MetaMask says no user funds were hit in validator security incident

MetaMask says there is no evidence that user wallets or funds were affected by the security incident it disclosed this week. The incident did not leave MetaMask untouched, though. It hit the company’s Ethereum validator infrastructure, which sits behind its staking product. What happened to MetaMask’s validators MetaMask reported the incident on September 30, 2026. On October 1, it confirmed it had found no sign that customer accounts or assets were compromised. One on-chain researcher found that an attacker diverted approximately 0.36 ETH in rewards tied to 18 of the 19 affected validators. Around 17,000 validators are now exiting because of the breach. Together they hold around 523,000 ETH. MetaMask began exiting a subset of its Ethereum validators, working with its associated partners. Exiting a validator means taking it offline entirely. The staked ETH gets returned, and the validator stops working. The final validator exits are expected to finish by October 7, 2026. Why users don’t need to do anything MetaMask says users do not need to take any action. Their funds and settings can stay as they are. The reason comes down to how MetaMask’s staking is built. The setup is non-cust...