MetaMask, one of the most widely used self-custodial crypto wallets, has begun removing affected Ethereum validators after identifying a security incident involving part of its infrastructure. The company said it has found no immediate threat to MetaMask wallets and is investigating the incident with outside service providers and security advisers.

In a security update posted on X on September 30, 2026, MetaMask said:

Security Update: We are responding to a security incident affecting part of our infrastructure. At this time, we have identified no immediate threat to MetaMask wallets. As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,… — MetaMask 🦊 (@MetaMask) September 30, 2026

X post: https://x.com/MetaMask/status/2105442300335620460?ref_src=twsrc%5Etfw

The wallet provider has not disclosed the nature, cause or extent of the incident. It said the affected infrastructure is being contained and addressed internally, while the broader response is being coordinated with external service providers and security advisers.

MetaMask scales back validator operations

As a precaution, MetaMask is scaling down the validators operated through its non-custodial staking service. Validators are participants in Ethereum’s proof-of-stake system that stake ETH to help secure the network, a form of infrastructure separate from the wallet application itself. The company said the measure is intended to reduce potential exposure while the investigation continues. It has not reported that user funds wallet users have been compromised.

MetaMask also emphasized the non-custodial structure of its staking model. The withdrawal keys for the assets being staked are not managed by the company.

The company has distinguished the infrastructure incident from its wallet product. MetaMask said it has not identified any apparent immediate issue affecting wallets used through the service, and it has not required users to move funds or take other emergency measures. It said it will continue monitoring the situation and provide additional information if appropriate.

The company’s security update is available at MetaMask’s official website.

Lido reports validator exits

The security measures also affected validators associated with MetaMask Staking and the Lido protocol, a liquid staking service that pools deposits from users into Ethereum validator positions. Lido said MetaMask had begun proactively taking measures involving its Ethereum validators, including initiating withdrawals.

Lido provided timeline updates for the other affected validators and said the final affected validators would exit by October 7, 2021. ETH removed from the affected validators was not expected to be returned to the protocol immediately. Instead, it would gradually become available to the network through the relevant Ethereum processes.

Re-entry may take up to 45 days

After withdrawal, the funds must pass through Ethereum’s validator exit and entry processes. Lido said the current validator entry queue could make the full withdrawal and re-entry process take up to 45 days. Ethereum rate-limits validator activation, so the wait is set by the protocol’s queue rules rather than by either company.

The timeline does not indicate that any ETH has been reported lost. Rather, it reflects the mechanics of withdrawing validators from the Ethereum protocol and subsequently re-entering them.

MetaMask has characterized the validator exits as a precautionary security measure, not as evidence of a security flaw affecting users’ wallets or their ability to withdraw funds.

Source: CryptoNinjas