MetaMask exits Ethereum validators after block rewards were diverted
Serguey Asael Shinder2 min readMetaMask has begun exiting the Ethereum validators it operates after a security incident affected part of its staking infrastructure, CoinDesk reports. The company said it had identified no immediate threat to MetaMask wallets and exited the affected validators as a precaution.
The visible damage so far is small. Ethereum security researcher Kaden said on X that 18 of 19 MetaMask-operated validators that had earned payments for producing blocks sent those payments to an unexpected address, and estimated that about 0.36 ETH had been diverted. His analysis put the precautionary exits at roughly 17,000 validators holding about 523,000 ETH. According to CoinDesk, MetaMask had not confirmed those figures or explained how its systems were compromised as of Thursday afternoon in Asia.
The mechanism matters. A validator has a separate address for receiving fees when it produces a block, and changing that destination diverts income without touching where the staked ETH goes on withdrawal. Someone holding validator credentials could in principle also make a validator sign conflicting messages and trigger slashing, where part of the stake is destroyed; neither MetaMask nor Lido has reported that happening.
Lido, which pools users' ETH and spreads it across operators including MetaMask, said the affected validators began leaving its system on Wednesday and the last should stop staking by 7 October. Exiting and re-entering could take up to about 45 days because of the queue to enter staking, and validators miss rewards while out. Lido said no action is required from stETH holders.
Why it matters
The stake was never at risk in the way a wallet hack puts funds at risk, and that is the point of Ethereum separating withdrawal and fee addresses. The cost is the exit itself: hundreds of thousands of ETH earning nothing for weeks because one operator could not rule out that its keys were exposed.