MetaMask unstakes $1.4B of ETH after validator rewards stolen

What it is

A security incident affecting MetaMask/ConsenSys's non-custodial Ethereum staking service, where block rewards from at least 18 validators were misdirected to a Tornado Cash-linked wallet instead of the correct fee recipient.

How it works

Block rewards (validator payments) from the 18 affected validators were routed through Titan Relay's forwarder contract but ended up at an external address rather than MetaMask's fee recipient. That address received 18 incoming transfers totaling less than $1,000, and was itself funded with 0.1 ETH from Tornado Cash. As of the report, the address had made no outgoing transactions and held only 0.46 ETH total — the misdirected amount was trivial relative to the $1.4B response it triggered. Researcher 0xKaden (Spearbit/Cantina) traced this on-chain and published the analysis on X.

Preconditions / Affected

Limited to MetaMask's non-custodial staking operations specifically tied to the Titan Relay forwarding path; MetaMask stated user wallets faced no direct threat. Separately, the page notes that in July, Drop Site News reported ConsenSys had "accidentally hired a software developer linked to North Korea" as a consultant for about a month — the report does not tie that consultant to the affected staking infrastructure, and no causal link is established.

What to do

No remediation steps are given beyond MetaMask's own action (mass validator exit and presumed key rotation, by analogy to the Kiln precedent). For engineers tracking downstream effects: the mass exit pushed the Ethereum validator exit queue from ~200,000 ETH to over 700,000 ETH within a single day (Wednesday to Thursday), and withdrawal wait times from ~3.5 days to nearly two weeks. Lido estimates the full exit-withdrawal-re-entry cycle for MetaMask's stake could take up to 45 days due to the extended entry queue — relevant if monitoring queue depth, re-staking timing, or liquid-staking exposure tied to this cohort of ETH.

Caveats

MetaMask provided no further technical detail beyond its initial statement; the root cause of the misrouted fee recipient (compromise vs. misconfiguration) is not confirmed in the text. The North Korea-linked consultant detail is explicitly flagged by the source report as unconnected to this incident. A separate 133,300 ETH ($360M) transfer from "Lubin/ConSensys"-labeled wallets was spotted hours before the statement, but the page states there is no suggestion this transfer was suspicious.