MetaMask Exits Lido Validators After Infrastructure Compromise; Researchers Put Diverted Rewards at 0.36 ETH
MetaMask said a security incident hit part of its infrastructure and it is exiting affected Lido Ethereum validators, while a researcher estimates 0.36 ETH of block tips was diverted.
Why it matters
The direct loss reported so far is small, under $1,000, but MetaMask is pulling roughly 523,000 ETH of validators out of active staking and Lido says exit and re-entry can take up to 45 days with foregone rewards and possible downtime penalties. MetaMask says no wallet was threatened and no client withdrawal keys were held, so the exposure described is to validator operations rather than user funds.
Where the sources disagree
Number of validators affected and ETH involved
Roughly 17,000 validators holding about 523,000 ETH (Kaden estimate)
CoinDesk, Crypto News Flash, Bitcoin.com News
0 affected validator counts, client balances or confirmed loss figures disclosed
Crypto.News, Crypto.News
Only researcher estimates give the scale of the exits, roughly 17,000 validators and about 523,000 ETH, and MetaMask has not confirmed those figures while public disclosures give no validator count or balance.
Cause of the incident
Undisclosed, no technical details released
Cointelegraph, Crypto.News, Crypto.News, Unchained, Crypto News Flash
Infrastructure compromise under investigation
Decrypt, CryptoPotato
Diverted block tips, apparently less than $1,000
Bitcoin.com News
MetaMask has not disclosed the attack method or the systems involved, while Lido's governance forum notice describes it as an infrastructure compromise under investigation and Bitcoin.com News characterizes the theft as apparently limited to block tips.
Key facts
MetaMask disclosed a security incident affecting part of its infrastructure and said it had identified no immediate threat to MetaMask wallets.
Reported by Cointelegraph
MetaMask began exiting affected validators within its non-custodial staking operations as a precaution.
Reported by Cointelegraph
Lido said MetaMask Staking exited its Ethereum validators in the Lido protocol and that the final validators are expected to be exited, but not fully withdrawn, by the end of Oct. 7, 2026.
Reported by Cointelegraph
MetaMask says it does not hold withdrawal keys for client stake, so it cannot withdraw the underlying funds.
Reported by Crypto.News
Ethereum security researcher Kaden estimated about 0.36 ETH in block-production payments was diverted from 18 MetaMask-operated validators.
0.36 ETHReported by CoinDesk
Bitcoin.com News put the value of the diverted 0.36 ETH at less than $1,000 at roughly $2,700 per ether.
1,000 USDDisputed figureReported by Bitcoin.com News
Researcher Kaden estimated roughly 17,000 validators holding about 523,000 ETH were sent toward the exits, a figure MetaMask has not confirmed.
523,000 ETHDisputed figureReported by CoinDesk
Lido said affected validators could miss rewards during an exit and re-entry process lasting up to about 45 days and that stETH holders do not need to take action.
45 daysReported by CoinDesk
What happened
MetaMask disclosed on Sept. 30 that it was responding to an ongoing security incident affecting part of its infrastructure and had found no immediate threat to MetaMask wallets, and the company said it was addressing the issue internally with external partners and security advisers (Cointelegraph, Decrypt, Unchained, CryptoPotato). As a precaution, MetaMask began exiting affected validators in its non-custodial staking operations, and the validators it operates as a node operator in the Lido protocol are among those being pulled (Cointelegraph, Unchained). Lido disclosed in a governance forum post that the cause was an infrastructure compromise under investigation, said it was taking steps to protect client assets, and said relevant validators have started exiting with the last ones out, though not fully withdrawn, by the end of Oct. 7 (Decrypt, Unchained, CryptoPotato). MetaMask has not shared the attack method, the affected systems, the validator count or the ETH involved (Crypto.News, Crypto.News). Ethereum security researcher Kaden said 18 of 19 MetaMask-operated validators that had earned payments had payments diverted, totalling about 0.36 ETH worth less than $1,000 at roughly $2,700 per ether, and estimated roughly 17,000 validators holding about 523,000 ETH were sent toward the exits; MetaMask has not confirmed those figures (CoinDesk, Bitcoin.com News). Bitquery reconstructed the incident from Ethereum data, found an unauthorized wallet received block tips from 18 MetaMask-operated validators totalling 0.36 ETH, and found no validator slashing, with MetaMask's first exit submitted at 10:46 UTC on Sept. 30 and the first diverted payment appearing 85 minutes later (Crypto News Flash). MetaMask says it does not hold withdrawal keys for client stake, so customers keep control of their funds, and Lido says stETH holders need take no action, though exits can cost rewards and last up to about 45 days (CoinDesk, Crypto.News, Unchained, Bitcoin.com News). Aave founder Stani Kulechov said his markets remain unaffected while teams monitor developments with Lido (Crypto.News).
