A MetaMask Staking Incident Is Not a Wallet Hack. Here Is What Is Confirmed.

Since September 30, 2026, MetaMask has been dealing with a security incident that touches part of its infrastructure. Many readers are asking one question: is my MetaMask wallet affected? As of October 3, MetaMask's own statement says it has seen no indication that wallets or customer funds were affected. The investigation is still open, and several important facts are not public yet.

What MetaMask has said

MetaMask posted its first notice on September 30. It described an ongoing incident affecting part of its infrastructure and said there was no immediate threat to wallets. It also said it was taking a precautionary step: exiting affected validators in its non-custodial staking product. MetaMask states that it does not manage withdrawal keys for those validators.

The October 1 update said the investigation was continuing and that there was "no indication that MetaMask wallets or customer funds have been affected." The company added that its teams were still working through containment and verification. It also repeated standard guidance: be careful with unsolicited messages, never share your Secret Recovery Phrase or private keys, and remember that MetaMask will never ask for them.

The wording matters. "No indication" describes what investigators have found so far. It is not a final all-clear, and this article does not treat it as one.

Wallet versus staking service

The MetaMask wallet app and MetaMask Staking are different products. The wallet holds your keys on your device. The staking service, formerly called Consensys Staking, runs Ethereum validators, which are the computers that help confirm blocks and earn rewards. The incident, according to MetaMask and Lido, involves the infrastructure side of that second service.

That distinction decides who needs to pay attention. If you only use MetaMask to hold and send tokens, the company's statements do not point to a problem with your wallet. If you staked ETH through MetaMask Staking, or you hold Lido's stETH, the staking details below are more relevant to you.

What Lido disclosed

Lido, a large Ethereum liquid staking protocol, published a security disclosure on its research forum. It says MetaMask Staking cited an "infrastructure compromise," and that the validators MetaMask Staking runs for Lido began exiting as a precaution.

Lido expects the last of those validators to be exited, but not yet fully withdrawn, by the end of October 7.
The full cycle of exit, withdrawal, and re-entry could take up to about 45 days because of the queue to enter staking.
During that time the affected validators may earn fewer rewards and could face downtime penalties.
Lido says stETH holders do not need to take any action.
Lido says it has an ad hoc reserve fund of more than 6,750 stETH.

Figures that are not confirmed

CoinDesk reported on October 1 that an independent researcher, writing under the name Kaden on X, estimated that about 0.36 ETH in block-production payments was diverted and that the exits cover roughly 17,000 validators holding about 523,000 ETH. Those numbers come from the researcher. MetaMask has not confirmed them or explained the cause, so treat them as unverified estimates.

CoinDesk also noted that the address that receives a validator's block-production payments is set separately from the address that receives withdrawn staked funds. It said it had seen no reports of slashing, which is the penalty for validator misbehavior. These are context points, not findings about the root cause.

What is still unknown

How the attacker got in, and which component was compromised.
The total scale of the incident and any losses.
Whether any user funds are at risk beyond reduced rewards.
When MetaMask will publish a full account of what happened.

No separate MetaMask statement dated October 2 or 3 was found when this article was prepared. Check the official page for anything newer.

What readers can do now

Use official channels only. Read updates on MetaMask's own news page rather than in replies, direct messages, or search ads.
Never enter your Secret Recovery Phrase into a website, chat, or "verification" form. MetaMask says it will never ask for it.
Be suspicious of unsolicited messages. Incidents like this attract fake support accounts and fake "compensation" or "migration" links.
Know what you use. Check whether your ETH is staked through MetaMask Staking, whether you hold stETH, or whether you only use the wallet app.
Expect delays, not panic. If you staked through the affected service, exits and re-entry take time, and rewards may be lower in the meantime.

Why this story matters beyond MetaMask

The incident is a reminder that crypto risk comes in layers. A wallet can keep your keys safe while a service built around it runs into trouble, and a statement that wallets are unaffected answers only one layer. Reading which product a notice refers to, and what the company has and has not verified, is the most useful habit in a fast-moving security story.

Sources

Disclosure: This article covers an ongoing security incident, and details may change as MetaMask and Lido publish updates. The featured image is a generated illustration. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.