MetaMask has begun removing affected Ethereum validators from staking after a security incident diverted an estimated 0.36 ETH in block-production payments, according to CoinDesk. The company said it had found no immediate threat to users’ wallets, while the precautionary response could temporarily interrupt staking rewards for validators holding about 523,000 ETH.
What happened inside MetaMask’s staking operation
MetaMask said the incident affected part of its infrastructure and that it had exited the affected validators as a precaution. The company has not confirmed the size of the validator group identified by an outside researcher, nor has it explained how its systems were compromised as of Thursday afternoon in Asia.
Ethereum security researcher Kaden said on X that 18 of 19 MetaMask-operated validators that had received payments for producing blocks sent those payments to an unexpected address. Kaden estimated that approximately 0.36 ETH had been diverted.
The researcher also estimated that around 17,000 validators holding roughly 523,000 ETH were being withdrawn from staking. MetaMask has not verified those figures. The reported movement involves a large amount of staked ether, but the incident described so far concerns payment credentials and the process of taking validators offline, rather than a reported loss of customers’ deposited stake.
MetaMask said: “At this time, we have identified no immediate threat to MetaMask wallets.” Neither MetaMask nor Lido has reported that any validator was slashed, an Ethereum penalty that can destroy part of a validator’s stake and remove it from service.
Why the response may affect rewards
Ethereum staking allows ether holders to commit their coins to the network’s security operations in exchange for rewards. Validators are the computers that help verify transactions and perform other network duties. Companies such as MetaMask can operate those systems for customers, while control over where staked coins can ultimately be withdrawn remains separate.
A validator also has a distinct destination for payments linked to transaction fees and block production. If an attacker gains control of the relevant credentials, those payments can potentially be redirected without changing the address that controls the original stake when it is withdrawn. That separation is central to why the reported diversion of block-production income does not, by itself, establish that the underlying 523,000 ETH was lost.
The precautionary exits nevertheless carry an economic cost. Validators do not earn staking rewards while they are out of service, and they could face penalties if they are taken offline before completing the exit process.
Lido, which pools customers’ ether for staking, said MetaMask-operated validators had started leaving its system. The final affected validators were expected to stop staking by October 7, although that date does not necessarily mean the ether will already have been withdrawn.
Lido said withdrawing the coins and returning them to staking could take up to about 45 days because of Ethereum’s queue for re-entering the staking system. The length of the process means the affected validators may miss rewards during both the exit and re-entry stages.
Lido also said holders of stETH, its token representing pooled staked ether and accumulated rewards, do not need to take action. The statement distinguishes the operational response involving validators from any required response by stETH holders.
Other wallet movements and current market picture
The disclosures were followed by attention to several large on-chain transactions. Blockchain tracker Lookonchain reported that a wallet it associated with Ethereum co-founder Joseph Lubin transferred 133,298 ETH, valued at about $356 million, to a new address. It was not immediately clear whether that transfer was connected with MetaMask’s response.
Ethena, the company behind the dollar-linked USDe token, also withdrew funds from Morpho during the security disclosures. Reported withdrawals included about $75 million from a vault holding Ripple’s RLUSD stablecoin and $60 million from another holding PayPal’s PYUSD. A source close to Ethena described the withdrawals as precautionary, and on-chain data showed that Ethena later redeployed the funds after receiving more clarity about the situation.
Moneyiar market data at 08:58-08:59 on October 1, 2026, showed Ethereum at $2,685.3947473573, up 0.57% over 24 hours and 0.73% over seven days. Shiba Inu was at $0.0000057483, down 0.58% over 24 hours and up 1.60% over seven days. Uniswap traded at $9.0203187816, up 2.32% over 24 hours but down 1.16% over seven days, while Pepe stood at $0.0000043347, up 0.50% over 24 hours and 0.16% over seven days.
The available disclosures therefore point to a precautionary operational shutdown, possible lost staking income and an investigation into infrastructure security. MetaMask has not publicly detailed the compromise or confirmed the researcher’s estimates, leaving the scale and technical cause of the incident unresolved.
