MetaMask security incident forces Ethereum staking exits, no funds at risk

What it is

A fee-recipient (block-reward payout address) compromise on MetaMask's Ethereum staking infrastructure, disclosed October 1, 2026. Security researcher Kaden identified the mechanism via on-chain analysis on X.

How it works

Fee-recipient address and withdrawal credentials are separate parameters on an Ethereum validator. The fee-recipient controls where transaction-fee payments go when the validator produces a block; it can be changed without touching the withdrawal address that controls the staked principal. Attackers altered MetaMask's fee-recipient configuration, redirecting block-production rewards. Kaden traced 18 of 19 sampled MetaMask-operated validators' rewards to an unexpected address, estimating ~0.36 ETH diverted total — the scope of the actual theft was small despite the large precautionary response.

Preconditions / Affected

Applies to Ethereum validators where an operator's fee-recipient credentials can be modified independently of withdrawal keys — i.e., any staking-as-a-service setup with this separation (MetaMask, and by extension any similar operator model). Withdrawal credentials and staked principal were not reported compromised.

What to do

MetaMask does not publish a user command or configuration fix in the article — the response was fully operator-side. Reported actions:

• MetaMask precautionarily exited the affected validators (~17,000 validators, ~523,000 ETH, per Kaden's unconfirmed estimate).
• Lido confirmed those validators are leaving its pool, with full exit expected by Oct. 7, and withdrawal/re-entry taking up to ~45 days due to Ethereum's entry queue.
• Lido stated stETH holders need take no action — pooled-stake token holders are insulated from the operator-level issue.
• Ethena separately pulled ~$75M (RLUSD vault) and ~$60M (PYUSD vault) from Morpho as a precaution unrelated to direct exposure, and redeployed after clarity — illustrating contagion-style caution rather than confirmed shared risk.

Engineers running their own validators or evaluating staking operators should treat fee-recipient credential isolation/rotation as a distinct control from withdrawal-key security — this incident is a concrete case of that boundary being exploited independently.

Caveats

MetaMask had not confirmed the 17,000-validator/523,000 ETH figures or disclosed how its systems were compromised as of Thursday afternoon (Asia time). Neither MetaMask nor Lido reported any slashing event, though the article notes fee-recipient compromise alone can enable conflicting-record approval that triggers slashing if mishandled. The Joseph Lubin-linked $356M wallet transfer and the Ethena/Morpho withdrawals are reported as coincident, not confirmed-connected to this incident.