In brief
- MetaMask is responding to an “ongoing security incident” affecting part of its infrastructure.
- It is exiting the Ethereum validators it operates in the Lido protocol as a precaution, and has not said whether others are affected.
- Lido says no action is required from stETH holders, and that returning ETH may take up to 45 days.
MetaMask is responding to an “ongoing security incident” affecting part of its infrastructure and has begun pulling its Ethereum validators out of the Lido staking protocol as a precaution, the companies said on Wednesday.
The wallet developer said it had identified “no immediate threat to MetaMask wallets,” and that it was addressing and remediating the issue internally alongside external partners and security advisors. It is exiting affected validators within its non-custodial staking operations, working with clients and partners.
Security Update: We are responding to a security incident affecting part of our infrastructure.
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…
— MetaMask 🦊 (@MetaMask) September 30, 2026
MetaMask Staking, previously Consensys Staking, runs validators on Lido, the largest liquid staking protocol on Ethereum. Lido disclosed the exits in a security notice posted to its governance forum on Wednesday, describing the cause as an infrastructure compromise under investigation.
The move will likely mean foregone rewards, Lido said, and possibly downtime penalties if validators go offline in the coming days to limit the risk of network penalties. The relevant validators have started the process, and the last of them are expected to have exited, though not fully withdrawn, by the end of October 7. Lido described the exits as among the steps taken, and neither firm said whether validators MetaMask runs elsewhere are involved.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
These steps include exiting its Ethereum (ETH) validators in the Lido… https://t.co/nsox7h0I5k
— Lido (@LidoFinance) September 30, 2026
Getting the ETH back will take considerably longer. Lido said the exited stake should return to the protocol gradually as validators work through the exit, withdrawal and re-entry cycle, a round trip it put at up to 45 days because of Ethereum’s extended entry queue.
Both firms stressed that the staking arrangement is non-custodial, and that MetaMask does not hold withdrawal keys for client stake. Lido said no action is required from holders of stETH, its liquid staking token, and pointed to its spread of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers against disruption.
Independent onchain analysis, which neither company has confirmed, suggests how little was taken. Researcher Kaden said that 19 MetaMask validators had won block rewards and that 18 of those payments were routed to an address funded through the Tornado Cash mixer rather than the correct fee recipient, amounting to roughly 0.36 ETH, under $1,000 at current prices.
On the same analysis, about 17,000 validators holding some 523,000 ETH, worth around $1.4 billion, are being exited as a precaution, with 821 potentially affected validators yet to leave. The researcher said it was unclear whether the attacker could alter fee recipients across the whole set, and that they “likely never had the ability” to withdraw staked ETH, but that validators could in principle be deliberately slashed depending on how signing access was obtained.
Aave founder Stani Kulechov said the lending protocol was watching the situation alongside Lido, and that there had been no impact on Aave markets, where stETH is among the most widely used forms of collateral. Ethena founder Guy Young said the backing assets behind its USDe synthetic dollar did not currently include direct exposure to stETH or any other liquid staking token, and that he expected no impact.
It is the second such episode at a major Lido operator in just over a year. Kiln exited all of its Ethereum validators in September 2025 after identifying what its chief executive called a potential compromise of its infrastructure, days after a Solana incident involving SwissBorg.
Neither company has said what was compromised, how, or by whom. A full investigation is under way, with further updates promised.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
