“We are currently responding to an ongoing security incident affecting part of our infrastructure. We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors. At this time, we have identified no immediate threat to MetaMask wallets.”
MetaMask is now taking precautionary actions focused on its staking operations rather than the wallets themselves. This means that users holding assets through MetaMask are not required to do any action now. The company hasn’t provided further details about the security incident. Also, it is not sure how long the investigation will continue.
Lido confirms MetaMask validator exits
Lido has reportedly confirmed that MetaMask Staking has started exiting some of its Ethereum validators from the protocol. The move aims to protect client assets as the investigation into the security incident continues.
The exit process is expected to be completed by October 7, 2026, by the affected validators. However, it should be mentioned that $ETH will not return to staking immediately. If the assets need to be staked again, they should first go through the withdrawal process. In a security disclosure on September 30, Lido noted,
“No action is required from stETH holders. $ETH exited from MetaMask Staking-operated validators is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue. As a reminder, staking operations are non-custodial in nature and MetaMask does not manage withdrawal keys for staking on behalf of clients.”
Further, Lido stated that it could take up to 45 days for the complete exit, withdrawal, and re-entry process. This is mainly because Ethereum currently has an extended queue for validators waiting to enter the staking system. During this period, the affected validators will remain offline, and thus, they will face some temporary changes in staking rewards.
Meanwhile, it is important for MetaMask users to understand the impacts of the security threat and the ongoing precautionary procedures. Currently, they are required to wait for the company’s further announcements, and no immediate action is needed. As the staking service is non-custodial, users maintain control over their assets while affected validators go through the exit process.
Joseph Lubin-linked wallet moves $356M in $ETH
In a separate development, a wallet linked to Ethereum co-founder Joseph Lubin moved about 133,298 $ETH, worth around $356.2 million, to a newly created wallet. This transfer took place around the same time as the MetaMask security incident.
But as of now, there is no indication that the $ETH transfer is connected to the incident affecting the platform’s staking infrastructure. The movement appears to be a separate on-chain transaction involving Lubin.
coincodex.com
