MetaMask is pulling its Ethereum validators out of the Lido protocol after finding a security compromise in its staking infrastructure. The company, which operates as a Lido node operator through its MetaMask Staking arm, says the affected validators are already exiting and that it has found no immediate threat to MetaMask wallets.
Lido expects the final affected validators to be out by October 7, 2026. The full exit, withdrawal, and re-entry cycle could take up to about 45 days because of Ethereum's extended entry queue. MetaMask and Lido both say a full investigation is underway.
What MetaMask actually controls
MetaMask Staking — formerly ConsenSys Staking — signs blocks for the validators it runs, but it doesn't hold clients' withdrawal keys. That means it can't move the underlying stake on anyone's behalf, even if it wanted to. The company says user wallets remain safe, and Lido says stETH holders don't need to do anything.
Neither MetaMask nor Lido has said how many validators are involved or how much ETH is at stake. That's a conspicuous gap. The two outfits have been quick to say what isn't at risk but haven't put a number on what is.
Rewards, penalties, and the queue
Validators in the exit process may forgo rewards while they wait. The mechanics here matter: if an operator yanks validators offline before the exit is complete — say, to dodge broader network-penalty risk — that can trigger downtime penalties instead. So the slow walk out is partly deliberate. There's no clean way to speed it up without inviting a different kind of cost.
Lido has an ad hoc reserve fund holding more than 6,750 stETH to help contain disruptions. That buffer exists for exactly this sort of situation, though the protocol hasn't said whether it will tap the fund for this incident.
This isn't the first validator mess
In September 2025, staking provider Kiln exited 5,726 validators across networks after a compromised GitHub token let an attacker into its infrastructure. Lido later estimated those exits cost about 207 ETH in missed protocol rewards. And in 2023, ConsenSys — the operation now called MetaMask Staking — mistakenly exited 125 Lido validators and ended up compensating stakers for lost rewards.
Two of those three incidents trace back to the same operator. That's a pattern worth watching, even if the causes differ.
The open questions
What's still unclear is which part of MetaMask's infrastructure was compromised, and whether the problem stayed contained to the staking operation or reached further. Neither company has addressed those points. Until they do, the most concrete date on the calendar is October 7, when Lido expects the last affected validators to be out — with the fuller re-entry cycle potentially running into mid-November.
