The news
MetaMask, the crypto wallet developed by Consensys, disclosed at the end of September 2026 that it is dealing with an ongoing security incident affecting part of its infrastructure. The company said the incident involves validators in its non-custodial staking operations, and that it is exiting those Ethereum validators from the Lido protocol as a precaution.
Validators are the computers that secure the Ethereum network by locking up, or staking, ether and confirming transactions in return for rewards. Lido is a large staking protocol that lets holders stake ether through professional node operators. MetaMask Staking, formerly Consensys Staking, operates validators through Lido, according to BleepingComputer and The Hacker News.
MetaMask said it has identified no immediate threat to MetaMask wallets, as reported by The Hacker News. It also stressed that its staking operations are non-custodial and that it does not manage withdrawal keys for stake on behalf of clients, according to BleepingComputer. In an October 1 update, MetaMask said there was no evidence that wallets or customer funds had been affected while containment work continued, The Hacker News reported.
According to Lido, quoted by both outlets, the relevant validators began the exit process, with the final validators expected to be exited, but not fully withdrawn, by the end of October 7, 2026. Decrypt reported that about 17,000 validators holding roughly 523,000 ETH are being exited, and that Lido put the full exit, withdrawal and re-entry cycle at up to 45 days. The outlets reported that the move could mean forgone rewards and possible downtime penalties.
MetaMask did not say which systems were affected or how the compromise happened. It said it is working with external security partners and advisors, and it did not disclose numbers of affected users or any financial losses, BleepingComputer reported. Independent on-chain analysis cited by Decrypt suggested that rewards from 18 of 19 blocks proposed by MetaMask validators were sent to an address other than the correct fee recipient, about 0.36 ETH in total, or under $1,000; MetaMask has not confirmed that finding. The company advised users to stay alert, never share their Secret Recovery Phrase and rely on official channels for updates, The Hacker News said.
The numbers
- Validators being exited (Decrypt)
- About 17,000
- ETH staked in those validators (Decrypt)
- About 523,000
- Final validator exits expected
- By end of October 7, 2026 (per Lido)
- Rewards reportedly diverted (on-chain analysis)
- About 0.36 ETH
Why CEOs should care
For CFOs and treasurers with digital-asset exposure, the key point is that staking runs through a chain of providers. Your ether may sit with a custodian, be staked through a protocol like Lido and be run by an operator like MetaMask Staking. An incident at any link can cost you rewards or trigger penalties even if your keys are safe. Ask your custodian or staking provider which operators run your validators, what happens to rewards during a forced exit, and who bears any penalties.
For CISOs, a wallet name that millions of people recognize is also a magnet for phishing. When a well-known crypto firm discloses an incident, scammers often pose as support staff. Remind staff who handle crypto that no legitimate provider asks for a recovery phrase, and route all incident updates through official channels only.
For boards and risk committees, MetaMask has not said what was accessed, and the incident is described as ongoing. Treat the company's statements as preliminary. Third-party risk reviews for digital-asset providers should cover incident disclosure terms, key management and how quickly a provider can exit validators without loss.
The bigger picture
Non-custodial staking was designed so that operators never hold the keys that control withdrawals, and MetaMask is leaning on that design to reassure users. The incident tests whether that separation holds under pressure. It also shows that the operational side of staking, the infrastructure that signs blocks every few seconds, is a real attack surface even where funds are not directly at risk.
What’s next
Watch for a fuller MetaMask account of what systems were affected, Lido's confirmation that the exits finished by October 7, and whether any validators incur penalties.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
