METAMASK has disclosed an ongoing security incident affecting part of its infrastructure and says it is actively addressing the issue in collaboration with external partners and security advisers. The company reports no immediate threat to MetaMask wallets at this time but is taking precautionary steps to mitigate potential risk.
In line with this, MetaMask is proactively exiting affected validators from its non-custodial staking operations, emphasising that custody of withdrawal keys is not handled on behalf of clients.
The move affects the Ethereum validators operated within the Lido protocol, which MetaMask uses for its staking services. Lido notes that exiting these validators will likely result in foregone rewards and could incur downtime penalties if validators are taken offline to reduce network risk. The process is ongoing, with validators expected to be exited by 31 October 2026, though not necessarily withdrawn. The situation remains fluid as MetaMask and its partners continue remediation.