MetaMask user update on recent security incident

[NOV 5 - UPDATE]

Following our previous updates on the security incident identified on September 28, 2026, we wanted to share a further update on the precautionary measures taken to protect our users and partners.

All affected Ethereum validators operated by MetaMask Staking have now exited as a precaution following the incident.

What happened?

On September 28, we identified a security incident involving unauthorized access to part of our infrastructure.

We took steps to contain the incident and secure affected systems, working with external security specialists.

As a precaution, we initiated the exit of affected Ethereum validators to reduce potential risks. All validators were exited as expected without incident.

Were MetaMask wallets affected?

We have identified no indication that MetaMask wallets or our wallet infrastructure were compromised as a result of this incident. As a reminder, MetaMask is a non-custodial wallet, and users with Secret Recovery Phrases are stored locally on their own devices. 

Were customer funds affected?

We have not identified evidence that the incident enabled unauthorized access to or withdrawal of customers' staked principal. However, a limited amount of execution-layer staking rewards was diverted during the incident, as explained below.

MetaMask is built on the fundamental principle of self-custody. In MetaMask Staking, we do not control the withdrawal keys used to access customers' staked ETH. This separation helped protect customers' staked principal during the incident. The incident did not compromise the Secret Recovery Phrases or private keys that MetaMask users rely on to control their wallets.

Why were validators exited?

Following the incident, we determined that exiting affected validators was the most prudent way to reduce potential security risks.

Protecting customer assets and the integrity of our services was our priority.

Have validator exits been completed?

Yes. All affected validators have now exited.

Validator exits and withdrawals are separate processes on Ethereum. Even after a validator exits, it can take additional time for funds to become withdrawable or for ETH to be staked again.

Were staking rewards or withdrawals affected?

Some customers have experienced temporary withdrawal delays as a result of the precautionary validator exits.

The process may also have resulted in missed staking rewards while validators were exiting or awaiting reactivation.

We are working directly with affected customers and partners to address any outstanding impact.

Why did some validators show different fee recipient addresses onchain?

During the incident, an attacker briefly altered the addresses used to receive execution-layer staking rewards for certain validators, following unauthorized access to infrastructure where these addresses were centrally stored. The issue was identified and addressed on the same day, and approximately 0.385 ETH in rewards was diverted.

These rewards are separate from customers’ staked ETH. We have found no evidence that customers’ staked principal or withdrawal keys were compromised, and the affected systems have been secured.

Has the incident been contained?

Yes. The unauthorized access has been contained, and affected systems have been secured.

Do users need to take any action?

MetaMask wallet users do not need to take any action as a result of this incident.

Customers whose staking arrangements were affected should follow any guidance provided directly by MetaMask or their staking provider.

As always, users should remain vigilant against phishing attempts and use official MetaMask channels for updates and support. MetaMask will never ask users to disclose their Secret Recovery Phrase or private keys.

What happens next?

We remain focused on addressing any outstanding customer impact and continuing to harden our infrastructure.

Security is an ongoing responsibility, and we remain committed to maintaining the trust that users and partners place in MetaMask.

[OCT 1 - UPDATE]

We’re continuing to actively investigate and respond to the security incident affecting part of our infrastructure.

Our focus remains on working closely with affected partners and taking appropriate steps to protect users. As part of this, we worked with our partners to take the precautionary step of exiting affected validators. Based on our investigation to date, there is no indication that MetaMask wallets or customer funds have been affected. Our teams continue to work through containment and verification, and we’ll share further verified information as appropriate.

As always, please remain vigilant: be cautious of unsolicited messages, never share your Secret Recovery Phrase or private keys, and rely on official MetaMask channels for updates. MetaMask will never ask you for your Secret Recovery Phrase.

[SEPT 30 - UPDATE]

We are currently responding to an ongoing security incident affecting part of our infrastructure.

We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors.

At this time, we have identified no immediate threat to MetaMask wallets.

As a precautionary measure, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients and partners. As a reminder, our staking operations are non-custodial in nature and we do not manage withdrawal keys for stake on behalf of our clients.

We will continue to monitor the situation closely and provide further updates as appropriate.