Metamask Pulls Validators as Meager ETH Theft Sounds Big Alarm

Less Than $1,000 Goes Missing, Half a Million $ETH Heads for the Door

According to a security researcher, someone appears to have pinched about 0.36 $ETH in Ethereum block tips from Metamask-operated validators, a haul worth less than $1,000 at roughly $2,700 per ether. The response was considerably bigger. Metamask began proactively exiting affected validators on Sept. 30 while investigators tried to determine how far the intruder had gotten.

Researcher Kaden estimates that roughly 17,000 validators collectively holding about 523,000 $ETH were sent toward the exits. Metamask hasn’t confirmed those figures, but Lido confirmed that validators operated by Metamask Staking are being removed from its protocol. That’s the curious bit. The visible theft was pocket change by crypto-hack standards, while the defensive maneuver involved hundreds of thousands of ether.

The Thief Apparently Found the Tip Jar

Metamask disclosed the incident at 7:38 p.m. Eastern time Sept. 30, saying it was responding to a compromise affecting part of its infrastructure and had found “no immediate threat to Metamask wallets.” On Oct. 1, the company said there remained “no indication that Metamask wallets or customer funds have been affected.” The staking architecture helps explain why.

Ethereum validators generally put up 32 $ETH, but Metamask says its staking operation is non-custodial and it doesn’t control customers’ withdrawal keys. Those keys are what allow the underlying stake to be withdrawn. An attacker able to tamper with validator settings, therefore, wouldn’t automatically hold the keys to the vault. Kaden’s onchain reconstruction instead points to the tip jar.

He reported that 19 Metamask validators won block rewards and payments, but 18 went to the wrong fee-recipient address. The address had been funded through the ether mixing service Tornado Cash, and the diverted payments totaled about 0.36 $ETH. Another reconstruction traced the activity to roughly four and a half hours on Sept. 30. It’s a tiny take followed by a very large alarm bell.

Why Metamask Went for Broke on Validator Exits

Changing the fee recipient can reroute a validator’s block tips without moving its 32 $ETH stake. The trouble starts if an attacker obtains something more powerful, such as validator signing keys.

Those keys can’t simply withdraw the stake, but they can potentially make proof-of-stake (PoS) validators commit offenses punishable by Ethereum’s slashing system. Slashing destroys part of the validator’s stake and removes it from service. Kaden said three exploited validators had not yet exited when he posted his analysis, and estimated about 821 potentially affected validators remained active.

In another analysis, the blockchain data infrastructure firm Bitquery separately counted 16,965 validators holding 565,056 $ETH that had exited or entered the queue by Oct. 1. Its numbers differ somewhat from Kaden’s because the researchers measured different sets at different times. Neither figure has been publicly confirmed by Metamask.

Bitquery also estimated that a hypothetical simultaneous slashing of roughly 17,000 validators could have burned around 22,000 $ETH. No validators had been slashed in its reconstruction. That possibility helps explain why the crypto wallet platform Metamask took the wraps off a much bigger defensive operation than the theft itself appeared to warrant.

A One-Week Exit Can Become a 45-Day Wait

Liquid staking infrastructure provider Lido expects the affected validators it uses to finish exiting by the end of Oct. 7. Getting that ether earning again is another matter. Validators must clear Ethereum’s exit process, withdraw, and eventually rejoin through the entry queue. Lido estimates the complete trip could take up to approximately 45 days. During that stretch, the exited stake isn’t earning validator rewards.

The queue was already crowded. Validator queue data via beaconcha.in shows about 393,795 $ETH waiting to leave Ethereum’s validator set, with an estimated four days and six hours required to clear the exit queue before another withdrawal delay. Lido says stETH holders don’t need to take action, while Metamask is telling wallet users the same thing and warning them not to surrender recovery phrases to anyone claiming to offer protection.

For now, the ledger presents a strange scorecard: roughly 0.36 $ETH apparently stolen, hundreds of thousands of $ETH shuffled toward the exits, and potentially weeks of lost earning time. The thief may have reached the tip jar, but Metamask still hasn’t said exactly how close the intruder got to the safe.