Infrastructure Compromise Prompts MetaMask to Exit Lido Validators

MetaMask is withdrawing Ethereum validators linked to an infrastructure security incident from its non-custodial staking service. Lido expects the last affected validators to exit by October 7, 2026, although returning the associated ETH to active staking could take as long as 45 days.

MetaMask said its investigation has not identified an immediate threat to users’ wallets.

The company said in a recent update that part of its infrastructure was affected by an ongoing security incident. MetaMask is working with outside partners and security advisers to contain and remediate the issue and has begun precautionary exits for validators connected to the affected systems.

MetaMask Staking, previously called ConsenSys Staking, operates Ethereum validators through Lido. Lido’s governance forum said the validator exits began after the operator investigated the infrastructure compromise.

MetaMask handles validator signing but does not hold the withdrawal keys belonging to its customers. The operator therefore cannot directly move the underlying staked ETH on their behalf.

No Action Needed for stETH Holders

Lido said stETH holders do not need to respond to the incident. The affected validators could nevertheless lose rewards while they are being exited or remain inactive.

Taking validators offline before they finish the exit process can also result in downtime penalties. Such a step may be taken as a precaution to reduce potential network-penalty exposure.

The incident shows how a security problem at a crypto infrastructure provider can disrupt staking services even when no exploit of the underlying protocol has been reported.

The size of the incident remains undisclosed. MetaMask and Lido have not provided figures for the affected validator count or the amount of ETH involved.

Previous Lido Exits Show Potential Costs

Lido says its broad distribution of node operators and security measures are designed to reduce the effect of individual service disruptions. Its safeguards include an ad hoc reserve containing more than 6,750 stETH.

The protocol has experienced large precautionary exits before. In September 2025, Kiln exited 5,726 validators across networks after an attacker accessed its infrastructure using a compromised GitHub token. Lido later estimated that the incident resulted in approximately 207 ETH in missed rewards.

In 2023, Kiln’s predecessor under the Consensys name mistakenly exited 125 Lido validators and later compensated affected stakers for their lost rewards.

Those events provide historical context for the potential cost of validator exits, but they do not show that MetaMask’s current incident used the same attack route or will produce the same result.

Ethereum’s validator queues will also affect the speed at which the withdrawn ETH can return to staking.

Validator Re-entry Could Take Weeks

Lido expects the final affected validators to leave the active set by the end of October 7. Their ETH, however, must still pass through withdrawal before it can be used to create active validators again.

Because Ethereum’s validator entry queue is extended, Lido estimates that the full exit, withdrawal and re-entry sequence could take up to 45 days.

That is a maximum estimated cycle rather than a uniform waiting period for every affected validator. Individual positions can move through the process at different speeds, and exited stake may not earn rewards until it becomes active again.

MetaMask and Lido are continuing their investigation and said they will provide additional updates as details emerge. The exact infrastructure component affected and whether the compromise reached beyond the staking operation remain unresolved.

At this stage, the available information points to a precautionary response involving affected validators, with MetaMask reporting no immediate wallet threat and no disclosed exploit of Lido’s underlying protocol.