MetaMask says it has found no indications that user wallets or customer funds faced any imminent threat, reaffirming in its latest security update that it remains focused on “containment and verification” steps. In parallel, the company continued the precautionary removal of its Ethereum validators from the Lido staking protocol.

No immediate threat to wallets

While the follow-up update did not go into detail about the security incident, MetaMask said it has seen no indication that customer funds were accessed, based on its investigations through October 1, according to its user update.

MetaMask’s staking service is non-custodial, meaning it does not hold any withdrawal keys for the staking it operates on behalf of clients.

MetaMask Staking, formerly known as Consensys Staking, operates validators inside Lido, the largest Ethereum liquid staking protocol, and has been pulling those validators offline as a precaution. Lido has not specified the exploit either. However, a governance forum post assured stETH holders that no action is required on their part. stETH is the liquid staking token Lido issues to participants, representing their staked Ether while the underlying funds remain locked in the protocol’s validators.

The affected validators are already in the exit queue, with the last expected to exit — though not fully withdrawn — by the end of October 7. Returning that withdrawn Ether to active validator positions will take at least another 27 days and 18 hours, according to the Ethereum validator queue. The wait reflects Ethereum’s design, which paces validator exits and withdrawals through queues that limit how many can process at once — a reason even a routine, precautionary exit can leave staked funds locked for weeks.

A first stress test for a newly independent MetaMask

The incident comes barely three weeks after MetaMask became an independent company. A September 9 announcement confirmed the split into the consumer wallet business, MetaMask, and the protocols and institutional arm, Consensys. Cryptopolitan reported at the time that the separation is set to finalize by year’s end.

MetaMask positions itself as the world’s largest self-custodial financial platform, downloaded more than 100 million times in roughly 190 countries and processing trillions of dollars in cumulative transaction volume.

The episode echoes September 2025, when staking platform Kiln carried out its own “orderly exit” from Ethereum validators after an API it provided was exploited in the roughly $40 million SwissBorg breach. Like MetaMask now, Kiln also insisted that client assets were secure.

MetaMask has not said whether the validators it runs outside Lido are caught up in the current incident, and neither the company nor Lido has detailed the nature of the compromise. MetaMask says it will share more verified information as it becomes available. For anyone tracking the situation, the visible markers ahead are the exit queue clearing by the end of October 7 and any verified updates MetaMask posts through its official channels.

In the meantime, the company reminded users not to share their Secret Recovery Phrase or private keys with anyone, and urged caution regarding any communications that do not come directly from its official channels.