MetaMask, the self-custodial crypto wallet, has disclosed a security incident affecting part of its infrastructure and has begun removing its staking unit’s Ethereum validators from Lido, a liquid staking protocol. The company said it has identified no immediate threat to MetaMask wallets, while Lido told stETH holders that no action is required on their part.
What MetaMask Said
MetaMask disclosed the incident in a post on X at 23:38:56 GMT on September 30, 2026. The company wrote: “Security Update: We are responding to a security incident affecting part of our infrastructure. At this time, we have identified no immediate threat to MetaMask wallets. As a precaution, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients, partners and security advisors. We’ll share further updates as appropriate.”
The same statement appeared that day in a user update on MetaMask’s website. The page adds that the company is addressing and remediating the issue internally with external partners and security advisors. It also states that MetaMask’s staking operations are non-custodial and that the company does not manage withdrawal keys for stake on behalf of its clients.
Non-custodial staking means the operator runs the validator software that participates in Ethereum’s consensus, while control over where the staked funds are ultimately withdrawn stays with the client. Withdrawal keys, also called withdrawal credentials, determine the address that receives staked Ether (ETH) once a validator is fully withdrawn.
Lido Details the Exit Timeline
Lido provided a more detailed operational account in a security disclosure on its governance forum, published on September 30, 2026, under the title “Security Disclosure MetaMask Staking Precautionary Out of Order Exits.”
Lido allows users to stake ETH and receive stETH (staked Ether), a token that represents their claim on ETH staked through the protocol. The staked ETH is spread across validators run by independent companies known as node operators. MetaMask Staking is one of them.
According to the Lido disclosure, MetaMask Staking took precautionary steps to protect client assets after an investigation into an infrastructure compromise. Those steps include exiting its ETH validators in the Lido protocol. The relevant validators have already begun the exit process.
Lido described these as “out of order” exits. Under normal operations, the protocol itself decides which validators leave and in what sequence, mainly to fill stETH withdrawal requests, as outlined in Lido’s node operator documentation. An out-of-order exit is one that a node operator initiates outside that protocol-determined sequence.
Lido said the final affected validators are expected to be exited, but not fully withdrawn, by the end of October 7, 2026. The exited ETH is expected to return to the protocol gradually as validators complete the exit, withdrawal, and re-entry cycle. Lido estimates that cycle could take up to about 45 days because of the extended entry queue on Ethereum.
The protocol said the process will likely result in foregone rewards. It may also lead to downtime penalties if validators are taken offline in the near term to reduce the risk of potential network penalties. On Ethereum, validators that go offline lose small amounts of their balance for missed duties, separate from slashing, a much harsher penalty for provable misbehavior.
Lido pointed to its diverse node operator set and other security systems as designed to contain disruptions. These include an ad hoc reserve fund of over 6,750 stETH. The protocol said a full investigation is underway and further updates will follow.
What Has Not Been Disclosed
Neither MetaMask nor Lido has said which systems were compromised or how the incident occurred. Neither has said whether any user data was exposed, how many validators are affected, or how much ETH is involved.
As of publication, MetaMask has not shared any public update beyond its September 30 statement.
What the Exits Mean for stETH Holders
Exiting a validator and withdrawing its ETH are two separate stages on Ethereum. A validator first stops performing its duties and leaves the active set. Its balance is then withdrawn to the address set in its withdrawal credentials. In Lido’s case, that ETH can only start earning rewards again after it re-enters through Ethereum’s validator entry queue.
This is why Lido’s timeline separates the October 7 exit target from the longer cycle of up to about 45 days.
For stETH holders, Lido said no action is required. Because stETH represents a claim on ETH staked across the whole protocol, it is not tied to a single operator. Based on what both companies have disclosed so far, any impact on rewards would come from validators being offline or outside the active set during the exit and re-entry window. Neither company has reported any loss of withdrawal keys.
Not the First Out-of-Order Exit Involving This Operator
The same operator was behind an earlier out-of-order exit in the Lido protocol, though that event was caused by an error, not a security incident. On July 17, 2023, at about 12:00 UTC, Consensys Staking mistakenly submitted voluntary exit messages for 125 validators set up through Lido. Because of a long entry queue at the time, those validators spent roughly 39 days without performing duties or earning rewards. ConsenSys Staking said afterward it had added administrative safeguards to prevent erroneous exits.
Lido has handled a precautionary security exit before as well. Staking provider Kiln began exiting all of its Ethereum validators, including those run through Lido, after an investigation into a Solana incident involving SwissBorg. Lido told stETH holders at the time that no action was needed and estimated that the exit and withdrawal cycle would take roughly 15 to 45 days. That case is documented in a separate Lido security disclosure.
MetaMask’s validator staking service is a separate product from its wallet software. In January 2024, MetaMask opened full validator staking to users depositing 32 ETH, with Consensys Staking running the validators. ConsenSys is the software company that built MetaMask. At that time, the service oversaw more than $2 billion across about 33,000 validators and had no recorded slashing event.
This is a developing story. Further details are subject to updates from MetaMask and Lido.
Also Read: Bitget, Liquid Hacks Drive Crypto Losses to $766M in September, 2026’s Worst Month: CertiK
