MetaMask security scare pushes Ethereum validator exits to a nine-month high
MetaMask is pulling hundreds of Ethereum validators after a security breach redirected rewards, creating a network-wide backlog for stakers attempting to exit.
Onchain security researcher Kaden said about 17,000 MetaMask-operated validators holding roughly 523,000 ETH had been proactively exited after an evaluation discovered that transaction-fee rewards from 18 of 19 validators that proposed blocks had been diverted to an handle funded by means of Tornado Cash, an Ethereum-based privateness protocol that permits crypto transactions to be blended and anonymized.
The attacker seems to have captured solely about 0.36 ETH, in accordance to Kaden. The larger concern is how the attacker gained sufficient entry to alter charge recipients and whether or not that entry prolonged to validator signing keys, which might set off slashable conduct.
MetaMask has not confirmed these figures or disclosed the reason for the incident. Instead, the corporate said that a part of its infrastructure had been compromised and that it was exiting affected validators as a precaution whereas working with purchasers, companions and security advisers. It stated it had recognized no speedy menace to MetaMask wallets.
The firm additionally stated its staking operation is non-custodial and that it doesn’t management purchasers’ withdrawal keys. That separation would stop an attacker with solely validator-level entry from withdrawing the underlying stake, however it could not get rid of the opportunity of penalties if signing keys had been compromised and misused.
Kaden stated 821 doubtlessly affected validators had not but exited, together with three amongst these whose charge rewards had been allegedly diverted. It stays unclear why they’re nonetheless lively or whether or not the attacker retained entry to change further charge recipients.
MetaMask has but to disclose what number of validators had been affected, whether or not signing keys had been uncovered or whether or not any slashing has occurred.
Ethereum’s withdrawal backlog spikes to 9-month high
Meanwhile, the security incident and the exits are already rippling by means of Ethereum’s staking infrastructure.
About 773,447 ETH was ready to depart the validator set on Wednesday, in accordance to Validator Queue knowledge, implying a 13-day, 10-hour wait earlier than an exiting validator clears the queue. An additional withdrawal sweep delay was estimated at 7.6 days.
That is the most important exit backlog since December 2025 and above the roughly 476,000 ETH ready throughout a earlier surge in May, in accordance to Validator Queue’s historic knowledge.
The bottleneck displays a safeguard constructed into Ethereum quite than an incapability to course of transactions.
Ethereum limits how rapidly stake can enter or depart its validator set to stop abrupt modifications from destabilizing its proof-of-stake consensus. The Validator Queue confirmed a churn fee of 256 ETH per epoch, with every epoch lasting about 6.4 minutes. At that fee, a massive burst of exits have to be processed step by step quite than concurrently.
The further 7.6-day sweep interval begins after validators clear the exit queue and grow to be withdrawable. Ethereum then cycles by means of eligible validators and transfers balances to their designated withdrawal addresses.
For MetaMask-linked stake, the disruption might last more nonetheless. Lido, the place MetaMask operates validators, estimates the complete exit, withdrawal, and eventual re-entry course of might take up to 45 days, partly as a result of validators returning to Ethereum should additionally deal with a lengthy entry queue that’s presently 27 days lengthy.
The publish MetaMask security scare pushes Ethereum validator exits to a nine-month high appeared first on CryptoSlate.
