Overview
- MetaMask disclosed a Sept. 30 infrastructure security incident and began exiting the validators it runs inside the Lido staking protocol as a precaution.
- Lido says the affected MetaMask‑operated validators have started the exit process and expects the final validators to reach the exited state by October 7, with full withdrawals following Ethereum’s usual 15–45 day cycle.
- MetaMask and Lido stress that staking is non‑custodial and that MetaMask does not control client withdrawal keys, and both have told stETH holders that no action is required at this time.
- Lido warned the exits could cause lost staking rewards or downtime penalties if validators are taken offline before exit finishes, but it has not reported any slashing or stolen funds and points to its distributed operator set and a reserve pool of more than 6,750 stETH to absorb disruption.
- A formal investigation is underway with external security advisers, public details remain limited about the cause and scope of the incident, and teams are monitoring possible knock‑on effects for DeFi markets that use stETH.