Threat watch / Attack
MetaMask Staking: attacker redirects validator rewards after reaching part of its infrastructure
MetaMask found unauthorized access to part of its infrastructure on September 28. The attacker briefly changed the addresses that receive execution-layer staking rewards for some validators and diverted about 0.385 ETH. MetaMask says wallets, recovery phrases, private keys, staked principal and withdrawal keys were not compromised. How the attacker got in is not public.
- Sector
- Finance
- Way in
- Not public yet
- Product or vendor
- MetaMask
- staking rewards diverted[1]
- 0.385 ETH
- How it happened
- MetaMask says the attacker had "unauthorized access to infrastructure where these addresses were centrally stored" and "briefly altered the addresses used to receive execution-layer staking rewards for certain validators". It does not say how the attacker got that access.[1] Checked 8 Nov 2026
- What was stolen
- About 0.385 ETH in staking rewards, according to MetaMask. It says it found no evidence that staked principal or withdrawal keys were compromised, and that Secret Recovery Phrases and private keys were not affected.[1] Checked 8 Nov 2026
- Who was impacted
- Customers of MetaMask Staking: all of its affected Ethereum validators were exited as a precaution. MetaMask says some faced temporary withdrawal delays and is working with affected customers and partners. MetaMask wallet users need no action. No count of affected validators or customers is public.[1][2] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- MetaMask identifies a security incident involving unauthorized access to part of its infrastructure. [1]
- MetaMask discloses an ongoing incident and starts exiting affected validators in its non-custodial staking operations as a precaution, saying it sees no immediate threat to MetaMask wallets. [1][3]
- MetaMask's update: about 0.385 ETH in execution-layer rewards was diverted, all affected validators have exited, and no wallet, key or staked principal was compromised. [1][2]