MetaMask has disclosed an ongoing security incident affecting part of its infrastructure and has begun pulling Ethereum validators run by its staking business offline as a precaution, The Hacker News reported early Thursday. The company said it had found no immediate threat to MetaMask wallets, and liquid-staking protocol Lido confirmed that validators MetaMask operates on its behalf are being exited.

What Happened

MetaMask announced the incident in a post on X at about 23:38 GMT on Sept. 30, according to Crypto Times. The company said it was addressing and remediating the issue internally, working with outside partners and security advisers.

The incident touches MetaMask's non-custodial staking operations, which run Ethereum validators for clients and partners. As a protective step, MetaMask said it was exiting the affected validators in coordination with those clients. It stressed that its staking service does not manage withdrawal keys on clients' behalf, meaning control over staked funds and rewards stays with the stakers rather than with MetaMask's infrastructure.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

Lido said MetaMask had started exiting validators that run within the protocol. These exits are happening outside Lido's normal order, and the last affected validators are expected to complete the exit stage, though not full withdrawal, by Oct. 7. Lido estimated that the full cycle of withdrawing and re-entering could take about 45 days, partly because of a long queue to activate new Ethereum validators.

Why It Matters

Validator infrastructure is a sensitive target because the machines that run validators hold signing keys used to propose and attest to blocks. On Ethereum, a validator that signs conflicting messages can be slashed, losing part of its stake, which is why operators tend to take validators offline quickly when their infrastructure may be compromised. MetaMask has not said whether any validator keys were exposed. The precaution has costs of its own: Lido said exiting validators will likely forgo staking rewards and may incur downtime penalties.

Lido told holders of its stETH token that they do not need to take any action. Crypto Times reported that the protocol keeps a reserve of more than 6,750 stETH to absorb operational losses of this kind. Aave founder Stani Kulechov said markets on the lending protocol were operating normally, according to crypto.news.

Context

MetaMask is one of the most widely used self-custody crypto wallets, and its staking service is operated through Consensys. Crypto Times reported that when the service launched in January 2024 it managed more than $2 billion across about 33,000 validators. The incident comes during a corporate split: Consensys announced earlier in September that it would separate into two independent companies, MetaMask and a new Consensys entity, with completion expected by the end of 2026, crypto.news reported.

It also follows the roughly $387.5 million theft from exchange Bitget in late September, which the exchange attributed to North Korean hackers who entered through zero-days in third-party security appliances. There is no indication so far that the two incidents are connected.

What to Watch

MetaMask has not disclosed the nature of the compromise, which systems were affected, how many validators are involved, how much ETH they hold or whether any user data was accessed. A root-cause report and those figures are the main items to look for. Lido's Oct. 7 target for completing exits and the roughly 45-day path back to full operation will show how much the precaution costs stakers in lost rewards and penalties. Both companies say their investigations are continuing.