BTC $84,231 
ETH $2,715 
USDT $0.9995 
BNB $771.32 
XRP $1.51 
USDC $0.9998 
SOL $119.34 
TRX $0.3374 
ZEC $1,435 
FIGR_HELOC $1.03 MetaMask exits Lido validators as it investigates security incident
MetaMask is exiting affected Ethereum validators in the Lido protocol while it responds to a security incident inside its own infrastructure.
Key takeaways
- Exits run to Oct. 7. Lido expects the last affected validators to be out by October 7, pending network conditions.
- Return takes 45 days. Lido's Will Shannon said the exit, withdrawal and re-entry cycle is estimated to take approximately up to 45 days.
- Key details missing. As of Oct. 1, reports had not named the attack method, the validator count or the ETH amount involved.
What happened
MetaMask says it is dealing with a security incident inside part of its own infrastructure, and it has begun removing impacted validators from staking as a precautionary step. The company said the precautionary moves cover validators inside its non-custodial staking business.
In an update on Wednesday, MetaMask said it was handling the ongoing threat in house and working with outside partners and security advisers. It did not say what the security issue was. The company said it had not found any immediate threat to MetaMask wallets, and that its staking service stays non-custodial, with the operator not controlling the keys clients use to withdraw funds.
Lido said in its own update that MetaMask Staking had started pulling its Ethereum validators out of the Lido protocol on Wednesday. Lido expects the last affected validators to be gone by the end of Oct. 7, and MetaMask's disclosure points to a Sept. 30 incident inside its infrastructure.
Why it matters
Lido warned the precautionary exits could cost stakers rewards and bring possible downtime penalties. Will Shannon, a developer at Lido Finance, said ETH taken out of MetaMask Staking-operated validators should return to the protocol gradually, with the process estimated to take approximately up to 45 days because of a long entry queue.
Lido said stETH holders need no action while exited ETH returns through protocol processes. Stani Kulechov, founder of Aave, said its markets remain unaffected while teams monitor developments with Lido.
MetaMask kept the incident separate from its wallet product, saying no immediate threat to wallets had been identified and reporting no wallet-user losses. The gaps in the disclosure matter, because the reports do not name the attack method, the number of validators affected, the amount of ETH involved or whether any data was accessed. MetaMask said it would keep monitoring and give more information as its investigation develops.
What the data shows
The reports carry few firm figures. Lido put the final affected validator exits at October 7, pending network conditions, and the incident MetaMask disclosed was dated Sept. 30.
Shannon of Lido Finance framed the exit, withdrawal and re-entry stages as approximately up to 45 days. As of Oct. 1, public disclosures did not identify the attack method, the number of validators affected, the amount of ETH involved or whether any data was accessed.
Background
- A Lido representative said in a Sept. 30 security disclosure on the protocol's governance forum that MetaMask Staking had taken precautionary action after an "infrastructure compromise."
- The affected operations involve MetaMask Staking, which was previously known as Consensys Staking.
- Earlier in September, Consensys Software Inc. said it planned to operate under the MetaMask name while separating its protocols and institutional infrastructure businesses into a newly formed Consensys company. That separation is expected to be complete by the end of 2026.
- MetaMask's validator staking service uses a non-custodial model. For direct validator staking, ETH stays tied to Ethereum's staking system until the user starts an exit and withdrawal.
What is still unclear
- The reports do not identify the attack method, the number of validators affected, the amount of ETH involved or whether any data was accessed.
- MetaMask's incident notice does not say whether every part of its staking business is affected, and it does not name the infrastructure component involved.
- The reports differ on detail: Lido offered an operational timeline, while Alerts and the company's own update did not describe the security issue itself.
- Cointelegraph said it reached out to MetaMask and did not receive an immediate response.
- MetaMask said more information would follow as its investigation develops, so the picture may change.
Questions readers ask
Are MetaMask wallets affected by the security incident?
MetaMask said it has not identified any immediate threat to MetaMask wallets while it responds to the incident. It did not report a compromise of its wallets or losses involving wallet users.
When will the affected MetaMask validators finish exiting?
Lido expects the final affected MetaMask validators to leave by October 7, pending network conditions. A separate report said the last affected validators were expected to exit by the end of Oct. 7.
Do stETH holders need to do anything?
Lido says stETH holders need no action while exited ETH gradually returns through protocol processes. ETH is expected to return as validators complete the exit, withdrawal and re-entry cycle.
What caused the MetaMask staking incident?
The reports do not identify the attack method, the number of validators affected, the amount of ETH involved or whether any data was accessed. Lido referred to an "infrastructure compromise" in its Sept. 30 disclosure.
