MetaMask has disclosed a security incident affecting part of its staking infrastructure, prompting the company to proactively exit impacted Ethereum validators as a precaution. The wallet provider confirmed no immediate threat to user wallets, emphasizing its non-custodial structure means it does not control withdrawal keys for clients’ staked assets. MetaMask is working with external security advisers and partners to investigate. The incident involves Lido protocol validators, with exits expected to complete by October 7. The full withdrawal process may take approximately 45 days due to Ethereum’s exit queue. No details on the number of validators, ETH amounts, or potential penalties have been released.
The MetaMask Security Incident has affected part of the wallet provider’s infrastructure, prompting the company to begin exiting impacted Ethereum validators as a precaution. MetaMask said it has identified no immediate threat to MetaMask wallets while working with external security advisers and partners to investigate and remediate the affected systems.
The incident involves MetaMask’s non-custodial staking operations rather than a confirmed compromise of user wallets. MetaMask said it does not manage withdrawal keys for clients’ staked assets, separating the infrastructure issue from a direct custody breach.
MetaMask said it is proactively exiting affected validators while the investigation continues. The company did not disclose the nature of the security issue, the number of validators involved, or whether any user funds were lost.
According to MetaMask, customers maintain ownership of withdrawal keys for their staked funds. The non-custodial structure allows validator operations to be isolated without indicating that the same infrastructure directly controls users’ wallet balances.
Lido added operational effects to this situation. MetaMask Staking started leaving the Lido protocol, with its validators operating on Ethereum to safeguard clients’ assets, and Lido said the final affected validators are expected to complete the exit process by October 7.
The exit procedure does not entail immediate availability of that ETH for restaking. According to Lido, the ETH of exited MetaMask-operated validators must pass exit and withdrawal procedures to be returned to the protocol, a process taking about 45 days due to the Ethereum entry queue.
Exiting validators will temporarily stop receiving staking rewards and may face some downtime penalties. MetaMask has not provided information on the number of affected validators, the amount of ETH, or any possible penalties.
The next step will depend on the findings of the MetaMask investigation and the validator exit process. The company is collaborating with external organizations and security experts while handling the compromised infrastructure.
