MetaMask has disclosed an ongoing security incident involving portions of its infrastructure, stating that user wallets face no immediate danger. As a protective step, the company is exiting impacted validators tied to its non-custodial staking business. Liquid staking operator Lido Finance said those exits had started, with completion anticipated by the end of October 7th, 2026.

What was disclosed

The wallet provider, developed by blockchain software company Consensys, said work to contain and resolve the matter is underway internally with assistance from outside partners and security advisers. The company described the event as affecting some of its infrastructure and characterized its staking operations as non-custodial, noting that it does not hold withdrawal keys for staked assets on behalf of clients.

In coordination with clients and partners, MetaMask said it is proactively removing affected validators from service within those staking operations. No additional specifics about the affected systems or whether any systems or data were accessed were provided, with inquiries directed to the company's public statement.

Lido Finance impact and timeline

The decentralized liquid staking platform Lido Finance said earlier the same day that MetaMask Staking (ex Consensys Staking) had initiated precautionary actions to safeguard client assets connected to Ethereum validators.

According to Lido Finance, the measures involve exiting its Ethereum (ETH) validators in the Lido protocol. Lido warned the move will likely result in missed rewards as well as potential offline penalties if validators are shut down soon to limit exposure to network penalties. It added that the relevant validators had entered the exit process, with the last of them expected to be exited but not fully withdrawn by the end of October 7th, 2026.

Technical background

This section covers general Ethereum staking concepts, not specifics of this incident.

Validators are nodes on the Ethereum network that operate software to propose blocks, check transactions, and help secure the blockchain. In non-custodial staking arrangements, the operator runs validator infrastructure but does not control withdrawal credentials.

A validator exit signals that a validator will stop performing duties, which halts future rewards and can trigger inactivity penalties if the node goes offline before the exit completes. Exit is distinct from full withdrawal, where staked ETH and accrued balances are removed from the validator and returned to the withdrawal address.

What remains unclear

MetaMask has not detailed the cause, scope, or entry point of the infrastructure issue, nor the exact infrastructure segment involved. It has also not stated whether client data, funds, or withdrawal keys were exposed, only that wallet users are currently not at immediate risk and that validator exits are being taken to reduce further risk.