MetaMask Security Incident: Staking Exits Lido Validators

Short answer: Late on September 30, 2026, MetaMask said it was handling an ongoing security incident in part of its infrastructure and had found no immediate threat to MetaMask wallets. As a precaution, MetaMask Staking (formerly Consensys Staking) began exiting the Ethereum validators it runs, including those in the Lido protocol; Lido says the last ones should enter the exit process by October 7 and that stETH holders do not need to do anything. On October 1 a separate bug drained about $3.8 million from NEAR Intents, which pledged to repay users in full, and on October 2 the funds were returned.

What happened at MetaMask?

MetaMask posted a short security update on X describing "an ongoing security incident affecting part of our infrastructure." It did not say which part, how the problem was found or who was behind it. The company said it was fixing the issue with outside partners and security advisors and that it was "proactively exiting affected validators within our non-custodial staking operations." A follow-up post said the investigation was continuing, that there was still no sign of impact on wallets or customer funds, and repeated the standard warning never to share a recovery phrase.

The key detail is where the incident sits. MetaMask the wallet keeps keys on the user's own device; MetaMask Staking is a separate business that operates Ethereum validators for clients and for Lido, the largest liquid staking protocol. According to Cointelegraph, MetaMask's site says the staking unit manages more than $3 billion in staked ETH. The staking business carries the old Consensys name because MetaMask is now being spun out of Consensys, a story we covered in MetaMask becomes an independent company.

Why is MetaMask Staking leaving Lido?

Lido published its own security notice on its governance forum on September 30. It said MetaMask Staking had taken precautionary steps to protect client assets after an investigation into an infrastructure compromise, and that exits from the validators it operates had already started. The final validators are expected to be in the exit queue by the end of October 7, which is not the same as fully withdrawn.

Exiting is the conservative choice when an operator is not sure who else might control validator signing infrastructure. A validator that signs something it should not can be slashed, so shutting it down removes that risk. The price is lost staking income: Lido warned of forgone rewards and possible downtime penalties if validators go offline in the coming days. The ETH comes back gradually through the exit, withdrawal and re-entry cycle, which Lido estimates at up to about 45 days because Ethereum's entry queue is long.

Both companies stress that the setup is non-custodial: MetaMask Staking does not hold withdrawal keys, so it cannot move clients' staked ETH. Lido pointed to two buffers for stETH holders: its spread of many node operators and a reserve fund of more than 6,750 stETH.

What do on-chain analysts say?

Neither company has published numbers, but a researcher tracking the validators on X, cited by Decrypt and The Crypto Basic, reported that 18 of 19 recent block rewards won by MetaMask-run validators went to an address funded through Tornado Cash instead of the proper fee recipient. That is about 0.36 ETH, under $1,000. The same analysis estimated that around 17,000 validators holding roughly 523,000 ETH (about $1.4 billion) are being exited as a precaution, and said the attacker most likely never had the ability to withdraw staked ETH. These figures are not confirmed by MetaMask or Lido.

Large stETH users reacted calmly. Aave founder Stani Kulechov said Aave was monitoring the situation and saw no impact on its markets, where stETH is widely used as collateral, and Ethena's Guy Young said USDe has no direct exposure to liquid staking tokens. It is the second time in roughly a year that a major Lido operator has pulled validators: in September 2025 Kiln exited all its Ethereum validators after a suspected infrastructure compromise.

What happened with NEAR Intents?

On Thursday, October 1, NEAR Intents, a cross-chain swap service that lets users trade across dozens of networks, halted after an exploit worth about $3.8 million. The team blamed a bug in how its Omni deposit and withdrawal infrastructure interacted with the NEAR Intents smart contract; the loss came from USDT on BNB Smart Chain. Investigator ZachXBT flagged irregular outflows from the protocol's BSC hot wallet and said the funds went to KuCoin and were bridged to bitcoin.

The bug was patched within about an hour and NEAR Intents and near.com came back online the same day, while deposits and withdrawals on 11 networks, including BSC, Polygon and Optimism, stayed paused for roughly 12 more hours. Co-founder Illia Polosukhin said all affected users would be compensated in full, and the team reported the case to law enforcement. General manager Alex Shevchenko then gave the attacker 48 hours to return the money. On Friday, October 2, he said the $3.8 million had been sent back in full; an on-chain message apparently from the exploiter admitted it was "in the wrong." Two days before the exploit, the same service had blocked a $50 million swap linked to the Bitget hack.

Key facts

What should MetaMask and staking users do?

1. Do not "migrate" or "verify" your wallet. Nothing in either incident requires you to move funds, re-import a seed or connect to a site. Incidents like this are a magnet for phishing: fake support accounts, ads and emails asking for your recovery phrase or a signature. MetaMask will never ask for your seed. Our guide to address poisoning and signature phishing shows the common tricks.
2. Update only from official sources. Install or update the extension from the official browser store or metamask.io, and follow news through MetaMask's own channels.
3. stETH holders can sit tight. Lido says no action is needed. If you watch the stETH/ETH rate, remember that small dips during news are normal; selling into panic only locks in a worse price.
4. Direct MetaMask Staking clients: expect slower rewards. Exited stake earns nothing while it waits in queues, and the round trip can take up to about 45 days. Check your dashboard in MetaMask Portfolio rather than third-party sites.
5. NEAR Intents users: check before you send. Make sure the network you need is live again before depositing, and keep transaction hashes for any stuck swap. Nobody will ask for keys or a fee to "release" compensation.
6. Spread operational risk. For one-off swaps you can compare rates across several services on changerella.com exchangers list or swap without an account through the non-custodial aggregator app.changerella.com, so a pause at one route does not block you.

Why does it matter?

The two events show different sides of the same lesson. At MetaMask the most valuable assets were protected by design: withdrawal keys sit with clients, so even a compromised operator could at most misdirect a few rewards or risk slashing, and exiting validators neutralises that risk at the cost of income. At NEAR Intents the weak spot was the glue between two systems, a pattern familiar from bridge exploits. In both cases quick, public disclosure and clear instructions limited the panic.

FAQ