MetaMask Exits $1.4 Billion in Validators After a Staking Incident: What It Means for ETH and stETH Holders

What happened

This week MetaMask disclosed a security incident affecting part of its infrastructure. The wallet itself was not the target; staking was. MetaMask runs Ethereum validators, including as one of the node operators in the Lido protocol. An attacker redirected some of the block production payouts to their own address. Researchers estimate they made off with about 0.36 ETH, less than $1,000.

The amount is trivial, but the response is massive. As a precaution, MetaMask is exiting every affected validator. The company says it has found no direct threat to MetaMask wallets. That means you can keep sending coins from your regular wallet balance or exchange crypto online as before.

The numbers

MetaMask has not confirmed the validator count or the amount of ETH itself: these figures are researchers' estimates based on on-chain data.

Why only rewards were affected

An Ethereum validator has two separate addresses. The first is the withdrawal address: that is where the 32 ETH stake goes back when the validator exits. The second is the fee recipient: it collects the priority fees users pay to get their transactions included, plus MEV, the income from how transactions are ordered in a block.

The attacker got to the second one. They could siphon off the income from blocks the validators produced, but they could not touch the staked ether: the withdrawal credentials are set separately, and the attacker had no access to them. That is exactly why MetaMask calls its staking non-custodial: the operator runs the validator but cannot withdraw the client's ether. It is the same difference you see when you compare a custodial vs non-custodial wallet: with the first, the service controls your ether; with the second, only you do.

Why exiting costs money

Exiting is a precaution, and the price is paid in yield. While a validator works through the exit queue and the ether waits to be withdrawn and then goes through the entry queue again, it earns nothing. Lido warned that the exiting validators will most likely miss out on rewards and may be hit with inactivity penalties. The full cycle, withdrawal plus re-staking, will take about 45 days because of Ethereum's entry queue.

This has happened before. In September 2025, after an incident, the staking provider Kiln exited 5,726 validators, and according to Cryptonomist that cost about 207 ETH in missed rewards.

What stETH holders should do

According to Lido, stETH holders do not need to do anything. stETH represents a share of the whole pool, not of specific validators, and some operators exiting does not change the fact that the token is backed by ether. The missed rewards will be spread across the entire pool and will slightly lower the yield. Lido keeps a reserve of more than 6,750 stETH for cases like this.

What to do if you staked through MetaMask

• There is nothing urgent to do: your ether is tied to the withdrawal address, and the operator cannot move it.
• Only trust updates from official MetaMask channels: the website, the app, and verified accounts.
• Assume your ether will earn less, or nothing at all, for the next month and a half.

Watch out for scammers

A high-profile incident involving a well-known wallet is prime time for phishing. Expect emails and messages like "update your wallet urgently", "confirm your stake", or "move your ETH to a secure address".

• MetaMask will never ask for your Secret Recovery Phrase. Anyone who asks is trying to steal it. For how to keep it safe, see our guide on where to store a seed phrase so you never lose access to your coins.
• Do not sign token spending approvals on sites you reached through a link in an email or a direct message.
• Do not send ether anywhere "for verification", even to an address that looks familiar.

What this says about staking

Staking through a service is a chain of contractors: the wallet, the validator operator, the protocol, plus their servers and keys. A weak link anywhere hits everyone's income, even when the ether itself is safe. September had already become the worst month of the year for crypto hacks, and nearly everything stolen went out through infrastructure, not through people's wallets.

Holding your own keys is still the safest option. If you no longer need the staking yield, you can exchange ETH to bitcoin without registration. VertEXchange doesn't ask for an account, email or phone number, and the coins go straight to your address. If you want transfers without a public history, you can swap ETH to Monero.

FAQ

Is my MetaMask wallet at risk?

According to MetaMask, no direct threat to wallets has been found. The incident hit the staking infrastructure, not the wallet app and not your keys.

Could my staked ETH have been stolen?

No. The attacker redirected the fee recipient, while staked ether goes back to a separate withdrawal address. They managed to take only about 0.36 ETH of block income.

Should I sell my stETH?

Lido says stETH holders do not need to do anything. With some validators exiting, the pool's yield will dip slightly until they return to staking.

When will the validators return to staking?

The last affected validators will stop by October 7. Withdrawing the ether and re-entering staking will take about 45 days because of Ethereum's queue.

How much did this incident cost?

The theft itself was about 0.36 ETH. The missed rewards on roughly 523,000 ETH sitting idle for a month and a half cost far more, but MetaMask has not given an exact figure.