How the story developed
- Update
MetaMask discloses infrastructure security incident and begins exiting validators
MetaMask said it was responding to an ongoing security incident affecting part of its infrastructure, found no immediate threat to wallets and was exiting affected validators in its non-custodial staking operations.
- Update
MetaMask submits first validator exit; first diverted payment follows 85 minutes later
The first exit was submitted at 10:46 UTC on Sept. 30 and the first diverted block-tip payment appeared 85 minutes later.
- Official statement
Lido discloses the exits in a governance forum notice
Lido said MetaMask Staking had taken precautionary steps to protect client assets, that exits were under way and that final validators are expected out by the end of Oct. 7.
- First report
First report by Cointelegraph
MetaMask exits Ethereum validators amid undisclosed security incident
- Independent corroboration
Independently corroborated by Crypto.News
MetaMask exits staking validators amid security probe
- Update
Researcher Kaden publishes diversion estimate
Kaden said 18 of 19 MetaMask-operated validators that had earned payments had those payments diverted, totalling about 0.36 ETH.
- Update
Bitquery reconstructs the incident from onchain data
Bitquery found an unauthorized wallet received block tips from 18 MetaMask-operated validators totalling 0.36 ETH and found no validator slashing.
- Official statement
Official statement from Bitcoin.com News
Metamask Pulls Validators as Meager ETH Theft Sounds Big Alarm
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 1 Oct 2026, 00:15 UTC: Cointelegraph — 1 independent source, 1 reports
- 1 Oct 2026, 00:35 UTC: Bitcoin Insider — 2 independent sources, 2 reports
- 1 Oct 2026, 05:37 UTC: Crypto.News — 3 independent sources, 3 reports
- 1 Oct 2026, 06:56 UTC: TheNewsCrypto — 4 independent sources, 4 reports
- 1 Oct 2026, 07:06 UTC: CoinDesk — 5 independent sources, 5 reports
- 1 Oct 2026, 09:38 UTC: Decrypt — 6 independent sources, 8 reports
- 1 Oct 2026, 10:14 UTC: Unchained — 7 independent sources, 9 reports
- 1 Oct 2026, 11:05 UTC: CryptoPotato — 8 independent sources, 10 reports
- 1 Oct 2026, 12:30 UTC: Finbold — 9 independent sources, 11 reports
- 1 Oct 2026, 15:45 UTC: Crypto News Flash — 10 independent sources, 13 reports
- 1 Oct 2026, 21:10 UTC: Bitcoin.com News, official — 11 independent sources, 14 reports
Affected entities
Also mentioned: Solana, Ripple, PayPal, PayPal USD
Original sources
Related events
Lido Contributors Unveil Lido Lend, a Morpho Blue Fork for Lower-Risk Lending
Lido contributors announced Lido Lend, a security-focused lending market built on a modified Morpho Blue fork, targeting passive lenders and professional borrowers with isolated markets and deposit screening.
LDO, AAVE, and NVDA Technical Analysis Shows Momentum Exhaustion at Bollinger Band Extremes
Blockchain.News reported that LDO, AAVE, and NVDA each face stalled momentum near their upper Bollinger Bands with MACD histograms flatlining at zero.
Grayscale and Republic offer three sector crypto funds with a $2,500 minimum
Grayscale and Republic are distributing three Grayscale crypto funds covering DeFi, decentralized AI and data networks to eligible investors at a $2,500 minimum.
SEC staff issue FAQs on staking tokens, buybacks and issuer promises to buyers
SEC Division of Corporation Finance staff issued FAQs on Sept. 25 covering staking receipts, buybacks, network upgrades and the profit promises issuers make to token buyers.
VanEck Withdraws Lido stETH ETF Registration After a Year With No Shares Sold
VanEck Digital Assets asked the SEC on October 14, 2026 to withdraw the S-1 for its proposed Lido stETH ETF, filed October 16, 2025, saying it no longer intends to distribute the trust's shares.