MetaMask provided a new update Thursday on the infrastructure security incident that prompted it to begin exiting Ethereum validators.
The company said its investigation has found no indication that MetaMask wallets or customer funds were affected. MetaMask is continuing containment and verification work with partners while affected validators are removed as a precaution. MetaMask official incident update
The validator exits relate to MetaMask’s non-custodial staking operation rather than users’ wallet private keys.
MetaMask emphasized that it does not control withdrawal keys for clients’ staked assets. MetaMask
The unresolved issue involves validator reward destinations.
An Ethereum security researcher reported that 18 of 19 observed MetaMask-operated validators that earned block-production payments sent those payments to an unexpected address. The researcher estimated approximately 0.36 ETH had been diverted. CoinDesk
The same researcher estimated that precautionary exits could involve approximately 17,000 validators holding roughly 523,000 ETH.
MetaMask has not confirmed those numbers.
Lido said stETH holders do not need to take action, although affected validators could miss rewards during the exit and re-entry process. That process could take approximately 45 days. CoinDesk
TOKEN RECON ASSESSMENT
The distinction between validator reward credentials and withdrawal credentials is central to understanding this incident.
Current evidence points toward diverted validator income rather than theft of the underlying staked ETH. MetaMask’s statement that customer funds remain unaffected is consistent with that architecture, but the company has not yet published a full explanation of how the reward destination was altered.
Until that mechanism is identified, the incident remains open.
A technical post-mortem confirming the compromise path and the actual number of affected validators would convert the current picture from containment reporting into a defensible forensic conclusion.
Sources
MetaMask, October 1 security incident update
CoinDesk, MetaMask exits Ethereum validators after attacker diverts staking rewards
