MetaMask Yanks Validators Off Lido While Onchain Sleuths Chase a $1K Ghost 🕵️

MetaMask is exiting Ethereum validators it operates on the Lido liquid staking protocol after disclosing an "ongoing security incident" affecting part of its infrastructure, the wallet provider and Lido said on Tuesday and Wednesday. In a post on X, MetaMask stated it had "identified no immediate threat to MetaMask wallets" and was "addressing and remediating the issue internally alongside external partners and security advisors." The firm did not specify the nature of the incident.

Lido detailed the impact in a security notice posted to its governance forum, saying MetaMask Staking, formerly Consensys Staking, had begun "precautionary steps to protect client assets related to its operated Ethereum validators," including exiting its ETH validators from the protocol. The exits began Wednesday, and the last of the affected validators are expected to have exited, though not fully withdrawn, by the end of Oct. 7. Lido warned the move will likely result in foregone rewards and possibly downtime penalties if validators go offline to limit further network penalties.

The two firms stressed that the staking arrangement is non-custodial and that MetaMask does not hold withdrawal keys for client stake. Lido Finance developer Will Shannon said the ETH exited from MetaMask Staking-operated validators "is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue." Lido added that no action is required from holders of its stETH liquid staking token and pointed to its distribution of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers against disruption.

Neither MetaMask nor Lido has confirmed what occurred, and it is unclear whether validators that MetaMask runs outside of Lido are affected. Cointelegraph reached out to MetaMask but did not receive an immediate response.

Independent onchain analysis, which neither company has confirmed, suggests the financial exposure was small. A researcher using the handle Kaden said 19 MetaMask validators had won block rewards and that 18 of those payments were routed to an address funded through the Tornado Cash mixer rather than the correct fee recipient, amounting to roughly 0.36 ETH, under $1,000 at current prices. The same analysis indicated about 17,000 validators holding some 523,000 ETH remain on the network. This is a developing story.