Overview
- MetaMask disclosed the infrastructure security incident on Wednesday and has begun exiting affected Ethereum validators, with Lido forecasting the final validators will reach the exited state by Oct. 7.
- Both MetaMask and Lido say the staking setup is non‑custodial so withdrawal keys and user principal are not currently reported as compromised.
- An independent on‑chain researcher reported about 0.36 ETH in diverted block fees and estimated roughly 17,000 validators (around 523,000 ETH) were being exited but MetaMask has not confirmed those figures.
- Lido warns exited validators will miss rewards and could incur downtime penalties if taken offline before completing their staged exits, and full withdrawal and re‑entry could take as long as 45 days because of Ethereum’s entry queue.
- A full investigation is underway with external security advisers, and protocols such as Lido point to a distributed operator set and reserve stETH holdings to limit broader disruption to DeFi while monitoring continues.