Lido says MetaMask's precautionary validator exit will mean foregone staking rewards, no action needed from stETH holders
MetaMask is pulling its Ethereum validators out of Lido after an infrastructure compromise, putting the stake on a round trip Lido says can take up to 45 days. The stake earns no rewards on the way, and stETH holders share that cost, for an attack whose only documented theft so far is diverted block rewards.
The Investor · Invest desk
What happened
- Lido expects the last of the affected validators to have exited, though not fully withdrawn, by the end of October 7.
- Unconfirmed onchain analysis by researcher Kaden found 18 of 19 MetaMask block rewards sent to a Tornado Cash-funded address, about 0.36 ETH in all.
- The same analysis counts about 17,000 validators holding some 523,000 ETH being exited, with 821 potentially affected validators yet to leave.
- Both firms say the staking arrangement is non-custodial and that MetaMask does not hold withdrawal keys for client stake.
- Kiln, another major Lido operator, exited all of its Ethereum validators in September 2025 after a potential compromise of its infrastructure.
Why it matters
- What it limits constraint Because re-entry runs through Ethereum's extended entry queue, a precautionary exit keeps stake out of rewards for weeks, however small the breach that prompted it.
- Who's exposed exposure Clients of MetaMask Staking outside Lido cannot yet tell whether their validators share the compromise, since neither firm has said whether they are involved.
- What it sets up precedent Two full precautionary exits at major Lido operators in about a year make emptying the validator set the expected answer to a suspected operator compromise, with the pool absorbing the yield each time.
Next story · Invest · Oct 2
MetaMask's Sept. 30 breach idles its staking clients' ETH for roughly 90 daysConfirmed4 publishers
On figures from the researcher Kaden, which neither company has confirmed, the stake being exited is about 1.45 million times the ETH the attacker is known to have diverted [9][16]. The exit protects against a different loss. Kaden said the attacker "likely never had the ability" to withdraw staked ETH, but that validators could in principle be deliberately slashed depending on how signing access was obtained [14]. Neither company has said what was compromised, how, or by whom [6].
Leaving costs yield. Lido said the move will likely mean forgone rewards, and possibly downtime penalties if validators go offline in the coming days to limit the risk of network penalties [7]. The stake then returns to the protocol in stages as validators work through exit, withdrawal and re-entry [3]. Each percentage point of annual yield on 523,000 ETH is worth about 645 ETH over 45 days, and less in practice because the stake does not all come back on the last day [17].
In my view that cost falls on stETH holders as a group, including those who never chose MetaMask as an operator, because the stake returns to the protocol whose liquid staking token they hold [3][11]. By Lido's account the 45 days describe the stake's round trip, and holders have been told no action is required [11]. Lido also pointed to its spread of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers against disruption [11]. The reserve is about 1.3% of the stake being exited [18]. It exceeds 45 days of rewards on all of that stake at any annual yield below about 10.5% [19].
If the diverted block rewards were the whole attack, the bill is yield plus whatever downtime penalties accrue [7]. Should the attacker hold signing access to validators still in the set, the slashing Kaden described becomes the live risk, and the reserve is the buffer that would be tested [14][11].
I think the first case is the likelier one, because the only theft anyone has documented is diverted block rewards [9]. The counter-case comes from the same researcher, who said it was unclear whether the attacker could alter fee recipients across the whole set [14]. A handful of redirected payments may be a narrow view of a wider access. One deliberate slashing among the remaining validators would prove the first case wrong.
Aave founder Stani Kulechov said the lending protocol was watching the situation alongside Lido [12]. He said there had been no impact on Aave markets, where stETH is among the most widely used forms of collateral [12]. Ethena founder Guy Young said the assets backing its USDe synthetic dollar did not currently include direct exposure to stETH or any other liquid staking token [13]. He said he expected no impact [13]. MetaMask said it had identified "no immediate threat to MetaMask wallets" [2].
What to watch
- A finding from MetaMask's investigation on how the attacker got in, and whether it reached validator signing keys.
