MetaMask Lido Validators Exit After Infrastructure Security Breach

MetaMask is moving to remove affected Ethereum validators from its non-custodial staking service following an infrastructure security incident. Lido expects the final affected validators to exit by October 7, 2026, while the full process of exiting, withdrawing and returning to active staking could take up to 45 days.

MetaMask said there is currently no indication that users’ wallets face an immediate threat.

In a user update published a few hours ago, MetaMask said it was dealing with an ongoing security incident involving part of its infrastructure. The company said it was working with external partners and security advisers to address the issue and had taken precautionary measures, including exiting validators linked to the affected infrastructure.

MetaMask’s Lido Validators Begin Exiting

MetaMask Staking, previously known as ConsenSys Staking, operates Ethereum validators through Lido. The validator exits began after an investigation into the infrastructure compromise, according to a disclosure on Lido’s governance forum.

MetaMask signs transactions for the validators it operates, but it does not control customers’ withdrawal keys. This means the staking operator cannot independently move the underlying ETH on behalf of its clients.

Lido said stETH holders do not need to take any action in response to the incident. However, the validator exits could carry financial costs. Affected validators may miss staking rewards, while taking validators offline before the exit process is completed could expose them to downtime penalties if done as a precaution against network-related risks.

The incident highlights an operational risk in crypto infrastructure: a compromise at a service provider can disrupt staking operations even when there is no disclosed exploit of the underlying protocol.

Neither MetaMask nor Lido has publicly disclosed the number of affected validators or the amount of ETH associated with them.

Lido Has Managed Large Validator Exits Before

Lido says its broad network of node operators and security controls are designed to limit the impact of disruptions. Its safeguards include an ad hoc reserve fund containing more than 6,750 stETH.

There have been previous cases involving precautionary validator exits. In September 2025, staking provider Kiln exited 5,726 validators across networks after an attacker gained infrastructure access through a compromised GitHub token. Lido later estimated that the incident resulted in approximately 207 ETH in missed protocol rewards.

The operator, then known as Consensys, also mistakenly exited 125 Lido validators in 2023 and compensated affected stakers for the lost rewards.

Those incidents demonstrate that large-scale validator exits can result in meaningful reward losses, but they do not establish that the current MetaMask incident involved either of the same causes or will follow the same outcome.

Ethereum’s validator entry and exit queues are another factor in determining how quickly the affected stake can return to active service.

Full Exit Could Take Up to 45 Days

Lido expects all affected validators to have exited by the end of October 7, but that does not mean the associated ETH will immediately become available for new staking.

The ETH must move through several stages, including validator exit, withdrawal and re-entry into the active validator set. Lido estimates that the complete process could take as long as 45 days because Ethereum currently has an extended entry queue.

The 45-day estimate does not mean every affected ETH position will remain inactive for the entire period. Validators will progress through the process at different rates, and the actual timeline can vary.

During the transition, exited stake may not generate staking rewards until the validators become active again.

MetaMask and Lido said investigations into the incident are continuing and that additional information will be provided as it becomes available. The main unanswered questions are which part of MetaMask’s infrastructure was compromised and whether the issue affected systems beyond its staking operations.

For now, the disclosed information points to a precautionary validator exit rather than a reported compromise of users’ wallets or an exploit of the Lido protocol itself.

About The Author