Summary
- MetaMask is taking action in response to a "security incident" impacting part of its infrastructure.
- The wallet provider is withdrawing its Ethereum validators from the Lido protocol as a safety measure, with no indication if other validators are affected.
- Lido has assured stETH holders that no action is needed from them and that the process of returning ETH might take up to 45 days.
MetaMask is currently addressing an "ongoing security incident" that has affected part of its infrastructure, leading the company to begin withdrawing its Ethereum validators from the Lido staking protocol as a precaution, according to announcements made on Tuesday.
The wallet developer confirmed that there is "no immediate threat to MetaMask wallets" and is actively working to resolve the issue with the help of external partners and security experts. They are withdrawing the validators involved in their non-custodial staking operations while collaborating with clients and partners.
Security Update: We are responding to a security incident affecting part of our infrastructure.
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…
— MetaMask 🦊 (@MetaMask) September 30, 2026
MetaMask Staking, formerly known as Consensys Staking, manages validators on Lido, which is the largest liquid staking protocol on the Ethereum network. Lido reported the validator exits in a security notice published on its governance forum late Tuesday, stating that the situation is linked to an infrastructure compromise that is currently under investigation.
This precautionary measure may result in lost rewards, as Lido indicated, and there could also be penalties for downtime if validators go offline in the upcoming days to minimize network penalties. The exit process for the relevant validators has commenced, with the final ones expected to complete their exit, although not fully withdrawn, by October 7. Neither firm has specified whether other validators managed by MetaMask are affected.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
These steps include exiting its Ethereum (ETH) validators in the Lido… https://t.co/nsox7h0I5k
— Lido (@LidoFinance) September 30, 2026
The retrieval of the ETH is expected to take significantly longer. Lido noted that the exited stake will gradually return to the protocol as validators navigate the exit, withdrawal, and re-entry process, which could take up to 45 days due to Ethereum's lengthy entry queue.
Both companies emphasized that the staking arrangement is non-custodial, meaning MetaMask does not hold withdrawal keys for client stakes. Lido reassured stETH holders that no action is required on their part and highlighted its diverse network of node operators and a reserve fund exceeding 6,750 stETH as safeguards against disruptions.
Independent on-chain analysis, which remains unverified by either company, suggests minimal amounts were impacted. Researcher Kaden reported that 19 MetaMask validators had accrued block rewards, with 18 payments funneled to an address linked to the Tornado Cash mixer instead of the intended fee recipient, totaling approximately 0.36 ETH, valued at under $1,000 based on current prices.
Myriad: Where does Ethereum go next? Click to make your prediction.According to the same analysis, around 17,000 validators holding approximately 523,000 ETH, valued at about $1.4 billion, are being exited as a precaution, with 821 validators still needing to exit. The researcher indicated uncertainty regarding whether the attacker could manipulate fee recipients across the entire group, suggesting they "likely never had the ability" to withdraw staked ETH, but validators could be intentionally slashed depending on how access was obtained for signing.
Aave founder Stani Kulechov stated that the lending protocol is monitoring the situation in conjunction with Lido, and confirmed that there has been no impact on Aave markets, where stETH is one of the most widely utilized collateral types. Ethena founder Guy Young added that the assets backing its USDe synthetic dollar currently have no direct exposure to stETH or any other liquid staking token, and he does not anticipate any repercussions.
This marks the second such incident involving a major Lido operator within a year. Last September, Kiln withdrew all its Ethereum validators after discovering what its CEO described as a potential compromise of its infrastructure, shortly after a related incident with SwissBorg.
Neither company has disclosed the specifics of what was compromised, how the breach occurred, or who was responsible. A comprehensive investigation is currently underway, with updates to follow.