MetaMask discloses infrastructure security incident

Cryptocurrency wallet provider MetaMask has disclosed an ongoing security incident affecting some of its infrastructure. The company said it is working to address the issue internally with help from external partners and security advisers, and that there is “no immediate threat to MetaMask wallets.”

As a precaution, MetaMask is exiting affected validators in its non-custodial staking operations, in coordination with clients and partners. The company said it does not manage withdrawal keys for clients’ stake.

Validators are nodes on the Ethereum network that run software to propose blocks, verify transactions and help maintain the blockchain’s security. MetaMask has not said which infrastructure was affected or whether any systems or data were accessed or compromised. A spokesperson directed BleepingComputer to the company’s public statement.

Lido Finance said MetaMask Staking, formerly Consensys Staking, had taken precautionary steps to protect client assets tied to Ethereum validators. Those steps include exiting its validators in the Lido protocol. Lido said this could mean foregone rewards and possible downtime penalties if validators are taken offline to reduce risks related to potential network penalties.

The exit process has begun. Lido expects the final validators to exit by October 7, 2026, but said they will not be fully withdrawn by then. MetaMask’s non-custodial wallet is developed by Consensys and supports assets on Ethereum and other compatible blockchains.