MetaMask reported a security incident affecting its Ethereum validator infrastructure on September 30, 2026. The company confirmed that user wallets and funds remain secure, as the platform utilizes a non-custodial staking model where MetaMask does not hold user withdrawal keys.
An investigation revealed that an attacker diverted approximately 0.36 ETH in staking rewards from 18 of 19 compromised validators. As a precautionary measure, the company is exiting roughly 17,000 validators, which collectively hold about 523,000 ETH.
The exit process involves taking validators offline to return staked assets. MetaMask stated that users do not need to take any action regarding their accounts or settings. The company is currently continuing its investigation into the breach.
Partner platform Lido warned that the exit and re-entry process could take up to 45 days. During this period, participants may experience a loss of staking rewards and face potential penalties associated with the validator cycle.
