In brief
- MetaMask is exiting its staking validators, including those it runs for Lido, after a security incident in part of its infrastructure.
- It says it has found no immediate threat to MetaMask wallets and does not hold clients’ withdrawal keys.
- Lido expects the last exits by Oct. 7 and says the ETH could take up to 45 days to return to the protocol.
MetaMask is pulling its Ethereum staking validators offline after what it calls “an ongoing security incident affecting part of our infrastructure”. In a user update on Sept. 30, the company said it had “identified no immediate threat to MetaMask wallets” and was exiting affected validators “as a precautionary measure”.
What MetaMask has said
The update gives no detail on what was compromised. MetaMask says it is fixing the problem internally with outside partners and security advisers. It also stresses that its staking is non-custodial: it runs the validators, but does not manage the withdrawal keys for clients’ stake. In principle, that keeps the staked ETH out of reach even if the validator infrastructure is compromised.
The public notices do not say how many validators are affected, how much ETH they hold, or how the incident happened. MetaMask’s website puts the staked ETH it manages at more than $3 billion, Cointelegraph reports.
What it means for Lido
MetaMask Staking, formerly Consensys Staking, is one of the node operators running validators for Lido. In a disclosure on Lido’s research forum, Lido said the exits began on Sept. 30, with the final validators due to exit, but not yet be withdrawn, by the end of Oct. 7.
Lido said stETH holders need take no action. Exited ETH will return to the protocol gradually through the exit, withdrawal and re-entry cycle, which could take up to 45 days because of the long entry queue. The exits will probably cost some rewards and could bring downtime penalties if validators go offline. Lido pointed to its spread of node operators and a reserve fund of more than 6,750 stETH to absorb disruption.
Aave founder Stani Kulechov said Aave’s markets were unaffected, crypto.news reports.
Why it matters
The incident hits the infrastructure behind a wallet, not the wallet itself. That is the same layer attackers have targeted at exchanges, as our guide to how crypto exchange hacks happen explains. It also comes weeks after Consensys said it would operate as MetaMask and split off its infrastructure business, crypto.news reports.
Next to watch: MetaMask’s root-cause report, and whether all validators exit by Oct. 7 without penalties.
Sources
- MetaMask, User update, September 30, 2026
- Lido research forum, [Security Disclosure] MetaMask Staking Precautionary Out of Order Exits, September 30, 2026
- Cointelegraph, MetaMask exits Lido validators as it investigates security incident
- crypto.news, MetaMask exits staking validators amid security probe
