MetaMask Exits Lido Validators After Infrastructure Compromise, Says Wallets Face No Immediate Threat

MetaMask said it is responding to "an ongoing security incident affecting part of our infrastructure" and is exiting Ethereum validators run by its staking business as a precaution, according to a statement posted at 23:35 UTC on September 30. The company said it has "identified no immediate threat to MetaMask wallets."

The incident sits within MetaMask's non-custodial staking operations, the validator business formerly known as Consensys Staking. MetaMask said it is "proactively exiting affected validators" and remediating the issue internally with external partners and security advisors. It stressed that it does not manage withdrawal keys for stake on behalf of clients, which means the operator signs for validators but cannot move the underlying stake. MetaMask has not said which systems were compromised, how the breach happened or whether any user data was exposed.

The exits are concentrated in Lido. In a security disclosure on Lido's governance forum, MetaMask Staking said it had begun exiting its validators in the protocol "following an investigation into an infrastructure compromise," with the final validators expected to be exited, though not fully withdrawn, by the end of October 7. Neither post said how many validators or how much ETH is involved.

No action is required from stETH holders, according to the disclosure. The cost falls on rewards instead. Exited ETH will return to Lido gradually as validators complete the exit, withdrawal and re-entry cycle, which is estimated to take up to 45 days because of the long validator entry queue. The disclosure also warned of possible downtime penalties if validators are taken offline before they exit, a step MetaMask may take to limit slashing risk. Lido pointed to its spread of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers.

Lido has handled this kind of exit before. In September 2025, staking provider Kiln exited roughly 5,726 validators across networks after a compromised GitHub token allowed an attacker into its infrastructure, an incident that ended with a customer losing funds on Solana. Lido's later analysis put the cost of Kiln's exit at about 207 ETH in missed protocol rewards. The same operator, then under the Consensys name, also mistakenly exited 125 Lido validators in 2023 and compensated stakers for the lost rewards.

MetaMask said a full investigation is underway and that it will share updates as they become available. The main open questions are what part of MetaMask's infrastructure was breached and whether the compromise reached beyond the staking operation.