MetaMask has begun removing Ethereum validators from its noncustodial staking service following a security breach of some of MetaMask’s infrastructure.
The company disclosed the problem on Sept. 30 and reported that it was working with external security experts to address the issue. The company noted that it had not found any evidence of immediate risks to MetaMask wallets.
The company has not released information about how the hack was carried out, which infrastructure was attacked, or how many validators and ETH were targeted.
It has not confirmed whether users’ or validators’ signing keys or other information were compromised. MetaMask officials said the withdrawals were a precautionary measure and noted that their staking business does not hold users’ withdrawal keys.
Security Update: We are responding to a security incident affecting part of our infrastructure.
— MetaMask 🦊 (@MetaMask) September 30, 2026
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…
That separation is key to the noncustodial nature of the service. MetaMask has infrastructure and other resources to act as a validator, but users maintain control over the withdrawal keys for their staked ETH.
As a consequence, the infrastructure incident does not prove that client funds or withdrawal keys were lost. There have been no public reports of losses from slashing or withdrawals.
Lido shared more information about the incident, stating that MetaMask Staking began unstaking its validators participating in the Lido protocol following a breach of the validators’ infrastructure.
Read More: Robinhood Targets U.S. Crypto Traders With 10x Perpetual Futures
The protocol intends for the last of the relevant validators to exit state by Oct. 7. The entire process of withdrawal and re-entry by validators may take much longer than this.
Ethereum validators queue under certain protocol rules to start or stop validating. Representatives of the Lido project noted that ETH staked by validators identified in a recent letter will be slowly returned to the protocol as the validators go through exit and re-entry processes.
The entire process may take around 45 days due to waitlists for becoming an Ethereum validator. Lido has informed stETH investors that they don’t need to do anything.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
— Lido (@LidoFinance) September 30, 2026
These steps include exiting its Ethereum (ETH) validators in the Lido… https://t.co/nsox7h0I5k
There may be operational costs to this process. Lido said some losses from these probative exits would include missed staking rewards, and validators not able to complete their exits on time would face downtime penalties.
The protocol did not state that the validators were slashed. The protocol cited its decentralized node operator setup and an emergency fund containing over 6,750 stETH as ways to protect against incidents involving its validators.
MetaMask’s validation service relies on infrastructure that once belonged to Consensys Staking. The most recent announcement does not specify which part of the Consensys Staking infrastructure MetaMask is using.
Read More: How Refunds, Exit Windows and Smart Contracts Work in Memecoin Trading
The MetaMask incident also caused concern in other crypto sectors, particularly decentralized finance. Stani Kulechov, founder of Aave, said that Aave markets are running normally and unaffected by the MetaMask Staking incident.
Details about this compromise have not yet been released. MetaMask has said it is investigating the event and plans to release updates as needed. Lido has confirmed it is still investigating.
The most specific timeline for operations is October 7, the end date for Lido-supported MetaMask validators to exit. MetaMask has not set an end date for its security investigation.
The post MetaMask Security Incident Triggers Ethereum Validator Exits as Lido Sets Oct. 7 Deadline appeared first on Bitcoin Foundation.