MetaMask Takes Ethereum Staking Offline After Security Incident
MetaMask took affected validators offline after an incident in its staking infrastructure; according to the company, wallets were not directly hit, but rewards and uptime were.
Key Takeaways
- MetaMask took part of its Ethereum staking offline after a security incident and shut down affected validators as a precaution.
- One researcher said 18 of the 19 MetaMask validators sent rewards to an unexpected address; MetaMask has not confirmed those numbers.
- According to the report, about 17,000 validators with roughly 523,000 ETH were taken offline as a precaution, while Lido said stETH holders do not need to do anything.
MetaMask has taken part of its Ethereum staking system offline after a security incident. According to the company, MetaMask wallets were not directly affected, but part of the infrastructure was hit and validators were shut down as a precaution.
An Ethereum security researcher said that 18 of the 19 MetaMask validators that received rewards for producing blocks sent those payments to an unexpected address. He estimated that about 0.36 ETH was redirected. MetaMask has not yet confirmed those numbers and on Thursday still had not explained exactly how the systems were compromised.
What Went Wrong
Staking means locking up ETH to help secure the Ethereum network. MetaMask runs the systems that do the work, while customers keep control over where their staked coins can eventually be withdrawn. A validator also has a separate address for rewards from block production, and that reward address can be changed without directly moving the original stake itself.
According to the researcher, about 17,000 validators with roughly 523,000 ETH have been taken offline as a precaution. MetaMask has not confirmed those numbers. The company also did not say there was any slashing, where Ethereum can destroy part of the stake if a validator acts incorrectly.
Impact on Staking and Lido
Lido, which pools ETH for staking, said MetaMask validators have already started exiting the system. The last ones are expected to stop staking on October 7, although that does not automatically mean the ETH will already have been withdrawn by then. Because of Ethereum's queue, it can take about 45 days before validators can fully enter and exit again.
That makes the move especially relevant for the returns of the validators involved. While they are offline, they miss out on rewards and can also face small penalties if they go offline too early. Lido said stETH holders do not need to take any action.
Why This Matters More Broadly
The case shows that staking is not just about the coins themselves, but also about the party running the infrastructure. For European crypto readers, that matters because more and more users are outsourcing staking to large providers instead of running a validator themselves. In that kind of setup, a problem in the operational layer can directly affect rewards, without necessarily putting the underlying ETH at risk.
Besides MetaMask, a large wallet move also drew attention. Blockchain tracker Lookonchain reported that a wallet it linked to Ethereum founder Joseph Lubin moved 133,298 ETH, worth about $356 million (€314 million), to a new address. It is not clear whether that was related to MetaMask's response. Ethena also pulled funds from lending platform Morpho as a precaution, then later redeployed the funds after more clarity emerged.
