MetaMask Discloses Security Incident, Exits Ethereum Validators as a Precaution

MakeCryippreferred on

• MetaMask disclosed a security incident affecting part of its infrastructure and proactively exited affected validators from its non-custodial staking operations as a precaution
• In an October 1, 2026 update, the company said “based on our investigation to date, there is no indication that MetaMask wallets or customer funds have been affected”
• Lido Finance confirmed that MetaMask Staking began exiting Ethereum validators from the Lido protocol in coordination with the response

MetaMask published an update on its official site on October 1, 2026 addressing an ongoing security incident affecting part of its infrastructure, after first disclosing the issue a day earlier with a statement that it had “identified no immediate threat to MetaMask wallets.”

In the October 1 update, MetaMask said its investigation had found no indication that MetaMask wallets or customer funds had been affected, while cautioning that the review was continuing. As a precautionary measure, the company said it is proactively exiting affected validators within its non-custodial staking operations, in coordination with clients and partners, and emphasized that it does not manage withdrawal keys on behalf of clients, a structural detail that limits what an attacker could do even if the affected infrastructure were compromised further.

Lido Finance, the liquid staking protocol, confirmed separately that MetaMask Staking began exiting Ethereum validators from the Lido protocol as a precaution tied to the incident, corroborating that the validator exits described in MetaMask’s own update are already underway on-chain rather than only a stated intention.

MetaMask has not disclosed specific technical details about which infrastructure was affected or whether any data was accessed, and the company said it is working with external partners and security advisors as the investigation continues. In its public guidance, MetaMask reminded users to remain cautious of unsolicited messages referencing the incident, to never share their Secret Recovery Phrase or private keys with anyone, and to rely only on official MetaMask channels for further updates, a standard precaution given that security incidents at major wallet providers routinely draw a wave of phishing attempts targeting worried users.

MetaMask is one of the most widely used self-custody wallets in the Ethereum ecosystem, and any infrastructure incident touching its staking operations draws close attention given how much value flows through validators tied to its services. The non-custodial structure of MetaMask’s staking product, under which the company never holds users’ withdrawal keys, is the specific design feature the company is leaning on to argue that user funds remain secure even while the underlying infrastructure incident is still being investigated.