{"id":78931,"date":"2026-10-01T21:41:52","date_gmt":"2026-10-01T21:41:52","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/metamask-pulls-validators-as-meager-eth-theft-sounds-big-alarm\/"},"modified":"2026-10-01T21:41:52","modified_gmt":"2026-10-01T21:41:52","slug":"metamask-pulls-validators-as-meager-eth-theft-sounds-big-alarm","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/metamask-pulls-validators-as-meager-eth-theft-sounds-big-alarm\/","title":{"rendered":"Metamask Pulls Validators as Meager ETH Theft Sounds Big Alarm"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Metamask said customer funds weren\u2019t hit as roughly 17,000 validators headed for exits.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Security researcher Kaden estimates attackers diverted about 0.36 ETH from 18 Metamask validator rewards.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Lido said affected Metamask validators could take up to 45 days to return to work.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Less Than $1,000 Goes Missing, Half a Million ETH Heads for the Door<\/h2>\n<p><a href=\"https:\/\/x.com\/0xKaden\/status\/2105530184103563620?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">According to a security researcher<\/a>, someone appears to have pinched about 0.36 ETH in Ethereum block tips from Metamask-operated validators, a haul worth less than $1,000 at roughly $2,700 per ether. The response was considerably bigger. Metamask began proactively exiting affected validators on Sept. 30 while investigators tried to determine how far the intruder had gotten.<\/p>\n<p>Researcher Kaden estimates that roughly 17,000 validators collectively holding about 523,000 ETH were sent toward the exits. Metamask hasn\u2019t confirmed those figures, but Lido confirmed that validators operated by Metamask Staking are <a href=\"https:\/\/research.lido.fi\/t\/security-disclosure-metamask-staking-precautionary-out-of-order-exits\/11961\" target=\"_blank\" rel=\"noopener noreferrer\">being removed from its protocol<\/a>. That\u2019s the curious bit. The visible theft was pocket change by crypto-hack standards, while the defensive maneuver involved hundreds of thousands of ether.<\/p>\n<h2>The Thief Apparently Found the Tip Jar<\/h2>\n<p>Metamask <a href=\"https:\/\/x.com\/MetaMask\/status\/2105442300335620460?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">disclosed the incident<\/a> at 7:38 p.m. Eastern time Sept. 30, saying it was responding to a compromise affecting part of its infrastructure and had found \u201cno immediate threat to Metamask wallets.\u201d On Oct. 1, the company <a href=\"https:\/\/x.com\/MetaMask\/status\/2105618018676163063?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">said there remained<\/a> \u201cno indication that Metamask wallets or customer funds have been affected.\u201d The staking architecture helps explain why.<\/p>\n<p>Ethereum validators generally put up 32 ETH, but Metamask says its staking operation is non-custodial and it doesn\u2019t control customers\u2019 withdrawal keys. Those keys are what allow the underlying stake to be withdrawn. An attacker able to tamper with validator settings, therefore, wouldn\u2019t automatically hold the keys to the vault. Kaden\u2019s onchain reconstruction instead points to the tip jar.<\/p>\n<p>He reported that 19 Metamask validators won block rewards and payments, but 18 went to the wrong fee-recipient address. The address had been funded through <a href=\"https:\/\/news.bitcoin.com\/kyberswap-exploiter-medjedovic-tornado-cash-2026\/\">the ether mixing service Tornado Cash<\/a>, and the diverted payments totaled about 0.36 ETH. Another reconstruction traced the activity to roughly four and a half hours on Sept. 30. It\u2019s a tiny take followed by a very large alarm bell.<\/p>\n<h2>Why Metamask Went for Broke on Validator Exits<\/h2>\n<p>Changing the fee recipient can reroute a validator\u2019s block tips without moving its 32 ETH stake. The trouble starts if an attacker obtains something more powerful, such as validator signing keys.<\/p>\n<p>Those keys can\u2019t simply withdraw the stake, but they can potentially make <a href=\"https:\/\/www.bitcoin.com\/get-started\/blockchain-tech\/infrastructure\/what-is-proof-of-stake\/\" target=\"_blank\" rel=\"noopener noreferrer\">proof-of-stake (PoS) validators<\/a> commit offenses punishable by Ethereum\u2019s slashing system. Slashing destroys part of the validator\u2019s stake and removes it from service. Kaden said three exploited validators had not yet exited when he posted his analysis, and estimated about 821 potentially affected validators remained active.<\/p>\n<p>In another analysis, the blockchain data infrastructure firm Bitquery <a href=\"https:\/\/bitquery.io\/investigations\/metamask-staking-incident\" target=\"_blank\" rel=\"noopener noreferrer\">separately counted 16,965 validators<\/a> holding 565,056 ETH that had exited or entered the queue by Oct. 1. Its numbers differ somewhat from Kaden\u2019s because the researchers measured different sets at different times. Neither figure has been publicly confirmed by Metamask.<\/p>\n<p>Bitquery also estimated that a hypothetical simultaneous slashing of roughly 17,000 validators could have burned around 22,000 ETH. No validators had been slashed in its reconstruction. That possibility helps explain why <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/metamask-breaks-free-from-consensys-as-2027-ipo-buzz-heats-up\/\">the crypto wallet platform Metamask<\/a> took the wraps off a much bigger defensive operation than the theft itself appeared to warrant.<\/p>\n<h2>A One-Week Exit Can Become a 45-Day Wait<\/h2>\n<p><a href=\"https:\/\/news.bitcoin.com\/liquid-staking-giant-lido-moves-8-million-eth-onto-new-validators-to-ease-ethereum-network-load\/\">Liquid staking infrastructure provider Lido<\/a> expects the affected validators it uses to finish exiting by the end of Oct. 7. Getting that ether earning again is another matter. Validators must clear Ethereum\u2019s exit process, withdraw, and eventually rejoin through the entry queue. Lido estimates the complete trip could take up to approximately 45 days. During that stretch, the exited stake isn\u2019t earning validator rewards.<\/p>\n<p>The queue was already crowded. <a href=\"https:\/\/beaconcha.in\/validators\/queues\" target=\"_blank\" rel=\"noopener noreferrer\">Validator queue data via beaconcha.in<\/a> shows about 393,795 ETH waiting to leave Ethereum\u2019s validator set, with an estimated four days and six hours required to clear the exit queue before another withdrawal delay. Lido says stETH holders don\u2019t need to take action, while Metamask is telling wallet users the same thing and warning them not to surrender recovery phrases to anyone claiming to offer protection.<\/p>\n<p>For now, the ledger presents a strange scorecard: roughly 0.36 ETH apparently stolen, hundreds of thousands of ETH shuffled toward the exits, and potentially weeks of lost earning time. The thief may have reached the tip jar, but Metamask still hasn\u2019t said exactly how close the intruder got to the safe.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/metamask-pulls-validators-meager-eth-theft-sounds-big-alarm\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Metamask said customer funds weren\u2019t hit as roughly 17,000 validators headed for exits. Security researcher Kaden estimates attackers diverted about 0.36 ETH from 18 Metamask validator rewards. Lido said affected Metamask validators could take up to 45 days to return to work. Less Than $1,000 Goes [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":78932,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78931"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78931"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78931\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78932"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}