MetaMask Exits Lido Validators Amid Infrastructure ‘Security Incident’

MetaMask said it is responding to an ongoing security incident affecting part of its infrastructure and has begun proactively exiting the Ethereum validators it operates within the Lido liquid-staking protocol. The company reported no immediate threat to MetaMask wallets and said it is addressing the issue internally with external partners and security advisers. Lido published a security notice confirming the exits and described the root cause as an "infrastructure compromise" under investigation.

Both MetaMask Staking and Lido emphasized that the staking arrangement is non-custodial and that MetaMask does not hold withdrawal keys for client stake. Lido told holders of its stETH token that no action is required and pointed to its distribution of node operators and an ad hoc reserve of more than 6,750 stETH as buffers against disruption. Lido also warned that the exits could lead to foregone rewards and potential downtime penalties if validators go offline while the precautionary steps are taken.

Lido said the relevant validators have started the exit process and that the last of them are expected to have exited, though not fully withdrawn, by the end of October 7. Because of Ethereum's exit, withdrawal and re-entry timing and the protocol's entry queue, Lido estimated the round trip to return exited ETH could take as long as 45 days. Neither firm specified whether MetaMask-operated validators beyond those on Lido are affected.

Independent on-chain analysis — which MetaMask and Lido have not confirmed — suggests financial impact may be small so far. Researcher Kaden reported that 19 MetaMask validators had won block rewards and that 18 of those payments were routed to an address funded through the Tornado Cash mixer rather than the correct fee recipient, totalling roughly 0.36 ETH (under $1,000 at current prices). The same analysis estimated about 17,000 validators holding some 523,000 ETH (roughly $1.4 billion) were being exited as a precaution, with 821 potentially affected validators still to leave. A full investigation is under way and both companies promised further updates.

Market participants and other protocol teams said they were monitoring the situation. Aave founder Stani Kulechov said Aave was watching alongside Lido and reported no impact to Aave markets; Ethena founder Guy Young said his protocol's USDe synthetic dollar did not currently include direct exposure to stETH or other liquid-staking tokens. The incident follows a similar episode in September 2025 when Kiln exited its validators after identifying a potential infrastructure compromise.