MetaMask Exits Lido Validators Amid Infrastructure ‘Security Incident’

In brief

• MetaMask is responding to an “ongoing security incident” affecting part of its infrastructure.
• It is exiting the Ethereum validators it operates in the Lido protocol as a precaution, and has not said whether others are affected.
• Lido says no action is required from stETH holders, and that returning ETH may take up to 45 days.

MetaMask is responding to an “ongoing security incident” affecting part of its infrastructure and has begun pulling its Ethereum validators out of the Lido staking protocol as a precaution, the companies said on Tuesday.

The wallet developer said it had identified “no immediate threat to MetaMask wallets,” and that it was addressing and remediating the issue internally alongside external partners and security advisors. It is exiting affected validators within its non-custodial staking operations, working with clients and partners.

MetaMask Staking, previously Consensys Staking, runs validators on Lido, the largest liquid staking protocol on Ethereum. Lido disclosed the exits in a security notice posted to its governance forum late on Tuesday, describing the cause as an infrastructure compromise under investigation.

The move will likely mean foregone rewards, Lido said, and possibly downtime penalties if validators go offline in the coming days to limit the risk of network penalties. The relevant validators have started the process, and the last of them are expected to have exited, though not fully withdrawn, by the end of October 7. Lido described the exits as among the steps taken, and neither firm said whether validators MetaMask runs elsewhere are involved.