TL;DR
- MetaMask withdrew its Ethereum validators from the Lido protocol after detecting a security incident in its infrastructure.
- The withdrawn ETH could take up to 45 days to rejoin the protocol due to Ethereum’s extended exit queue.
- An independent onchain analysis suggests that 18 of 19 affected validators directed rewards to an address linked to the Tornado Cash mixer.
MetaMask, the wallet developed by Consensys, began withdrawing its Ethereum validators from the liquid staking protocol Lido as a precautionary measure in response to what both companies described as an active security incident affecting part of their infrastructure. The firm clarified that no immediate threat to users’ wallets was identified.
MetaMask Staking, formerly known as Consensys Staking, operates validators within Lido, Ethereum’s largest liquid staking protocol. Lido disclosed the exits in a security advisory published on its governance forum, describing the cause as an infrastructure compromise under investigation. The last of the validators is expected to have completed the exit process —though not the full withdrawal— before October 7.
Following an investigation into an infrastructure compromise, MetaMask Staking (ex Consensys Staking) has taken precautionary steps to protect client assets related to its operated Ethereum validators.
These steps include exiting its Ethereum (ETH) validators in the Lido… https://t.co/nsox7h0I5k
— Lido (@LidoFinance) September 30, 2026
MetaMask’s Withdrawal Could Take Up to 45 Days
Recovering the ETH will involve a considerably longer process. Lido estimated that the withdrawn stake could take up to 45 days to rejoin the protocol, given the extended exit, withdrawal, and re-entry cycle imposed by Ethereum’s entry queue. Both firms underscored that the staking arrangement is non-custodial and that MetaMask does not hold the withdrawal keys for its clients’ stake.
Lido indicated that holders of stETH, its liquid staking token, do not need to take any action. The protocol also pointed to its node operator distribution and an ad hoc reserve fund of over 6,750 stETH as buffers against potential disruptions.
Onchain Trail and Ecosystem on Alert
An independent analysis by researcher Kaden —unconfirmed by either company— shed further light on the scale of the incident. According to that review, 18 of 19 MetaMask validators that earned block rewards directed those payments to an address funded through the Tornado Cash mixer instead of the correct recipient, for an approximate amount of 0.36 ETH, equivalent to less than $1,000 at current prices. The same analysis indicates that approximately 17,000 validators holding around 523,000 ETH —valued at roughly $1.4 billion— are being withdrawn as a precaution.
Stani Kulechov, founder of lending protocol Aave, confirmed that his platform is monitoring the situation alongside Lido without having recorded any impact on its markets, where stETH is among the most widely used forms of collateral. Guy Young, founder of Ethena, indicated that the backing assets of the synthetic dollar USDe include no direct exposure to stETH or other liquid staking tokens.
This is the second case of its kind involving a Lido validator in just over a year. In September 2025, Kiln withdrew all of its Ethereum validators after identifying a potential compromise in its infrastructure. Neither of the companies involved in the current incident has disclosed what was compromised, how, or by whom.
