MetaMask Hit by Security Breach, Pulls Ethereum Validators

MetaMask announced Wednesday night a security incident affecting part of its infrastructure. As a precaution, the company is initiating the withdrawal of its Ethereum validators operated via Lido. However, it specifies that it has detected no immediate threat to wallets. For now, the origin and extent of the compromise remain unknown.

A preventive withdrawal, not an emergency

Lido regularly updates its validator fleet. This summer, the protocol notably announced its intention to consolidate its 8 million ETH into much fewer validators.

This time, the context is different. In a statement published on September 30 at 11:35 p.m. UTC, MetaMask mentioned a security incident affecting part of its infrastructure. The company nevertheless assures it has identified no immediate threat to wallets.

Soon after, MetaMask Staking, formerly Consensys Staking, confirmed on the Lido governance forum the start of the withdrawal of its ETH validators, following an investigation into a compromise of its infrastructure.

The timeline remains significant. The last withdrawals are expected by October 7. However, this stage does not mean the ETH will immediately return to staking. Between withdrawal, removal, and a possible re-entry, the process could take up to 45 days due to the validator queue.

For stETH holders, no action is necessary. However, MetaMask could experience a temporary drop in rewards. Penalties related to validator unavailability also remain possible if some of them go offline before their full withdrawal.

A pattern already seen at Lido

Preventive withdrawals by operators are a painful routine for Lido, whose massive withdrawals had already weakened the model this year. In September 2025, provider Kiln withdrew some 5,726 validators after the compromise of a GitHub token of an engineer, an intrusion resulting in a loss of funds for a client on Solana. The loss documented by Lido amounts to about 207 ETH in missed rewards.

Other precedents mark the protocol’s history, from Numic in 2024 to InfStones in 2023. MetaMask Staking, then under the name Consensys, had itself mistakenly withdrawn 125 Lido validators in 2023, before compensating stakers. This time, Lido advances its firewalls, a diverse set of operators, and a temporary reserve fund of more than 6,750 stETH.

MetaMask has not disclosed which systems were compromised, how, or if user data leaked. The question of the scope goes beyond staking. The company has launched a full investigation and promises updates; MetaMask news will provide more on the incident.

The episode certainly appears amid a busy context for Consensys, reorganized between consumer wallet and infrastructure activities, with a possible IPO under study since the beginning of the year.

The follow-up depends on two unknowns. The first is the exact origin of the compromise and its possible extension beyond staking. The second is the return of MetaMask among operators once the incident is resolved. The withdrawal mechanics, however, are nothing exceptional. Validator fleets change with the rhythm of risks, and even the Ethereum Foundation has withdrawn more than 17,000 ETH from staking this year.