This week started with an ugly headline for Ethereum stakers. MetaMask pulled part of its staking setup offline after a security incident. The company said it found no immediate threat to MetaMask wallets. That line matters. But it does not tell the whole story. A researcher says block payments from MetaMask validators landed at an address nobody expected. Lido, the liquid staking protocol, started warning about lost rewards. If you stake ETH, hold stETH, or just keep a MetaMask wallet, you want the facts straight. Here is what we know so far, and what we still don’t.
What Actually Happened in the MetaMask Security Incident
MetaMask disclosed the incident on Wednesday. It said part of its infrastructure was affected. As a precaution, it exited affected validators. Validators are the machines that check Ethereum transactions and propose new blocks. Security researcher Kaden then posted his own analysis on X. He found that 18 of 19 MetaMask operated validators that earned block payments sent them to an unexpected address. His estimate of the diverted amount is about 0.36 ETH. At current prices that is roughly a thousand dollars. Tiny, yes. But the size of the diversion is not the point. The point is that something changed where the money goes.
Why a Fee Recipient Address Matters
Here is the technical bit, kept simple. Staking has two separate destinations. One is where your original stake goes when you withdraw. The other is where block rewards and transaction fees get paid. Ethereum sets them separately. Changing the second one can divert income without touching the staked coins. That fits what Kaden saw. It also explains how MetaMask can say wallets face no immediate threat while still shutting validators down. The scarier scenario is slashing. Someone controlling validator credentials could make a validator sign conflicting records. Ethereum would then destroy part of the stake. Neither MetaMask nor Lido has reported that happening.
Key Numbers at a Glance
- About 17,000 validators holding roughly 523,000 ETH are being exited, per Kaden’s estimate. MetaMask has not confirmed it.
- Around 0.36 ETH in block rewards was reportedly diverted.
- Lido expects the last affected validators to stop staking by October 7.
- Getting back into staking can take up to about 45 days.
- Lido says stETH holders need to take no action.
How Big Is This, Really?
Do the math. 523,000 ETH at about $2,700 per coin is roughly $1.4 billion. That is a lot of staked value to move in one go. But remember the source. This figure comes from one researcher, not from MetaMask. Treat it as an estimate until the company confirms it. Also note the contrast. The reported loss is under a thousand dollars. The precaution covers over a billion. That gap tells you how MetaMask is thinking. It chose a cautious, expensive response over a slow investigation. Honestly, that is the right call when the cause is still unknown and the keys that control payouts may be exposed.
What Lido Stakers and stETH Holders Should Know
Lido said MetaMask operated validators began leaving its system early Wednesday. The last ones should stop staking by October 7. That does not mean the ETH is back in hand by then. Withdrawing and staking again can take up to about 45 days because of the entry queue. During that time, those validators earn nothing. They could also face penalties if taken offline before finishing their exits. For stETH holders, the message is simple. Lido says no action is required. Your token still represents pooled stake plus accumulated rewards. The cost, going by what Lido has said so far, is missed rewards, not lost principal.
The Side Moves Nobody Can Fully Explain
Markets noticed other things at the same time. Lookonchain reported that a wallet it links to Ethereum cofounder Joseph Lubin moved 133,298 ETH, worth about $356 million, to a new address. Nobody has tied that to MetaMask’s response. Ethena also pulled money from Morpho, including about $75 million from an RLUSD vault and $60 million from a PYUSD vault. A source close to Ethena called it precautionary. Onchain data shows the funds have since been redeployed. Correlation is not causation. Still, quick moves like these show how jumpy large players get when a major wallet brand mentions a security problem.
Is MetaMask Safe to Use Right Now?
Based on what has been disclosed, the wallet itself is not the reported problem. MetaMask says it found no immediate threat to wallets. Staking infrastructure is a different layer from the app on your phone. Still, I would not relax completely. The company has not explained how its systems were compromised. Until it does, you are trusting a statement, not a post mortem. That is normal in the first couple of days of any incident. Just do not read “no immediate threat” as “no threat”. Wording like that is careful for a reason, and careful wording deserves a follow up.
What You Should Do Now
- Check official MetaMask and Lido channels for updates, not social media replies.
- If you stake through MetaMask directly, expect exit notices and a gap in rewards.
- Revoke old token approvals you no longer use.
- Watch for phishing. Scammers love headlines like this one.
- Never share your seed phrase with anyone offering “help”.
The Bigger Lesson for Ethereum Staking
Staking is sold as passive income. This week shows the catch. Someone still runs the hardware. Someone still holds the keys that control reward payouts. When that operator has trouble, you feel it even if your coins stay safe. That is the real risk in managed and liquid staking. It is operational, not mathematical. Spreading stake across many node operators helps limit the damage from any one of them, and Lido works that way. Whether that spread was enough here depends on facts we do not have yet. Ask your provider who actually runs the validators. Most people never do.
What to Watch Next
Three things will show how serious this was. First, whether MetaMask confirms Kaden’s numbers of 17,000 validators and 523,000 ETH. Second, whether it publishes a clear explanation of how its systems were compromised. Third, whether any slashing shows up onchain. So far nobody has reported it. Also watch the exit queue. Large exits and returns can stress the staking pipeline for weeks. Lido expects the last MetaMask operated validators to stop staking by October 7. After that, the wait of up to 45 days begins for anyone who wants back in. Mark that date. It is the next real checkpoint.