- Whether Aave reports any change in its stETH collateral markets while the exited stake is out of the protocol.
- Any draw on Lido's ad hoc reserve fund, the first figure that would put a price on this beyond forgone rewards.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence58
Perspective Coverage
4 publishers- Builder
- Builder 26%
- Operator
- Operator 41%
- Investor
- Investor 33%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
MetaMask is responding to an 'ongoing security incident' affecting part of its infrastructure and has begun pulling its Ethereum validators out of the Lido staking protocol as a precaution, the companies said on Tuesday, September 30, 2026.
- [2]
MetaMask said it had identified "no immediate threat to MetaMask wallets."
- [3]
Lido said the exited stake should return to the protocol gradually as validators work through the exit, withdrawal and re-entry cycle, a round trip it put at up to 45 days because of Ethereum's extended entry queue.
- [4]
The last of the relevant validators are expected to have exited, though not fully withdrawn, by the end of October 7.
- [5]
Both MetaMask and Lido stressed that the staking arrangement is non-custodial and that MetaMask does not hold withdrawal keys for client stake.
- [6]
Neither company has said what was compromised, how, or by whom.
- [7]
Lido said the move will likely mean foregone rewards, and possibly downtime penalties if validators go offline in the coming days to limit the risk of network penalties.
- [8]
Neither MetaMask nor Lido said whether validators MetaMask runs elsewhere are involved.
- [9]
Independent onchain analysis by researcher Kaden, not confirmed by either company, found that 19 MetaMask validators had won block rewards and that 18 of those payments were routed to an address funded through the Tornado Cash mixer instead of the correct fee recipient, roughly 0.36 ETH, under $1,000 at current prices.
- [10]
On the same analysis, about 17,000 validators holding some 523,000 ETH, worth around $1.4 billion, are being exited as a precaution, with 821 potentially affected validators yet to leave.
- [11]
Lido said no action is required from holders of stETH, its liquid staking token, and pointed to its spread of node operators and an ad hoc reserve fund of more than 6,750 stETH as buffers against disruption.
- [12]
Aave founder Stani Kulechov said the lending protocol was watching the situation alongside Lido and that there had been no impact on Aave markets, where stETH is among the most widely used forms of collateral.
- [13]
Ethena founder Guy Young said the backing assets behind its USDe synthetic dollar did not currently include direct exposure to stETH or any other liquid staking token, and that he expected no impact.
- [14]
Kaden said it was unclear whether the attacker could alter fee recipients across the whole set, that they "likely never had the ability" to withdraw staked ETH, but that validators could in principle be deliberately slashed depending on how signing access was obtained.
- [15]
It is the second such episode at a major Lido operator in just over a year: Kiln exited all of its Ethereum validators in September 2025 after identifying what its chief executive called a potential compromise of its infrastructure.
- [16]
The roughly 523,000 ETH being exited is about 1.45 million times the roughly 0.36 ETH diverted.
- [17]
Each percentage point of annual yield on 523,000 ETH is worth about 645 ETH over a 45-day period.
- [18]
Lido's reserve fund of more than 6,750 stETH is about 1.3% of the 523,000 ETH being exited.
- [19]
The 6,750 stETH reserve exceeds 45 days of rewards on 523,000 ETH at any annual yield below about 10.5%.
Sources
4 independent publishers whose own reporting we read for this story.
- coindesk.comMetaMask security incident forces Ethereum staking exits, no funds at risk
1 article · October 1, 2026
- cryptobriefing.comSentora’s Morpho vaults face outflows after MetaMask security incident
2 articles · October 1, 2026
- cryptopolitan.comMetaMask remains in containment as first test as independent company enters second day
1 article · October 1, 2026
- decrypt.coMetaMask Exits Lido Validators Amid Infrastructure ‘Security Incident’
1 article · October 1, 2026
Topics and entities
Topics
- Ethereum staking
- DeFi Lending Protocols
- Liquid Staking
- Staking infrastructure security