MetaMask said it is investigating a security incident affecting part of its infrastructure and has begun precautionary exits from affected Ethereum validators, adding that it has identified no immediate threat to MetaMask wallets.

The disclosure came on Sept. 30, when the company said it was working with external partners and security advisers to address and remediate the issue. According to an official user update published by MetaMask, the company has not disclosed which system was compromised, how the incident occurred, or whether attackers gained access to customer information.

Validator exits underway

MetaMask said the precaution targets validators within its non-custodial staking operations. The company also emphasized that it does not manage withdrawal keys for customers' staked assets. In non-custodial staking arrangements, the service operator runs validator infrastructure on users' behalf, while users retain control of the keys required to withdraw their staked funds.

Lido, a liquid staking protocol on Ethereum, separately confirmed that MetaMask Staking had started exiting Ethereum validators operated through its protocol. The affected validators are expected to complete the exit process by Oct. 7. An exit removes a validator from Ethereum's active set, ending its participation in the network's block proposal and attestation duties while the investigation proceeds.

The move could temporarily reduce staking rewards associated with the exiting validators. Lido noted that the ETH must pass through Ethereum's exit and withdrawal process before it can return to staking. Because of the current validator entry queue, the full exit, withdrawal and re-entry cycle could take up to about 45 days; Ethereum's protocol caps how many validators can enter or exit the network within a given period, which is what creates these queues. Validators that go offline before completing their exits could also face downtime-related penalties.

What remains unknown

MetaMask has not disclosed the number of affected validators or the amount of ETH involved. The company has also not said whether the infrastructure incident affected systems beyond its staking operation.

For wallet users, MetaMask's current assessment separates the infrastructure incident from direct wallet security, and the company says it has found no immediate threat to wallets while the investigation continues.

MetaMask said it will continue monitoring the situation and provide additional updates as appropriate. The incident remains under investigation, with the scope and technical cause of the compromise still unresolved. The near-term markers to watch are the completion of the validator exits by Oct. 7 and any further disclosure from MetaMask about the investigation's findings.