MetaMask begins exit of 17,000 validators following $1.4B ETH reward theft

In the wake of a security incident, MetaMask, the crypto wallet heavyweight, has begun “proactively” exiting 17,000 affected Ethereum validators, a batch that holds more than 523,000 staked ETH ($1.4 billion).

According to the firm, there was “no immediate threat” to its wallets, with the issue confined to its “non-custodial staking operations.”

No additional information has been released by MetaMask so far, but the concerning announcement has led others to look into how far the breach extends.

Security Update: We are responding to a security incident affecting part of our infrastructure.

At this time, we have identified no immediate threat to MetaMask wallets.

As a precaution, we are proactively exiting affected validators within our non-custodial staking operations,…

— MetaMask (@MetaMask) September 30, 2026

0xKaden, a security researcher with Spearbit and Cantina, posted an analysis on X stating that block rewards from 18 MetaMask validators were “not paid to the correct fee recipient but instead to this tornado [Cash] funded account.”

That address, which has yet to carry out any transactions, holds 0.46 ETH, of which 0.1 ETH came from Tornado Cash, the crypto mixer.

The account has taken in 18 inbound ETH transfers (block rewards) from Titan Relay: Forwarder, with a combined value under $1,000.

On-chain researcher Emmett Gallic noticed a large 133,300 ETH move from wallets tagged “Lubin/ConSensys,” valued at $360 million, occurring a few hours prior to MetaMask’s announcement, but nothing suggests this transfer is suspicious.

after some onchain sleuthing, i think this is what happened:

19 metamask validators had won block rewards, and 18 of the rewards were not paid to the correct fee recipient but instead to this tornado funded account: 0x98B9231de84334c1d48BA0b72CF13f92484924A3

~17k validators… https://t.co/qAlfkVNUW1

— kaden.eth (@0xKaden) October 1, 2026

This event is remarkably similar to the $41 million loss that Kiln suffered in its SOL staking operations last September.

At that time, Kiln also exited every active ETH validator and rotated its signing keys, regarding all related operations as “potentially compromised.”

UnMasked

Back in July, Drop Site News reported that ConsenSys — MetaMask's developer, which rebranded as both MetaMask and ConsenSys in early September — “accidentally hired a software developer linked to North Korea… as a consultant.”

The report, though, does not imply that the consultant, who was engaged for about a month, had any connection to the affected staking operations.

Unstaked

MetaMask's actions have pushed the Ethereum staking exit queue to its highest point of the year.

The exit queue jumped from about 200,000 ETH on Wednesday to more than 700,000 ETH on Thursday, extending the withdrawal wait from three and a half days to nearly two weeks.

Lido, a liquid staking provider, anticipates that MetaMask's ETH will be re-staked after the validators' "exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue."