MetaMask disclosed a security incident on Wednesday affecting part of its infrastructure. The company says it has found no immediate threat to its users’ wallets so far. The damage sits in staking, where an attacker skimmed about 0.36 ETH in rewards before MetaMask shut down machines handling roughly 523,000 ETH as a precaution, by one security researcher’s estimate.
Key Takeaways
- MetaMask reports a security incident on part of its infrastructure and has found no immediate threat to wallets.
- About 0.36 ETH in staking rewards was diverted, while the ETH clients deposited stayed untouched.
- MetaMask is shutting down its staking machines as a precaution, and a full return can take around 45 days.
Get an AI Summary of This Article
ChatGPTWhat MetaMask Says About Its Security Incident
The note went up on Wednesday, September 30, as a short user update on the ongoing security incident, and it runs a few lines: part of the company’s infrastructure is affected, the team is handling it internally with external partners and security advisors, and no immediate threat to MetaMask wallets has been identified.
For anyone who uses MetaMask, that last line is the one that matters. The update asks wallet holders to do nothing in particular. What it leaves out is which part of the infrastructure was hit and how the attacker got in.
The only concrete step concerns staking, the service that puts ETH to work for a yield. MetaMask is taking offline the validators exposed to the security incident, the computers that check Ethereum transactions and earn rewards for it, in coordination with clients and partners. The company stresses that its staking is non-custodial, so the keys used to withdraw client funds stay with the clients.
The staking unit went by Consensys Staking until MetaMask split from Consensys earlier in September. The size of the shutdown is still an estimate: Ethereum security researcher Kaden puts it at roughly 17,000 validators and about 523,000 ETH, close to $1.4B, and MetaMask has yet to confirm those numbers.
0.36 ETH Diverted: What the Attacker Actually Took
The theft itself is tiny. In his breakdown posted on X, Kaden found that 18 of the 19 MetaMask validators that had earned block production payments sent them to an unexpected address. That came to about 0.36 ETH, under $1,000, and the receiving address is tied to the Tornado Cash mixer.
Ethereum’s design explains why the security incident stopped there. The network keeps the address that collects rewards separate from the address that receives withdrawals of staked funds. The attacker got hold of credentials tied to the first one, which let them skim transaction fees without ever reaching the deposited ETH.
Part of that money runs through Lido, the protocol that lets people stake ETH without running a validator themselves, in exchange for a token called stETH. That setup hands security to operators the user never picks, a trade-off covered in our guide to how liquid staking works and where it can break.
Lido contributor KimonSh laid out the timeline in a security disclosure on the Lido research forum. Every MetaMask validator inside the protocol is being exited, with the final exits expected by October 7. stETH holders have nothing to do, Lido holds a reserve fund of more than 6,750 stETH, and downtime penalties remain possible.
Lido developer Will Shannon said the withdrawn ETH will flow back into the protocol gradually over roughly 45 days. The cost of the security incident therefore shows up as a temporary dip in yield spread across all holders, while their principal stays intact.
Also on Cryptonomic:
- California Bans Memecoins for Public Officials
- What Max Pain Really Predicts in Bitcoin Options
- XRP Ledger Pushes Its Batch Upgrade to October 9
What the Security Incident Changes for MetaMask Users
Set against this summer’s big exploits, the contrast is sharp. In July, three DeFi protocols were drained of $35M in six hours because nobody shut the door in time. Here the direct loss sits below $1,000, and MetaMask’s quick reaction is what makes the news.
The near-term story hinges on what MetaMask discloses about the source of the security incident. Until the entry point is known, pulling validators offline is the safest call, because it cuts the attacker off from any further income.
MetaMask’s exposure goes beyond Lido. The company manages more than $3B in staked ether and offers three routes through its Portfolio interface, namely pooled staking, validator staking, and liquid staking through Lido and Rocket Pool. Its update says nothing yet about the routes outside Lido.
The timing is awkward for a wallet that keeps widening its reach. MetaMask already opened its wallet to autonomous AI agents this summer, and its new independence from Consensys pushes it toward more financial services. Each service it adds also widens the surface open to a security incident.
MetaMask says it will keep monitoring the situation and share more as the investigation moves. Its next update on the security incident will need to say which parts of the infrastructure were hit and whether any other wallet service was touched.
Follow the story on Cryptonomic.
