Security
MetaMask Is Pulling Its Lido Validators Over 0.36 ETH in Misrouted Tips
On September 30, 18 of the 19 MetaMask Staking validators that proposed blocks paid their tips to an address funded through Tornado Cash, by an independent analyst's count. The take was worth less than $1,000. The response is the exit of every validator the operator runs for Lido, which outside analysts put at roughly 17,000 validators and more than half a million ETH, with the last expected out by October 7 and the stake taking up to 45 days to come back. Nobody has said what was compromised.
The number at the center of this story is 0.36 ETH. That is the amount an Ethereum analyst who posts as Kaden estimated was diverted from validators run by MetaMask Staking on September 30: of 19 validators that proposed blocks and earned tips, 18 paid those tips to an address that was not their usual fee recipient, and the address had been funded through the Tornado Cash mixer. Bitcoin.com News, which also reported the analysis, puts the window at roughly four and a half hours and the value at under $1,000.
The number at the other end is somewhere above half a million ETH. MetaMask said on September 30 that it was "responding to a security incident affecting part of our infrastructure" and was "proactively exiting affected validators within our non-custodial staking operations, in coordination with clients and partners." Lido, the staking protocol for which MetaMask Staking runs validators, posted the same night that the operator "has taken precautionary steps to protect client assets related to its operated Ethereum validators," including "exiting its Ethereum (ETH) validators in the Lido protocol." The last of them are expected to be out by the end of October 7. Kaden's estimate of the fleet is about 17,000 validators holding roughly 523,000 ETH. Bitquery, counting exits and queue entries through October 1, reached 16,965 validators and 565,056 ETH. MetaMask has not confirmed either figure.
What a fee recipient is
The gap between those two numbers is the story, and it comes down to which key does what on an Ethereum validator. The 32 ETH deposit, and the consensus rewards that accrue to it, can only be moved by the withdrawal credentials. MetaMask's statement leans on that: "our staking operations are non-custodial in nature, and we do not manage withdrawal keys for stake on behalf of our clients." Whoever got into MetaMask's infrastructure, on that account, could not take the stake.
Tips are different. The Lighthouse client's documentation describes the fee recipient as "an Ethereum address nominated by a beacon chain validator to receive tips from user transactions." It is a configuration value, not a credential. It is set in the validator client's definitions file or passed as a flag to the validator client or the beacon node, and the same page notes that "there is no guarantee that an execution node will use the suggested_fee_recipient, it may use any address it chooses." Its advice is that to be sure you control your fee recipient, "run your own BN and execution node (don't use third-party services)." A validator whose infrastructure someone else controls can, in other words, be made to pay its tips elsewhere without anyone touching a key that moves stake. That is consistent with what Kaden found and with how little was taken. Tips are a small fraction of a validator's income, and only validators chosen to propose a block earn them at all.
The Desk has not seen MetaMask say that a fee-recipient change is what happened. Its two updates say "infrastructure," and as Unchained noted, "neither MetaMask nor Lido has said what part of the infrastructure was compromised or how the breach was found." The fee-recipient reading rests on Kaden's on-chain reconstruction, as reported by CoinDesk and Bitcoin.com News, and on the fact that the only money anyone has identified as missing is tips.
Why exit everything
If the stake cannot be moved, why pull it all out? The answer in the coverage is slashing. A validator's signing key, the one its client uses to attest and propose, is not its withdrawal key, but it can be used to do the things Ethereum punishes. ethereum.org lists three: proposing two different blocks for the same slot, attesting to a block that "surrounds" another, and "double voting" on two candidates for the same block. Slashing "results in the forceful removal of a validator from the network and an associated loss of their staked ether." The initial penalty on a 32 ETH validator is now small, 0.0078125 ETH, but a second penalty applied about 18 days later "scales with the total staked ether of all slashed validators," which is what makes many validators slashed together expensive. Bitquery estimated that a simultaneous slashing of roughly 17,000 validators could burn around 22,000 ETH. No validator has been slashed, by Bitquery's reconstruction or anyone else's.
Lido's post says the exits "will likely incur foregone rewards as well as possible downtime penalties should validators be taken offline in the near future to reduce risks related to potential network penalties." That sentence describes a trade: accept the certain, small cost of being offline to remove the possibility of the large one. The exited ETH "is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue." Lido says stETH holders need do nothing, and points to a reserve fund of "over 6,750 stETH." Linea, the Consensys-built rollup whose Yield Boost vault stakes bridged ETH through Lido, said on October 2 that "the affected validators supporting the Yield Boost vault are being exited as a precaution" and that "the funds and control of the staking vault itself are unaffected."
Two sets of numbers, one incident
| Figure | Value | Who says so |
|---|---|---|
| Validators that proposed blocks in the window | 19 | Kaden, via CoinDesk |
| Of those, paying tips to the wrong address | 18 | Kaden, via CoinDesk |
| Tips diverted | ≈0.36 ETH | Kaden, via CoinDesk |
| Validators exiting | ≈17,000 / 16,965 | Kaden / Bitquery, via Bitcoin.com News |
| ETH exiting | ≈523,000 / 565,056 | Kaden / Bitquery, via Bitcoin.com News |
| Potentially affected validators still active | ≈821 | Kaden, via Bitcoin.com News |
| Last validators exited by | End of Oct 7 | Lido |
| Stake back in the protocol | Up to ≈45 days | Lido |
| Lido reserve fund | Over 6,750 stETH | Lido |
The operator with two names
Lido's disclosure calls the operator "MetaMask Staking (ex Consensys Staking)." That parenthesis is three weeks old. On September 9 Consensys announced it would split in two by the end of the year: the existing company, Consensys Software Inc., to be renamed MetaMask and carry the consumer wallet, and a new company keeping the Consensys name for Ethereum infrastructure and institutional work. The Block's report does not say which side the validator business lands on, and neither company has said. For now the incident sits under the MetaMask name, which is also the name on the wallet 0.36 ETH in tips has nothing to do with, and MetaMask's October 1 update spends most of its length on that point: "there is no indication that MetaMask wallets or customer funds have been affected," and "MetaMask will never ask you for your Secret Recovery Phrase."
What is still missing is the part a node operator would want. Which system was reached, how, when it was noticed, and whether the 821 validators Kaden counted as potentially affected and still active had their fee recipients changed or merely shared infrastructure with ones that did. MetaMask's two updates do not say. Lido's post, written for stETH holders, does not either. The Desk has not asked MetaMask and is not reporting the answer; it is reporting that two days in, the public record contains a precise account of the theft from an outside analyst and no account of the breach from the company.
The Take
Exiting half a million ETH over a sub-$1,000 theft is not an overreaction. It is the correct reading of what the theft proved: someone could change what a MetaMask validator did with its tips, and the signing key that makes a validator attest lives on the same class of machine. Once that is true, the only question is whether the stake is worth more than a few weeks of rewards, and it is. Lido's framing, foregone rewards against potential network penalties, is the honest version of the math. What the response does not do is tell anyone what to check. Fee-recipient diversion is quiet by design; the chain shows the wrong address only to someone who already knows the right one, and Kaden found this by looking, not because a company said to. Every other operator running validators on shared infrastructure now has a reason to compare their proposals against their configuration, and the operator with the most information about what to look for has published two paragraphs about wallets.