MetaMask has begun pulling its Ethereum validators out of the Lido staking protocol after what it described as a security incident affecting part of its infrastructure. In a statement on September 30, the wallet developer said it had identified no immediate threat to MetaMask wallets and that it was addressing the issue internally with external partners and security advisors, according to Ambcrypto.
Lido disclosed the validator exits in a security notice on its governance forum, citing an infrastructure compromise under investigation. The liquid staking provider said the incident does not affect users or their operations and projected the exit process could finish by October 7, while warning that returning the ETH could take up to 45 days because of Ethereum’s extended entry queue.
Also read: BitMine Tops 6 Million ETH After $47M Weekly Buy
Key facts
- MetaMask is exiting the Ethereum validators it operates within Lido’s node operator set, citing an ongoing infrastructure security incident.
- Lido said no action is required from holders of stETH, its liquid staking token.
- Lido projected the last validators could have exited, though not fully withdrawn, by the end of October 7.
- Lido pointed to an ad hoc reserve fund of more than 6,750 stETH and its spread of node operators as buffers against disruption.
- MetaMask’s perps volume increased by 2x to $1.6B in Q3, per DeFiLlama data reported by Ambcrypto.
Adding a new precautionary exit
The move makes MetaMask Staking the latest operator to pull the exit lever when security is in question, following Kiln in September 2025, which exited all of its Ethereum validators after identifying what its chief executive called a potential compromise of its infrastructure, Cryptobriefing and Decrypt reported. Kiln was forced to take its validators offline to contain the risk but suffered a $41M loss, Ambcrypto reported.
Cryptobriefing noted that MetaMask plays a double role at Lido: it runs validators inside the node operator set and offers staking interfaces connected to Lido, so users staking ETH through the wallet typically receive stETH as their yield product. The outlet added that ConsenSys, the company behind MetaMask, has its own history with Lido exits — in July 2023, a miscommunication led ConsenSys Staking to accidentally submit exit messages for 125 Lido validators, and users did not lose funds.
Also read: Ethereum's EIP-8363 staking overhaul draws fierce backlash from DeFi and institutions
Independent onchain analysis cited by Decrypt, which neither company has confirmed, offered one estimate of scale. Researcher Kaden said 19 MetaMask validators had won block rewards, with 18 of those payments routed to an address funded through the Tornado Cash mixer rather than the correct fee recipient, amounting to roughly 0.36 ETH, under $1,000 at current prices. The same analysis put about 17,000 validators holding some 523,000 ETH, worth around $1.4 billion, as being exited as a precaution, with 821 potentially affected validators yet to leave. The researcher said it was unclear whether the attacker could alter fee recipients across the whole set.
MetaMask Staking, previously Consensys Staking, did not say whether validators it runs elsewhere are involved, Decrypt reported. Ambcrypto noted that Lido controls 29% of staked ETH, but the amount staked by MetaMask alone is not publicly disclosed.
Why it matters
stETH is among the most widely used forms of collateral in DeFi, so an incident involving one of Lido’s node operators draws attention well beyond the wallet’s own users. Aave founder Stani Kulechov said the lending protocol was watching the situation alongside Lido and that there had been no impact on Aave markets, while Ethena founder Guy Young said the backing assets behind its USDe synthetic dollar did not currently include direct exposure to stETH or any other liquid staking token and that he expected no impact.
The risks for stETH holders turn on whether the incident touches their funds. No impact on stETH holders has been reported, and the orderly exit process is designed to keep it that way. Exiting validators removes them from active duty and shrinks the window in which anything bad can happen with them, Cryptobriefing noted.
Onchain data reported by Ambcrypto showed Joseph Lubin, founder of ConsenSys, the firm behind MetaMask, moved 133K ETH, though it is unclear whether that was tied to the incident. Neither company has said what was compromised, how, or by whom, and a full investigation is under way.
What to watch
The next concrete markers are how long the exits take relative to the typical 15 to 45 day window, whether Lido reallocates stake to other operators, and whether MetaMask outlines plans to return as a validator operator once the incident is resolved. A disclosure on the root cause would also shape how other node operators respond.
Reported by ambcrypto.com.
Sources: AMBCrypto, Cryptobriefing, Decrypt