- MetaMask proactively exited over 523,000 staked ETH ($1.4 billion) across 17,000 validators following a security incident confined to its non-custodial staking operations, with no immediate threat to user wallets.
- On-chain analysis revealed 18 of 19 block rewards were misdirected to a Tornado Cash-funded address, suggesting a fee recipient compromise affecting a subset of validators.
- The incident triggered a sharp spike in the Ethereum staking exit queue, which jumped from roughly 200,000 ETH to over 700,000 ETH, pushing withdrawal wait times from three and a half days to nearly two weeks.
MetaMask announced on Sept. 30 that it proactively exited 17,000 Ethereum validators representing over 523,000 staked ETH ($1.4 billion) after detecting a security incident affecting part of its infrastructure. The firm stressed that user wallets faced no immediate threat and that the issue was confined to its non-custodial staking operations, according to its statement.
Security researcher 0xKaden posted an analysis noting that 18 of 19 block rewards from MetaMask validators were paid to a suspicious address funded by 0.1 ETH from crypto mixer Tornado Cash. That address, holding 0.46 ETH, received 18 incoming ETH transfers from Titan Relay totaling less than $1,000, Etherscan data shows.
On-chain analyst Emmett Gallic spotted a sizable 133,300 ETH transfer from wallets labeled “Lubin/ConsenSys” hours before MetaMask’s statement, though no evidence suggests the transfer was suspicious. The incident resembles last September’s $41 million loss from Kiln‘s SOL staking operations, where the firm exited all active ETH validators and treated related operations as potentially compromised.
In July, Drop Site News reported that ConsenSys had accidentally hired a software developer linked to North Korea as a consultant, though the report does not suggest the consultant’s role was related to the affected staking operations.
The exit queue for staked ETH leapt from around 200,000 ETH to over 700,000 ETH, bumping withdrawal wait times to almost two weeks. Lido expects MetaMask’s ETH to be re-deposited following a cycle estimated to take approximately 45 days due to the extended entry queue.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
