Threat intel

On September 30, 2026, MetaMask said it was responding to an "ongoing security incident affecting part of our infrastructure" and began exiting validators run by MetaMask Staking, the Ethereum validator business formerly called Consensys Staking. Lido, the largest liquid staking protocol on Ethereum, confirmed the same day that MetaMask Staking's validators in its protocol were leaving after "an infrastructure compromise under investigation". MetaMask's October 1 update says there is "no indication that MetaMask wallets or customer funds have been affected". Neither company has said what was compromised or how.

This matters to anyone who stakes through a provider, holds stETH, or runs validators. The money taken was small. Still, an intruder who can change where a validator sends its block rewards is close to the keys that sign for that validator. MetaMask treated it that way and pulled the stake out of reach.

How it works

An Ethereum validator has two separate sets of credentials. The signing key is a BLS key (the signature scheme Ethereum's consensus layer uses) that signs block proposals and attestations, the votes validators cast every few minutes. It has to stay online, in the validator client or a remote signer, so it is the exposed one. The withdrawal credential decides where the stake itself can go. With type 0x01 or 0x02 credentials it is a fixed Ethereum address, set at deposit time, and MetaMask says it does not hold its clients' withdrawal keys.

A third setting sits between them: the fee recipient. When a validator proposes a block, the transaction tips and MEV payments (extra value from transaction ordering, paid by block builders) go to the fee recipient address, not to the withdrawal address. Most professional operators use MEV-Boost, where the validator client sends relays a registration message, signed with the validator's BLS key, that names the fee recipient. Builders pay whatever address the latest registration names.

Bitquery's onchain reconstruction found that this is what changed. From 12:05 UTC on September 30, signed registrations named a new wallet, and from 12:12 UTC blocks proposed by MetaMask validators paid that wallet instead of the client's address. The stake never moved, because the withdrawal address was untouched.

The open question is how those messages were signed. If the intruder only changed the fee recipient setting in the validator client or its configuration, the client signed the registration with its own key and the keys may never have left. If the intruder held the signing keys, they could also sign two conflicting blocks or votes. That gets a validator slashed: part of its stake is burned and it is forced out. Bitquery says the chain cannot show which case applies, and MetaMask has not said.

Why exiting is the defensive move

Once a validator has exited and its balance is withdrawn, a stolen signing key controls nothing: there are no more blocks to redirect and no stake left to slash. Exits queue at a protocol rate limit, about 1,800 validators a day according to Bitquery, so starting early shortens the exposure window. Since the Pectra upgrade of May 7, 2025 (EIP-7002), the holder of an execution-layer withdrawal address can also trigger an exit without the signing key, which gives staking clients their own exit route if an operator is compromised.

The cost is real. Lido expects the last MetaMask Staking validators in its protocol to exit, though not yet withdraw, by the end of October 7. It says the full cycle of exit, withdrawal and re-entry through an extended entry queue could take up to 45 days, with foregone rewards and possible downtime penalties. Lido says stETH holders need to do nothing and holds a reserve fund of more than 6,750 stETH. On October 14 it put onchain vote 206 live to set MetaMask Staking's target limit to zero, which stops new deposits going to its node operator IDs (21 in Curated Module v1, 6 in v2).

What the intruder did

These figures come from third-party researchers. MetaMask has confirmed none of them.

• Bitquery counted 0.36 ETH in tips from 18 blocks paid to the intruder's wallet, under $1,000, between 12:12 and 16:46 UTC. Eleven of those blocks came from Lido validators. Researcher Kaden, quoted by Decrypt and Bitcoin.com, gives the same 0.36 ETH, from 18 of 19 MetaMask validators that won blocks.
• The receiving wallet was funded through the Tornado Cash mixer at 10:27 UTC. MetaMask's first exit, a Lido validator, followed at 10:46 UTC, 85 minutes before the first diverted block. Fee recipients were restored in waves between 16:10 and 17:08 UTC.
• Bitquery counted 16,965 validators holding 565,056 ETH that had exited or queued to exit by 05:29 UTC on October 1, and calls that a floor. Kaden's estimate is about 17,000 validators and about 523,000 ETH. The counts were taken at different times by different methods.
• Bitquery recorded no slashings. Its worst case, all of these validators slashed at once, would have burned about 22,000 ETH.

MetaMask also warns that it will never ask for a Secret Recovery Phrase. Expect phishing that uses this incident as a lure.

What to do

If you stake through a provider

1. Look up each validator public key on a beacon chain explorer such as beaconcha.in and confirm the withdrawal credentials are type 0x01 or 0x02 and point to an address you control. Type 0x00 credentials have no execution address set, so whoever holds the BLS withdrawal key decides where the stake goes.
2. Check the fee recipient on your recent proposals in the same explorer, and query each relay your provider uses for the registered one, for example https://boost-relay.flashbots.net/relay/v1/data/validator_registration?pubkey=0x.... Any address that is not yours or your provider's documented vault is a finding.
3. Find out how your provider stores signing keys and whether it runs slashing protection.
4. Keep the withdrawal address key offline, and test the EIP-7002 exit path, which needs 0x01 or 0x02 credentials, so you can leave without the operator if you need to.

If you run validators

• Alert on every block your validators propose where the fee recipient differs from the expected address. A per-proposal check against your own allowlist would have flagged the first diverted block at 12:12 UTC.
• Watch relay registrations too. A signed registration naming a new address appeared seven minutes before the first diverted block.
• Keep signing keys out of general-purpose hosts. A remote signer such as Web3Signer, backed by an HSM (hardware security module) or a cloud KMS, means a compromised validator client cannot copy the keys.
• Keep slashing protection databases with the signer, and carry them over on every migration.
• Treat fee recipient files and proposer settings as protected configuration, with change control and an alert on edits.
• Write and rehearse a mass exit runbook. In Bitquery's timeline, MetaMask's first exit came 19 minutes after the intruder's wallet was funded and before any tip was diverted.

The wider lesson

Here the intruder did not need the stake to take money. A fee recipient setting was enough, and configuration management, orchestration and relay registration can all change it. Those systems belong inside the same access controls and alerting as the signer. When the root cause is unclear, getting validators out of reach before the investigation finishes is a sound choice, and that only works if the exit runbook has already been tested.

Our security operations team builds alerting for this kind of configuration drift, and our platform and cloud engineering work covers key isolation and signer architecture. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: MetaMask user update, Lido security disclosure, Bitquery investigation, Decrypt, Bitcoin.com News, Gridinsoft, ethereum.org on validator keys, ethereum.org on withdrawal credentials, ethereum.org on Pectra, Flashbots validator registration check.