MetaMask began withdrawing affected Ethereum validators from service Wednesday after a security incident diverted an estimated 0.36 ETH in block-production payments to an unexpected address, the cryptocurrency wallet provider disclosed.
The company said it found no immediate threat to users’ wallets. “At this time, we have identified no immediate threat to MetaMask wallets,” MetaMask stated.
Eighteen of 19 MetaMask-operated validators sent payments to the unexpected address, triggering the precautionary exit. The validators are expected to stop staking by October 7. Ethereum staking allows ETH holders to earn rewards by committing coins to help secure the network. MetaMask operates validators, which are computers that check Ethereum transactions, while customers retain separate control over staked coin withdrawal addresses.
Validators have separate addresses for receiving transaction-fee payments when producing blocks. Changing the payment destination diverts income without affecting the original stake withdrawal location. Ethereum sets these destinations separately.
Scope of Validator Withdrawals
Ethereum security researcher Kaden estimated that 17,000 validators are being withdrawn, holding approximately 523,000 ETH combined. MetaMask has not confirmed these figures. The company also has not published an explanation of how its systems were compromised or named the individual or entity that controlled the credentials to divert payments.
Withdrawing and re-staking validators incurs penalties if taken offline before completing exits. The process takes approximately 45 days for validators to exit and re-enter the staking system.
Lido Response and Related Movements
Lido, the staking service that pools users’ ETH, stated that no action is required from stETH holders. Lido’s stETH token represents users’ pooled stake and accumulated rewards. Neither MetaMask nor Lido reported that slashing occurred. Slashing is a punishment triggered when a validator approves conflicting records, destroying part of its stake and removing it from service.
On the same day as MetaMask’s disclosure, blockchain tracker Lookonchain reported a transfer of 133,298 ETH from a wallet linked to Ethereum cofounder Joseph Lubin, worth approximately $356 million.
Precautionary Fund Withdrawals
A source close to Ethena, the company behind the USDe token, said that fund withdrawals from a Morpho vault were precautionary. Approximately $75 million was withdrawn from a Morpho vault holding Ripple’s RLUSD, and $60 million was withdrawn from a Morpho vault holding PayPal’s PYUSD. Ethena has since redeployed the funds.
