About 17,000 Ethereum validators holding roughly 523,000 ETH, worth around $1.4 billion, are being exited after a security incident at MetaMask’s staking business, according to estimates reported by CoinDesk and Decrypt.
MetaMask disclosed on Wednesday that part of its infrastructure had been compromised. It said it had found no immediate threat to MetaMask wallets and was fixing the problem internally with outside partners.
The visible damage is tiny. Ethereum security researcher Kaden found that 18 of 19 MetaMask-operated validators that earned block-production payments sent them to an unexpected address, about 0.36 ETH in total, or roughly $1,000.
The validators run inside Lido, where MetaMask Staking, formerly Consensys Staking, is one of the node operators. Lido said the exits should finish by 7 October and told stETH holders that no action was needed.
Holders are not entirely spared. Lido warned the exits would likely cost rewards, and that getting the ether staked again could take up to about 45 days because of Ethereum’s long entry queue.
Node operators hold signing keys rather than withdrawal keys, which is why an intruder can redirect fees but cannot simply walk off with the stake. This is the second time in about 15 months that a Lido operator has pulled its validators after an incident, after Kiln did the same in September 2025.
What is missing is the explanation. Neither MetaMask nor Lido has said which system was breached, how, or by whom, and MetaMask has not confirmed the researcher’s figures.
The gap between a $1,000 leak and a $1.4 billion exit is the part only MetaMask can explain.
