MetaMask is taking the Ethereum validators run by its staking business offline after what it described on Wednesday as “an ongoing security incident affecting part of our infrastructure.”
“At this time, we have identified no immediate threat to MetaMask wallets,” the company said, adding that it is working on a fix internally alongside outside partners and security advisors.
This story is an excerpt from the Unchained Daily newsletter.
Subscribe here to get these updates in your email for free
As a precaution, MetaMask said, it has started exiting the validators affected by the incident, working with its staking clients and partners. The company stressed that the staking operation is non-custodial and that it does not hold withdrawal keys for clients’ stake.
MetaMask was known as Consensys Software until earlier this month, when the company split in two and kept the wallet and consumer business under the MetaMask name.
What It Means for Lido
The validators being pulled include those MetaMask Staking runs as a node operator in the Lido protocol. A disclosure posted to Lido’s research forum late Wednesday, and shared by Lido on X, opened: “Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.”
The exits have already begun, and the final validators are expected to be out, though not fully withdrawn, by the end of Oct. 7. The disclosure warned that the move will likely mean missed staking rewards, and that validators could face downtime penalties if they are taken offline in the near future.
“No action is required from stETH holders,” the disclosure said. The ETH coming out of MetaMask Staking’s validators is expected to flow back into Lido gradually as it cycles through exit, withdrawal and re-entry, a process that could take “approximately up to 45 days due to the extended entry queue.”
Lido pointed to its spread of node operators and an ad hoc reserve fund holding more than 6,750 stETH as backstops designed to contain disruptions like this one.
Investigation Continues
Neither MetaMask nor Lido has said what part of the infrastructure was compromised or how the breach was found. “A full investigation is underway, and further updates will be shared as they become available,” the Lido disclosure said.
MetaMask said it will keep monitoring the situation and share more updates as appropriate.
Related Listen: How the Bitget Hack Reopened Crypto’s Fight Over Neutral Infrastructure
