The team behind the Web3 wallet MetaMask has reported issues with its staking service infrastructure. As a precautionary measure, developers have begun to disable Ethereum validators associated with the service.
Security Update: We are responding to a security incident affecting part of our infrastructure.
— MetaMask 🦊 (@MetaMask) September 30, 2026
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…
At the time of this announcement, MetaMask did not disclose the specifics of the incident, the potential attack vector, the number of affected validators, or the amount of Ethereum involved. An investigation is underway with the assistance of external partners and security consultants.
Representatives stated that there are no risks for users due to the architectural limitations in place. Validators operate with two types of credentials: a signing key, which is responsible for voting on blocks and is held within the operator's infrastructure, and a withdrawal key, which controls the movement of staked ETH and remains with the client.
Even if the operator's infrastructure is compromised, an attacker would only have access to the signing key. It is impossible to withdraw or transfer funds without the withdrawal key.
Validators Exiting Lido
Lido has confirmed that MetaMask Staking (formerly Consensys Staking) has begun withdrawing its managed Ethereum validators from the protocol. The last affected nodes are expected to complete their exit by October 7.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
— Lido (@LidoFinance) September 30, 2026
These steps include exiting its Ethereum (ETH) validators in the Lido… https://t.co/nsox7h0I5k
During this process, they will temporarily stop earning some staking rewards. If individual validators cease their operations before the exit is complete, penalties for downtime may apply. There are no reports of user fund losses.
After the exit, ETH will gradually return to Lido. The entire cycle — exiting the protocol, receiving funds, and re-entering staking — could take up to 45 days due to the activation queue on the Ethereum network. stETH holders do not need to take any action.
Community Discusses the Scale of the Issue
The lack of detailed information has led to speculation among users. A trader known as Andy pointed out circulating rumors suggesting a "serious scale of the problem."
Rumor mill saying the Metamask exploit could be far worse than people are expecting, with a small % of the Ethereum supply being ‘held hostage’ onchain from a single liquid staking provider.
— Andy (@andyyy) October 1, 2026
More to come as we learn more from our sources, but hoping it’s a nothing burger.
According to him, part of the Ethereum supply may have been "held hostage" by a single liquid staking provider. However, there is no confirmation of this claim.
Crypto community member Nick O’Neil suggested that MetaMask may have disclosed the issue preemptively due to the risk of someone else publishing the information. He also did not provide any evidence.
Former MetaMask employee and security expert Taylor Monahan disagreed with such interpretations. She noted that the company's message describes a standard response: the team detected suspicious activity, mitigated potential threats, and proactively withdrew the affected validators.
I mean their post is pretty explicit, I'm not sure what I can add without making shit up like you're doing lmao.
— Tay 💖 (@tayvano_) October 1, 2026
They detected some weird shit happening somewhere.
They are obviously rotating shit out of an abundance of caution.
I haven't worked for MetaMask for ages now but,…
She emphasized that it is much more concerning when projects fail to detect threats, do not maintain proper event logs, and do not take action after identifying issues.
Lubin Withdraws 133,300 ETH
In light of MetaMask's announcement, on-chain analysts noticed a significant transfer of ETH from an address linked to Joseph Lubin, the co-founder and CEO of Consensys. The wallet transferred 133,298 ETH, valued at approximately $356.2 million.
A wallet linked to #Ethereum co-founder Joseph Lubin(@ethereumJoseph) transferred 133,298 $ETH ($356.2M) to a new wallet 5 hours ago.https://t.co/s6lzxlNpRy pic.twitter.com/MInJPam0s6
— Lookonchain (@lookonchain) October 1, 2026
This transaction occurred just hours before the issues were revealed, which sparked further discussion within the crypto community. However, there are no confirmations linking this transfer to the situation at MetaMask.
It is worth noting that in September, the wallet's developer — Consensys Software Inc — announced plans to separate its consumer and institutional operations into two independently managed companies.
Stay updated with ForkLog on social media
Telegram (main channel) Facebook X