMask began exiting affected Ethereum validators after a security incident diverted an estimated 0.36 ETH in block-production payments, though the company said it found no immediate threat to users’ wallets. A researcher estimated that about 17,000 validators holding roughly 523,000 ETH were being withdrawn, but MetaMask had not confirmed those figures or explained how its systems were compromised. Lido said affected validators could miss rewards during an exit and re-entry process lasting up to about 45 days, while stETH holders do not need to take action.

MetaMask is pulling Ethereum staking systems out of service after a security incident, with Lido warning of lost rewards and a security researcher reporting that payments from producing blocks were diverted to another wallet.

The cryptocurrency wallet provider, which also operates staking services, disclosed Wednesday that the incident affected part of its infrastructure, adding it exited affected validators — or the computers that help check Ethereum transactions — as a precaution.

“At this time, we have identified no immediate threat to MetaMask wallets,” the company said.

Ethereum security researcher Kaden said on X that 18 of 19 MetaMask-operated validators that had earned payments for producing blocks sent those payments to an unexpected address. He estimated about 0.36 ETH had been diverted.

Kaden’s analysis put the precautionary exits at roughly 17,000 validators holding about 523,000 ETH. MetaMask has not confirmed those figures or published an explanation of how its systems were compromised as of Asian afternoon hours Thursday.

Staking lets holders earn ETH by committing their coins to help secure Ethereum. Operators such as MetaMask run the computers that do the work, while customers retain separate control over where their staked coins can be withdrawn.

A validator also has an address for receiving transaction-fee payments when it produces a block. Changing that destination can divert income without changing where the original stake goes when withdrawn. Ethereum sets those destinations separately.

Someone controlling those credentials could make a validator approve conflicting records, triggering a punishment called slashing, in which Ethereum destroys some of its stake and removes it from service. Neither MetaMask nor Lido has reported that this happened.

Lost income while validators leave

The precautionary shutdown carries a cost even if the staked coins remain secure.

Lido, a service that pools users’ ETH for staking, said early Wednesday that MetaMask-operated validators had begun leaving its system. The last are expected to stop staking by Oct. 7, although their ETH will not necessarily have been withdrawn by then.

Withdrawing the coins and putting them back into staking could take up to approximately 45 days because of the queue to enter Ethereum’s staking system. The affected validators would miss rewards while out of service and could incur penalties if taken offline before completing their exits.

“No action is required from stETH holders,” Lido said. Its stETH token represents users’ pooled stake and accumulated rewards.

Read More: MetaMask adds ‘pooled staking’ for cheaper Ethereum validation

Large wallet movements also drew attention amid the disclosures. Blockchain tracker Lookonchain reported that a wallet it linked to Ethereum cofounder Joseph Lubin transferred 133,298 ETH, worth about $356 million, to a new address. It was not immediately clear whether the movement was connected to MetaMask’s response.

Ethena, the company behind the dollar-linked USDe token, also withdrew funds from cryptocurrency lending platform Morpho amid the security disclosures. Reported movements included about $75 million from a vault holding Ripple’s RLUSD stablecoin and $60 million from another holding PayPal’s PYUSD.

A source close to Ethena said the withdrawals were precautionary. Ethena has since redeployed the funds after receiving clarity on the situation, onchain data shows.

1Dogecoin gets DeFi testnet as DogeOS bets miners will eventually secure its apps2 hours ago 2Bitcoin's soft-inflation pop to $85,500 fades as bond yields refuse to fall3 hours ago 3Crypto industry gave $8 million to Clarity Act lobbyists who didn't close the deal14 hours ago 4Open USD takes on Tether, Circle with a different stablecoin model that's 'building money'16 hours ago 5U.S. CFTC seeks event contract definitions that may defy states' gambling claims16 hours ago 6Crypto Long & Short: What will the AI agents run on? 16 hours ago 7Clock's ticking: UK's crypto regulatory application window opens with February deadline17 hours ago 8Cardano tapped by Brazil’s state oil giant to track cleaner jet fuel and diesel18 hours ago 9A stronger dollar is a weaker threat to bitcoin than traders think20 hours ago 10Bitget hackers move $4 million into Zcash’s private pool, making funds harder to trace20 hours ago

The Definitive Stablecoin Landscape Series: Asia Pacific

The Definitive Stablecoin Landscape Series: Asia Pacific

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

Why it matters:

As stablecoins move into regulated finance, APAC is becoming a key proving ground. This report maps the region’s rules, use cases, and RLUSD’s role.

Dogecoin gets DeFi testnet as DogeOS bets miners will eventually secure its apps

Cardano tapped by Brazil’s state oil giant to track cleaner jet fuel and diesel

OpenAI, Google and Meta pledge independent AI safety audits under voluntary White House deal