- After revealing a security issue impacting a portion of its infrastructure, MetaMask is removing impacted Ethereum validators from Lido.
- Lido confirmed that stETH holders do not need to take any action, while MetaMask claims that user wallets are not in immediate danger.
- Although the entire withdrawal and re-entry processes may take up to 45 days, Lido anticipates that the impacted validators will leave by October 7.
MetaMask has disclosed a security incident affecting part of its infrastructure and is taking precautionary steps by exiting affected Ethereum validators operated through Lido. The crypto wallet provider said it has identified no immediate threat to MetaMask wallets.
Security Update: We are responding to a security incident affecting part of our infrastructure.
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients, partners and security advisors.
We’ll share further updates as appropriate. https://t.co/0wmhnVFSIL
— MetaMask 🦊 (@MetaMask) September 30, 2026
In a September 30 update, MetaMask said it is working to address the incident with external partners and security advisors. The company also emphasized that its staking operations are non-custodial and that it does not control withdrawal keys for client assets.
MetaMask Begins Precautionary Validator Exits
Lido confirmed that MetaMask Staking has started exiting affected Ethereum validators following an investigation into an infrastructure compromise.
The exits are being handled as “out of order” exits, meaning they were initiated outside Lido’s normal validator exit sequence. Lido said the affected validators are expected to complete the exit process by the end of October 7, 2026.
However, exiting a validator does not mean the staked ETH immediately becomes available. After leaving Ethereum’s active validator set, the ETH must complete the withdrawal process before it can potentially enter staking again.
Lido estimates the complete exit, withdrawal and re-entry cycle could take up to 45 days because of Ethereum’s current validator entry queue.
No Action Required From stETH Holders
Lido said stETH holders do not need to take any action following the incident.
The protocol distributes staked ETH across validators operated by multiple independent node operators. This means stETH is not tied to a single validator or staking provider.
Lido said the precautionary exits could result in some foregone staking rewards. Validators taken offline during the process could also face downtime penalties, although these are different from slashing penalties associated with provable validator misconduct.
The protocol also pointed to its security measures, including an ad hoc reserve fund containing more than 6,750 stETH, while a full investigation continues.
MetaMask Security Incident
MetaMask and Lido have not disclosed which infrastructure systems were compromised, how the incident occurred, how many validators are affected, or the amount of ETH involved.
Neither company has reported compromised withdrawal keys or a direct threat to MetaMask wallet assets based on the information available so far.
MetaMask’s wallet software and its validator staking service are separate products. Its full Ethereum validator staking service launched in 2024, with Consensys Staking operating validators for users depositing 32 ETH.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment