MetaMask is removing its Ethereum staking operations following a security breach, while Lido cautions about potential reward losses and a security analyst notes that block creation payouts were rerouted to an alternative wallet.
The digital asset wallet provider, which also delivers staking solutions, reported on Wednesday that the event impacted part of its system framework, noting that it withdrew vulnerable validators—the nodes that help validate Ethereum network operations—as a safety measure.
“At this time, we have identified no immediate threat to MetaMask wallets,” the organization noted.
Ethereum security analyst Kaden shared on X that 18 out of 19 MetaMask-managed validators responsible for block production rewards sent those earnings to an unexpected destination. He estimated that roughly 0.36 ETH had been redirected.
Kaden’s evaluation suggested that approximately 17,000 validators containing about 523,000 ETH were undergoing withdrawal. As of Thursday afternoon in Asia, MetaMask had not verified those numbers or released a breakdown detailing how its network was breached.
Staking enables holders to generate ETH by locking up their tokens to support network security. Providers such as MetaMask manage the underlying hardware, whereas users maintain independent control over the ultimate destination for withdrawing their locked coins.
A validator also features a dedicated address for collecting transaction fee rewards when successfully building a block. Altering this endpoint can redirect earnings without modifying where the principal funds go upon withdrawal. The Ethereum protocol designates these endpoints separately.
An entity controlling those credentials could potentially force a validator to endorse contradictory state data, initiating a penalty known as slashing, where the network burns a portion of the stake and ejects the validator. Neither MetaMask nor Lido has indicated that this occurred.
Revenue Loss During Validator Departures
This precautionary shutdown incurs expenses even if the locked capital remains secure.
Lido, a platform aggregating user ETH for staking, announced early Wednesday that validators managed by MetaMask had started exiting its network. The final batch is projected to halt staking operations by October 7, though their ETH may not be fully withdrawn by that date.
Withdrawing these assets and re-staking them could require up to roughly 45 days due to the activation queue within Ethereum’s staking architecture. The affected validators would forfeit earnings during downtime and might face penalties if taken offline prematurely before finishing their exit sequence.
“No action is required from stETH holders,” Lido stated. The stETH asset represents customer pooled stakes along with accrued incentives.
Read More: MetaMask adds ‘pooled staking’ for cheaper Ethereum validation
Significant wallet transactions also caught attention during the disclosures. Onchain monitoring service Lookonchain revealed that a wallet associated with Ethereum co-creator Joseph Lubin transferred 133,298 ETH, valued near $356 million, to a fresh address. It remained uncertain whether this transfer linked to the MetaMask response.
Ethena, the firm behind the pegged USDe asset, likewise pulled capital from the decentralized lending protocol Morpho amid the security disclosures. Documented movements involved about $75 million from a vault holding Ripple’s RLUSD stablecoin alongside $60 million from another containing PayPal’s PYUSD.
An individual close to Ethena noted that the withdrawals were executed as a precaution. Blockchain records show Ethena has subsequently redeployed the funds after gaining clarity on the situation.
Originally published at https://www.coindesk.com/tech/2026/10/01/metamask-security-incident-forces-ethereum-staking-exits-with-lido-warning-of-lost-rewards.
