A security breach of MetaMask's staking infrastructure allowed an attacker to siphon 18 block rewards, totaling roughly 0.36 ETH, to a Tornado Cash-funded address. On-chain researcher Kaden identified the theft and noted that 821 potentially affected validators remain active, creating a continued slashing risk. In response, MetaMask has begun exiting about 17,000 validators that represent roughly 523,000 ETH to protect client assets.

The company maintains that there is no immediate threat to user wallets and that it does not control customer withdrawal keys. The process of removing its nodes from the Lido protocol is scheduled for completion by October 7, 2026, though a full withdrawal and re-entry cycle may take up to 45 days. Lido warned the exits will likely result in foregone rewards and downtime penalties, while Aave reported no impact to its markets.