MetaMask has begun exiting affected Ethereum validators after disclosing a September 30 infrastructure security incident. According to reports from crypto.news, the company confirmed it was responding to an ongoing incident affecting part of its infrastructure and was working with external partners and security advisers on remediation. MetaMask stated it had identified no immediate threat to MetaMask wallets, while giving no technical details about the systems involved. As a precaution, the company started exiting affected validators from its non-custodial staking operations. The incident sits within MetaMask's non-custodial staking operations, the validator business formerly known as Consensys Staking, with MetaMask emphasizing it does not manage withdrawal keys for stake on behalf of clients. For everyday users, MetaMask has not asked users to move funds or change any settings, instead planning to share more details as its investigation continues.
Joseph Lubin, Ethereum co-founder and founder of ConsenSys, has provided the third assurance that customer wallets and funds remain unaffected by the security incident. In an X post, Lubin stated "Based on our investigation to date, there is no indication that MetaMask wallets or customer funds in wallets have been affected. You custody and control your own keys. That is how self-custody works. You are fully in control of your own money in MetaMask." The MetaMask team has maintained that they're continuing to "investigate and respond" to the incident affecting "part of its infrastructure," as reported by crypto.news. Lubin emphasized that "We do not publicly discuss the details of an open incident, but we disclose promptly to partners and relevant stakeholders once an issue is sufficiently understood." The incident was first reported on September 30, with the team taking precautionary measures including taking validators offline.
According to Ethereum researcher Kaden, approximately 17,000 validators have exited, translating to about 513,000 ETH total. However, validator queue data shows about 10,500 validators exited (from 884,000 to 873,000), translating to about 336,000 ETH, which may not entirely be linked to MetaMask exits. Over 800 potentially impacted validators were yet to exit as of October 1st. The queued ETH waiting for exit jumped 3x from 205K ETH to 773K ETH by October 1st, surging to 850K ETH a day later, underscoring a spike likely tied to the MetaMask incident. ETH being moved from the overall validator market jumped 4x to +800K ETH in the past few days, according to AMBCrypto. Despite the validator exits, ETH price remained unaffected and consolidated below $2.8K during the period.
The MetaMask incident has significantly impacted Ethereum's staking infrastructure, with Ether waiting to leave staking surging more than fivefold in three days, reaching about 851,000 ETH on October 2 after MetaMask began withdrawing validators. As per CoinDesk analysis, about 786,000 ETH, worth more than $2 billion, remained in the exit queue as of Monday morning, with an estimated wait of nearly 14 days due to Ethereum's network limits. The network restricts validator entry and exit to approximately 57,600 ETH per day to prevent sudden security changes. Ether waiting to enter staking has fallen by more than a quarter since early September, with 1.5 million ETH, worth roughly $4 billion, waiting to enter with an estimated 25-day wait, down from about 2 million ETH and a 35-day wait in early September. Most of the exit queue represents a temporary detour for MetaMask's affected validators, with Lido expecting the process to take up to 45 days for affected validators to return to staking.
Multiple DeFi protocols have assured users that they face no risk exposure to the MetaMask compromise. Stani Kulechov, Aave CEO, clarified that the lending protocol was not facing any contagion risk, stating "We're keeping an eye on this situation alongside Lido. No impact to Aave markets, and everything is operating normally." Similarly, Guy Young, founder of Ethena, assured USDe investors that there was no risk exposure to Lido assets, noting that "USDe backing assets do not currently include any direct exposure to stETH or any other liquid staking tokens. No expected impact on Ethena." However, security analysts have compared the compromise to last year's Kiln incident that affected back-end node infrastructure, which resulted in a $41 million loss despite the company taking validators offline to contain the risk. Following the update, on-chain data showed that Joseph Lubin moved 133K ETH, though it remains unclear whether this was tied to the incident.
