TLDR
- MetaMask disclosed a Sept. 30 security incident affecting part of its infrastructure.
- The company says it has found no immediate threat to MetaMask wallets.
- Affected Ethereum validators in its non-custodial staking service are being exited as a precaution.
- Lido expects the last affected validators to exit by the end of Oct. 7, with the full process taking up to about 45 days.
- Aave founder Stani Kulechov says Aave markets remain unaffected.
MetaMask has started exiting affected Ethereum validators after disclosing a security incident within its infrastructure on Sept. 30. The company said it is working with outside partners and security advisers to fix the issue.
In a short update, MetaMask said it had identified “no immediate threat to MetaMask wallets.” It did not give technical details about which systems were involved.
As a precaution, the company is exiting affected validators within its non-custodial staking operations. MetaMask said it does not manage withdrawal keys for stake on behalf of its clients.
What MetaMask Has Disclosed
Public disclosures as of Oct. 1 do not name the attack method. They also do not say how many validators were affected, how much ETH is involved, or whether any data was accessed.
MetaMask did not say whether validator signing keys were accessed. It also has not reported slashing, stolen client stake, or unauthorized withdrawals.
The affected operations involve MetaMask Staking, which was previously known as Consensys Staking. Earlier in September, Consensys Software Inc. announced plans to operate under the MetaMask name.
As part of that change, its protocols and institutional infrastructure businesses will move into a newly formed Consensys company. That separation is expected to be completed by the end of 2026.
MetaMask’s validator staking service uses a non-custodial model. Its documentation says users keep control of their stake and rewards, while MetaMask’s infrastructure runs the validator.
Lido Sets Oct. 7 Exit Target
Lido shared more details in a Sept. 30 post on its governance forum. A Lido representative said MetaMask Staking took precautionary action following an “infrastructure compromise.”
Validators run by MetaMask Staking within the Lido protocol have begun exiting. Lido expects the final affected validators to reach the exit stage by the end of Oct. 7, though they may not be fully withdrawn by then.
Lido said ETH from these validators will return to the protocol gradually as each one moves through exit, withdrawal, and re-entry. The full process could take up to about 45 days because of Ethereum’s long validator entry queue.
Lido told users that “No action is required from stETH holders.” It said the exits could lead to lost staking rewards and possible downtime penalties if validators go offline before their exits finish.
Lido did not say any validators had been slashed. It pointed to its network of more than 600 node operators and a reserve fund holding more than 6,750 stETH as tools to absorb disruptions.
Aave founder Stani Kulechov said in an Oct. 1 update that he was monitoring the situation. He said Aave’s markets had not been affected and were operating normally.
MetaMask has not given a deadline for completing its investigation. The company said it remains in contact with clients, partners, and security advisers, while Lido said a “full investigation is underway.”
