The MetaMask Team Reported a Security Incident

• The incident affected part of MetaMask’s infrastructure, but the company found no immediate threat to wallets.
• As a precaution, MetaMask Staking began withdrawing the Ethereum validators linked to the issue from Lido.
• The full cycle of validator exit, withdrawal, and re-entry can take up to 45 days.

MetaMask reported a security incident that affected part of the company’s infrastructure. The team said it is addressing the issue together with external partners and cybersecurity specialists. As of publication, no immediate threat to users’ wallets has been identified.

As a precaution, the company began withdrawing the affected nodes from its non-custodial staking operations. MetaMask emphasized that it does not manage customers’ withdrawal keys and therefore does not control staked assets on their behalf.

Journalist Colin Wu also drew attention to the situation. This concerns the staking infrastructure specifically, not a compromise of users’ wallets.

Lido confirmed that MetaMask Staking, previously known as Consensys Staking, has begun withdrawing the Ethereum validators it services from the protocol. The last affected nodes are expected to complete the exit phase by the end of October 7. However, this does not mean a full withdrawal of Ethereum by that date.

Next, the funds must go through the stages of validator exit, the actual withdrawal of coins, and subsequent re-staking. Due to the queue for entering the validator set, the entire process may take roughly up to 45 days. Lido emphasized that stETH holders do not need to take any action.

The procedure may result in the loss of some potential rewards. In addition, if individual validators are taken offline before the exit is completed, downtime penalties are possible. At the time of publication, however, there is no information about any loss of staked Ethereum or a compromise of withdrawal keys.

MetaMask has not yet disclosed which specific infrastructure components were affected, how the incident occurred, how many validators were at risk, or how much of the asset is associated with them. The investigation is ongoing.

The incident comes amid an expansion of MetaMask’s security tools. In September, the crypto wallet launched a defense mechanism against “red pill” attacks, which compares a transaction’s actual outcome with its pre-execution simulation and cancels the operation if there are discrepancies.

Previously, MetaMask also added a feature that detects signs of “romance” and investment scams before funds are sent.

Сообщение The MetaMask Team Reported a Security Incident появились сначала на INCRYPTED.