Crypto wallet giant MetaMask has “proactively” initiated the exit of 17,000 affected Ethereum validators, representing a total of over 523,000 staked ETH ($1.4 billion), following a security incident.
It stressed that its wallets faced “no immediate threat,” and that the issue was confined to its “non-custodial staking operations.”
The firm has so far provided no further details, but the worrying news prompted others to investigate the scope of the breach.
Security Update: We are responding to a security incident affecting part of our infrastructure.
— MetaMask
At this time, we have identified no immediate threat to MetaMask wallets.
As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…(@MetaMask) September 30, 2026
Read more: Bitget’s eighth birthday ends with a $352M hack
Spearbit and Cantina security researcher 0xKaden posted an analysis of the incident to X, noting that block rewards from 18 MetaMask validators were “not paid to the correct fee recipient but instead to this tornado [Cash] funded account.”
The suspicious address has made no transactions and holds 0.46 ETH, including its funding of 0.1 ETH from crypto mixer Tornado Cash.
It has received 18 incoming ETH transfers (block rewards) from Titan Relay: Forwarder, worth less than $1,000 in total.
On-chain analyst Emmett Gallic spotted a sizable 133,300 ETH transfer coming from wallets labelled “Lubin/ConSensys,” worth $360 million a few hours before MetaMask’s statement, though there’s no suggestion this is a suspicious transfer.
Read more: SwissBorg CEO blames $41M loss on staking partner Kiln
The incident bears a striking resemblance to last September’s $41 million loss from Kiln’s SOL staking operations.
In that case, the firm also exited all active ETH validators and rotated their signing keys, treating all related operations as “potentially compromised.”
UnMasked
In July, Drop Site News reported that ConsenSys (MetaMask’s developer, which rebranded as both MetaMask and ConsenSys in early September) “accidentally hired a software developer linked to North Korea… as a consultant.”
However, the report doesn’t suggest that the consultant’s role, which lasted around a month, was related to the affected staking operations.
Read more: Staked ETH exit queue reaches 45 days, highest in over two years
Unstaked
MetaMask’s response has led to a spike in the ETH staking exit queue, which has hit its highest level so far this year.
The queue leapt from around 200,000 ETH on Wednesday to over 700,000 ETH on Thursday, bumping the withdrawal wait time from three and a half days to almost two weeks.
Liquid staking provider Lido expects MetaMask ETH to be re-deposited following the validators’ “exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post MetaMask unstakes $1.4B of ETH after validator rewards stolen appeared first on Protos.
