MetaMask Responds to Security Issue

MetaMask is currently addressing an “ongoing security incident” that has impacted a portion of its infrastructure. The company has begun to withdraw its Ethereum validators from the Lido staking protocol as a precautionary measure, although it has not indicated whether other validators are affected.

According to Lido, no action is required from stETH holders, but the return of Ethereum may take as long as 45 days.

MetaMask stated that it has found “no immediate threat to MetaMask wallets,” and it’s working on resolving the issue both internally and with external partners and security experts. The company is exiting the affected validators within its non-custodial staking operations while coordinating with clients and partners.

Security Update: We are responding to a security incident affecting part of our infrastructure. At this time, we have identified no immediate threat to MetaMask wallets. As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…

— MetaMask 🦊 (@MetaMask)

MetaMask Staking, which was previously known as Consensys Staking, manages validators on Lido, the leading liquid staking protocol on Ethereum. Lido disclosed the exits in a security notice posted late on Tuesday, mentioning that the cause is an infrastructure compromise currently under investigation.

It’s important to note that this withdrawal from the staking protocol may lead to missed rewards and possible downtime penalties if validators need to go offline in the coming days to mitigate network risks. The relevant validators are in the process of withdrawing, and it’s expected they’ll be fully out by the end of October 7. Neither firm has clarified whether other validators managed by MetaMask might be involved.

Following an investigation into an infrastructure compromise, MetaMask Staking has taken precautionary steps to protect client assets related to its operated Ethereum validators. These steps include exiting its Ethereum (ETH) validators in the Lido…

— Lido (@LidoFinance)

Retrieving the Ethereum stake will take a significant amount of time. Lido indicated that the exit process will be gradual, with validators needing to navigate through exit and withdrawal phases, which could take up to 45 days due to the prolonged queue for Ethereum entries.

Both MetaMask and Lido emphasized that their staking method is non-custodial, meaning that MetaMask does not hold the withdrawal keys for client stakes. Lido assures that holders of stETH, its liquid staking token, need to take no action and is relying on a diverse range of node operators and an emergency reserve fund of over 6,750 stETH to buffer against disruptions.

Interestingly, independent on-chain analysis suggests the amount taken could be minimal. Researcher Kaden noted that 19 MetaMask validators had received block rewards, but 18 of those payments were mistakenly channeled to an address linked to the Tornado Cash mixer instead of the rightful fee recipient, totaling about 0.36 ETH, which is under $1,000 at current market prices.

According to Kaden’s analysis, around 17,000 validators holding about 523,000 ETH—valued at around $1.4 billion—are being exited as a precaution. There are still 821 validators who potentially remain impacted. It remains uncertain if the attacker had the capability to adjust fee recipients across the entire group, with indications that they likely did not possess the ability to withdraw staked ETH, although there could be implications for validators depending on how access was gained.

Aave founder Stani Kulechov remarked that Aave is monitoring the situation alongside Lido, confirming that there has been no impact on Aave markets, where stETH is a commonly used form of collateral. Meanwhile, Ethena founder Guy Young stated that their USDe synthetic dollar does not currently include direct exposure to stETH or any other liquid staking tokens and that he does not expect any significant impact.

This incident marks the second occurrence of this nature involving a major Lido operator within just over a year. Last September, Kiln also exited all its Ethereum validators after discovering a potential infrastructure compromise, just days following an incident with SwissBorg.

Neither MetaMask nor Lido has disclosed any specific details regarding what exactly was compromised or who may be responsible. A thorough investigation is ongoing, with further updates anticipated soon.