protos.com
01 October 2026 10:29, UTC
Crypto wallet giant MetaMask has “proactively” initiated the exit of 17,000 affected Ethereum validators, representing a total of over 523,000 staked $ETH ($1.4 billion), following a security incident.
It stressed that its wallets faced “no immediate threat,” and that the issue was confined to its “non-custodial staking operations.”
The firm has so far provided no further details, but the worrying news prompted others to investigate the scope of the breach.
4.8 based on 40K reviews in the App Store and Google Play
Security Update: We are responding to a security incident affecting part of our infrastructure.
— MetaMask 🦊 (@MetaMask) September 30, 2026
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…
Spearbit and Cantina security researcher 0xKaden posted an analysis of the incident to X, noting that block rewards from 18 MetaMask validators were “not paid to the correct fee recipient but instead to this tornado [Cash] funded account.”
The suspicious address has made no transactions and holds 0.46 $ETH, including its funding of 0.1 $ETH from crypto mixer Tornado Cash.
It has received 18 incoming $ETH transfers (block rewards) from Titan Relay: Forwarder, worth less than $1,000 in total.
On-chain analyst Emmett Gallic spotted a sizable 133,300 $ETH transfer coming from wallets labelled “Lubin/ConSensys,” worth $360 million a few hours before MetaMask’s statement, though there’s no suggestion this is a suspicious transfer.
after some onchain sleuthing, i think this is what happened:
— kaden.eth (@0xKaden) October 1, 2026
19 metamask validators had won block rewards, and 18 of the rewards were not paid to the correct fee recipient but instead to this tornado funded account: 0x98B9231de84334c1d48BA0b72CF13f92484924A3
~17k validators… https://t.co/qAlfkVNUW1
The incident bears a striking resemblance to last September’s $41 million loss from Kiln’s SOL staking operations.
In that case, the firm also exited all active $ETH validators and rotated their signing keys, treating all related operations as “potentially compromised.”
In July, Drop Site News reported that ConsenSys (MetaMask’s developer, which rebranded as both MetaMask and ConsenSys in early September) “accidentally hired a software developer linked to North Korea… as a consultant.”
However, the report doesn’t suggest that the consultant’s role, which lasted around a month, was related to the affected staking operations.
MetaMask’s response has led to a spike in the $ETH staking exit queue, which has hit its highest level so far this year.
The queue leapt from around 200,000 $ETH on Wednesday to over 700,000 $ETH on Thursday, bumping the withdrawal wait time from three and a half days to almost two weeks.
Liquid staking provider Lido expects MetaMask $ETH to be re-deposited following the validators’ “exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue.”
