service outage

MetaMask Staking exits its Lido validators following a security incident

16Importance
closedStatus
16News media
20Pieces
Published
Also mentions
ETHLDOMORPHO +5

MetaMask began removing affected Ethereum validators from Lido after disclosing an infrastructure security incident, while saying it had found no immediate threat to user wallets or client funds. Multiple updates said the exit process could take until Oct. 7 and, in full, could run for about 45 days. Other coverage tied the incident to diverted validator rewards and noted that Lido said stETH holders did not need to take action.

Key claims & sources

✓
The validator exits were expected to finish by Oct. 7, and the full exit, withdrawal, and re-entry cycle was described as taking about 45 days.
✓
A separate report said an estimated 0.36 ETH in block-production payments was diverted and that the precautionary exits involved validators holding roughly 523,000 ETH.
✓
One update said the precautionary exits covered about 17,000 validators holding roughly 523,000 ETH.
✓
MetaMask said it was dealing with an ongoing security incident affecting part of its infrastructure and started taking affected staking validators offline.
✓
The company said it had identified no immediate threat to MetaMask wallets and said it was working with outside security advisers and partners.
✓
Lido said stETH holders did not need to take action while the validator exits were under way.
✓
Another report said an onchain analysis linked 18 of 19 affected validators to rewards sent to an address connected with Tornado Cash.

What it means

Users and clients watching MetaMask today would notice that the staking operation is removing affected validators while the company says wallet access has no immediate threat. That matters for stakers using the service because the process is already underway and the affected ETH is moving through an exit sequence rather than remaining in place.

What remains open is the exact scope of the infrastructure incident and which systems were affected, because one piece says MetaMask had not said which of its systems was hit. A fuller account would come from a later disclosure of the affected components or a completed investigation into the validator reward movements. (per beincrypto.com)

Market reaction i

EthereumETH it is the asset of the company or protocol in the event
first headline
+0.2% 2 h before
0.0% 4 h after
$2,688price at publication
13data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 30 23:48
+12 min
Oct 1 00:00
The Defiant echo
Confirms it 12 min later, with the same facts
+27 min
Oct 1 00:15
Cointelegraph context
Its angle: investigates, result, warned; with quotes
+3 h 31 m
Oct 1 03:19
+3 h 36 m
Oct 1 03:24
Crypto Briefing echo
No new facts: interconnectedness, instability, widespread
+5 h 49 m
Oct 1 05:37
crypto.news echo
No new facts: saying, probe
+6 h 27 m
Oct 1 06:15
Cryptonews.com context
Its angle: approximately, expecting, infrastru; with quotes
+7 h 18 m
Oct 1 07:06
CoinDesk context
Its angle: cryptocurrency, production, estimated; with quotes
+7 h 50 m
Oct 1 07:38
BeInCrypto echo
No new facts: unsolicited, continues, shutting; with quotes
+8 h 44 m
Oct 1 08:32
crypto.news adds
Brings into the story: ETH, with quotes
+9 h 49 m
Oct 1 09:38
+10 h 26 m
Oct 1 10:14
Unchained echo
No new facts: disclosure, operation, alongside; with quotes
+11 h 12 m
Oct 1 11:00
AMBCrypto echo
No new facts: exposure, ethena, aave
+11 h 17 m
Oct 1 11:05
CP CryptoPotato echo
No new facts: separately, respective, potential; with quotes
+11 h 51 m
Oct 1 11:39
Crypto Briefing echo
No new facts: infrastructures, vulnerability, emphasizing; with quotes
+13 h 11 m
Oct 1 13:00
The Coin Republic adds
Adds $3B, with quotes
+13 h 41 m
Oct 1 13:29
Protos adds
Adds $1.4B and $352M, with quotes
+14 h 4 m
Oct 1 13:52
Crypto Economy echo
No new facts: withdrawing, immediately, describing
+14 h 57 m
Oct 1 14:45
CR Cryptopolitan echo
No new facts: investigations, verification, indications; with quotes
+15 h 57 m
Oct 1 15:45
Crypto News Flash echo
No new facts: reconstructed, unauthorized, coordinating; with quotes

Thefts of a similar size

WhenWhat happenedFigure
1.7 years ago Bybit · Supply chain attack incident $1.5B
1.7 years ago Bybit · Signer Phishing incident $1.4B
7.1 years ago WOTOKEN · Ponzi incident $1.1B
9.3 years ago BTC-e incident $990M
10.3 years ago Bitfinex · Wallet stolen incident $900M

4282 incidents stored · 9 were as large as this one or larger ($1.4B)