TechMetaMask Security Breach Triggers Ethereum Validator Withdrawals, Funds Remain Safe
Approximately 0.36 ETH in rewards has been redirected, while precautionary measures impact validators with about 523,000 ETH.
By Shaurya MalwaUpdated Oct 1, 2026, 3:30 a.m. EDTPublished Oct 1, 2026, 3:06 a.m. EDT3 min readMake preferred on ShareShare this articleCopy linkX (Twitter)LinkedInFacebookEmailMake preferred on
MetaMask's mobile app (Gabby Jones)Summary- Following a security breach, MetaMask has initiated the withdrawal of affected Ethereum validators, with an estimated 0.36 ETH in block-production payments redirected. The company confirmed that users’ wallets remain secure.
- An Ethereum security expert estimated that around 17,000 validators, collectively holding about 523,000 ETH, are being withdrawn; however, MetaMask has not verified these numbers or clarified the nature of the breach.
- Lido has warned that validators undergoing this exit process may miss out on rewards, which could take up to 45 days to complete, while holders of stETH are not required to take any action.
In light of a recent security incident, MetaMask is ceasing its Ethereum staking services, prompting Lido to caution users about potential lost rewards. A security researcher reported that some payments intended for block production were misdirected to an unauthorized wallet.
The cryptocurrency wallet provider, which also offers staking, announced on Wednesday that part of its infrastructure was compromised, leading to the precautionary withdrawal of affected validators—essentially the systems that verify Ethereum transactions.
“Currently, there is no immediate threat to MetaMask wallets,” the company stated.
Ethereum security researcher Kaden posted on X that 18 of the 19 validators operated by MetaMask that had received payments for producing blocks sent those funds to an unexpected address, estimating that around 0.36 ETH was diverted.
According to Kaden's findings, the precautionary withdrawals involve approximately 17,000 validators with a total of about 523,000 ETH. As of Thursday afternoon in Asia, MetaMask had not confirmed this data or explained how the breach occurred.
Staking allows users to earn ETH by locking their assets to help secure the Ethereum network. Companies like MetaMask manage the infrastructure, while customers maintain control over their staked coins and can withdraw them separately.
Each validator has a designated address for receiving transaction fees when it produces a block. Altering this address can reroute income without affecting the original stake's withdrawal. Ethereum manages these addresses separately.
If someone gains access to these credentials, they could make a validator approve conflicting records, which could lead to penalties known as slashing, where Ethereum destroys part of its stake and takes the validator offline. However, neither MetaMask nor Lido has indicated that such penalties have occurred.
Impact on Validator Income During Exits
The precautionary shutdown incurs costs even if the staked assets are secure.
Lido, which pools users' ETH for staking, stated early Wednesday that validators operated by MetaMask had begun exiting its system, with the last expected to finish by October 7, although their ETH might not be withdrawn by that date.
Returning the coins to staking may take up to about 45 days due to the queue in Ethereum's staking system. During this period, the affected validators will not earn rewards and may face penalties if they are taken offline before completing the withdrawal process.
Lido reassured that no action is needed from stETH holders, whose stETH token reflects their pooled stake and accrued rewards.
Read More: MetaMask introduces ‘pooled staking’ for more cost-effective Ethereum validation
Additionally, significant wallet transfers have gained attention following the incident. Blockchain analytics firm Lookonchain reported that a wallet associated with Ethereum co-founder Joseph Lubin transferred 133,298 ETH, valued at about $356 million, to a new address. It remains unclear if this transaction is related to MetaMask's actions.
Ethena, the company behind the USDe stablecoin, also moved funds from the cryptocurrency lending platform Morpho amid the security alerts. This included approximately $75 million from a vault containing Ripple's RLUSD stablecoin and $60 million from another vault holding PayPal's PYUSD.
A source close to Ethena indicated that these withdrawals were precautionary. The company has since redeployed the funds after gaining clarity on the situation, as shown by on-chain data.
Latest Crypto News- 1Dogecoin introduces DeFi testnet as DogeOS bets on miners to secure its applications3 hours ago
- 2Bitcoin's temporary rise to $85,500 fades as bond yields remain high3 hours ago
- 3Crypto sector contributed $8 million to Clarity Act lobbyists who failed to finalize the deal14 hours ago
- 4Open USD challenges Tether and Circle with an innovative stablecoin model16 hours ago
- 5U.S. CFTC seeks definitions for event contracts that may contradict state gambling laws16 hours ago
- 6Crypto Long & Short: What will the AI agents operate on?17 hours ago
- 7Time is running out: UK's crypto regulatory application window opens, with a February deadline17 hours ago
- 8Cardano selected by Brazil’s state oil company to monitor cleaner jet fuel and diesel19 hours ago
- 9A stronger dollar poses less of a threat to bitcoin than traders believe20 hours ago
- 10Bitget hackers transfer $4 million into Zcash’s private pool, complicating fund tracing20 hours ago
The Definitive Stablecoin Landscape Series: Asia Pacific
The Definitive Stablecoin Landscape Series: Asia Pacific
As stablecoins enter regulated finance, the Asia-Pacific region is emerging as a significant testing ground. This report outlines the region's regulations, use cases, and RLUSD’s involvement.
Why it matters:
As stablecoins transition into regulated finance, the Asia-Pacific region is becoming a critical proving ground. This report details the region’s regulations, use cases, and RLUSD’s role.
View Full ReportMore From Tech