MetaMask is investigating an undisclosed security incident affecting part of its infrastructure, but it says it has found no immediate threat to user wallets.
The crypto wallet provider said it is working with external security advisers and partners to contain and fix the issue.
MetaMask Exits Affected Validators
As a precaution, MetaMask is exiting affected validators linked to its non-custodial staking operations. The company asserted that it does not control withdrawal keys for client stakes. This means customer assets remain under the control of the respective clients.
Lido separately confirmed the infrastructure compromise and revealed that precautionary steps were taken to protect client assets related to its operated Ethereum validators.
“These steps include exiting its Ethereum (ETH) validators in the Lido protocol, and will likely incur foregone rewards as well as possible downtime penalties should validators be taken offline in the near future to reduce risks related to potential network penalties. Relevant validators have begun the exit process, with the final validators expected to be exited (but not fully withdrawn) by the end of October 7th, 2026.”
The incident comes as a large amount of ETH was moved from a wallet linked to Ethereum co-founder Joseph Lubin. Blockchain tracker Lookonchain reported that the wallet transferred 133,298 ETH, worth over $356 million, to a new wallet. The transfer took place around the same time as MetaMask’s security announcement. However, there is no information showing that the ETH movement is connected to the MetaMask incident.
Potential Risks
There’s already some back-and-forth over how serious the incident really is. For instance, Andy Cavanaugh of The Rollup suggested the situation could be “far worse than people are expecting,” including the possibility of ETH being stuck through a liquid staking provider.
Security researcher Taylor Monahan wasn’t buying it. She called the claim a “crackhead set of assumptions” while arguing that MetaMask’s response looks more like a normal security precaution.
The disruption comes just weeks after Consensys announced a major split that will turn MetaMask into a separate company focused on consumer finance. The restructuring is expected to be completed by the end of 2026, ending more than a decade of MetaMask operating under the Consensys umbrella.
