MetaMask has begun exiting its Ethereum validators from the Lido staking protocol as a precaution during an ongoing security incident affecting part of its infrastructure. MetaMask said it found no immediate threat to MetaMask wallets. MetaMask said it was addressing the issue internally with external partners and security advisers while exiting affected validators in its non-custodial staking operations. Lido described the cause as an infrastructure compromise under investigation. Lido said the relevant validators had begun exiting and expected the last to have exited, but not fully withdrawn, by the end of October 7. Lido said the exits would likely cost rewards and could cause downtime penalties if validators went offline in the coming days. Lido said the exited stake should return to the protocol gradually through the exit, withdrawal and re-entry cycle. Lido put that cycle at up to 45 days because of Ethereum's extended entry queue. Neither company said whether validators MetaMask runs elsewhere were involved. Both companies said the staking arrangement was non-custodial and MetaMask did not hold withdrawal keys for client stake. Lido said stETH holders need take no action. Lido pointed to its range of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers against disruption. Researcher Kaden's onchain analysis, which neither company confirmed, found that 19 MetaMask validators had won block rewards. Kaden said 18 of those payments went to an address funded through the Tornado Cash mixer instead of the correct fee recipient, totaling roughly 0.36 ETH, or under $1,000 at current prices. Kaden's analysis suggests about 17,000 validators holding some 523,000 ETH, worth around $1.4 billion, are being exited as a precaution. The analysis identified 821 potentially affected validators that had yet to exit. Kaden said it was unclear whether an attacker could alter fee recipients across the entire set. Kaden said the attacker likely never had the ability to withdraw staked ETH, but validators could in principle be deliberately slashed depending on how signing access was obtained. Aave founder Stani Kulechov said Aave was monitoring the situation with Lido and that Aave markets had not been affected. Ethena founder Guy Young said the assets backing its USDe synthetic dollar had no current direct exposure to stETH or any other liquid staking token, and he expected no impact. Kiln exited all its Ethereum validators in September 2025 after identifying what its chief executive called a potential infrastructure compromise. Neither MetaMask nor Lido has said what was compromised, how it happened or who was responsible. An investigation is under way, and further updates have been promised.
MetaMask Exits Lido Validators Amid Infrastructure Security Incident
NS3Share
Summary
MetaMask has started exiting its Ethereum validators from Lido due to a security breach impacting part of the staking protocol’s infrastructure. Lido said the incident is under investigation and confirmed validators are being exited, with the last expected to exit by October 7. A protocol update related to the incident has not been disclosed publicly. Onchain analysis by Kaden suggests 19 MetaMask validators earned block rewards, with 18 sent via Tornado Cash. Around 17,000 validators are exiting, holding 523,000 ETH. Lido warned of possible reward loss and downtime penalties. No details on the breach or responsible parties have been shared.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.