MetaMask has started proactively exiting 17,000 affected Ethereum validators after a security incident, covering more than 523,000 staked ETH worth about $1.4 billion according to the report.
The company said MetaMask wallets face no immediate threat and that the issue is confined to its non-custodial staking operations. It has not released additional details so far.
MetaMask says the issue is limited to part of its infrastructure
In a security update posted on X, MetaMask said: 「We are responding to a security incident affecting part of our infrastructure. At this time, we have identified no immediate threat to MetaMask wallets. As a precaution, we are proactively exiting affected validators within our non-custodial staking operations.」
The announcement prompted others to examine how broad the breach might be.
Researcher says 18 validator rewards went to the wrong fee recipient
0xKaden, a security researcher with Spearbit and Cantina, posted an analysis on X saying block rewards from 18 MetaMask validators were not paid to the correct fee recipient and were instead sent to an address funded by Tornado Cash.
In the same post, he said roughly 17,000 validators were affected. Based on his description, 19 MetaMask validators had won block rewards, and 18 of those rewards were sent to 0x98B9231de84334c1d48BA0b72CF13f92484924A3 rather than the intended recipient.
The report said the address has made no other transactions and holds 0.46 ETH, including a 0.1 ETH funding transaction from crypto mixer Tornado Cash. It received 18 incoming ETH transfers from Titan Relay: Forwarder, which represented the block rewards and were worth less than $1,000 in total.
A 133,300 ETH transfer was also spotted before the statement
On-chain analyst Emmett Gallic said he spotted a transfer of 133,300 ETH from wallets labeled Lubin/ConSensys a few hours before MetaMask published its statement, a move valued in the report at about $360 million.
The article added that there is no suggestion this transfer was suspicious.
Comparison drawn to Kiln’s staking loss last September
The incident was compared with Kiln’s $41 million loss in its SOL staking operations last September. In that case, Kiln also exited all active ETH validators and rotated signing keys, treating related operations as potentially compromised.
Earlier report on a consultant linked to North Korea
The article also cited a July report by Drop Site News saying ConsenSys, the developer behind MetaMask and a company that rebranded as both MetaMask and ConsenSys in early September, had accidentally hired a software developer linked to North Korea as a consultant.
The report did not say that the consultant’s role, which lasted around one month, was connected to the staking operations affected in this incident.
Ethereum’s staking exit queue jumps above 700,000 ETH
MetaMask’s response pushed the ETH staking exit queue to its highest level so far this year.
After MetaMask moved to pull 17,000 validators, the Ethereum staking queue climbed to more than 700,000 ETH. The report said the queue was around 200,000 ETH on Wednesday and had risen above 700,000 ETH by Thursday. The withdrawal wait time increased from three and a half days to nearly two weeks.
Lido said it expects MetaMask ETH to be deposited again after the validators complete an exit, withdrawal, and re-entry cycle. Because of the extended entry queue, that process is estimated to take up to 45 days.
