An infrastructure incident is forcing MetaMask's staking arm out of the Lido protocol. The principal is protected; the rewards on that ETH are not.
MetaMask says it has identified no immediate threat to wallet users from its infrastructure incident. Some Ethereum stakers nevertheless face a financial cost through forgone rewards and possible downtime penalties.
In a notice dated , MetaMask said it is "currently responding to an ongoing security incident affecting part of our infrastructure." It said it had identified no immediate threat to MetaMask wallets and, as a precaution, is "proactively exiting affected validators within our non-custodial staking operations." The company stressed that it does not manage withdrawal keys for stake on behalf of clients.
Lido, the liquid-staking protocol, then disclosed that MetaMask Staking, the business formerly known as Consensys Staking, is pulling its validators out of the protocol following "an infrastructure compromise." The exits "will likely incur foregone rewards as well as possible downtime penalties," Lido said. The final validators are due to be exited by the end of , and the ETH is expected to return to the protocol over "approximately up to 45 days due to the extended entry queue." Lido said: "No action is required from stETH holders."
Why keys matter
The distinction between signing keys and withdrawal credentials helps explain Lido's statement that the underlying stake is protected. Validators use signing keys to propose and attest to blocks; separate withdrawal credentials determine where staked ETH ultimately goes. MetaMask says it does not hold clients' withdrawal keys. Access to validator configuration can put rewards at risk without, on its own, giving an attacker control over withdrawal of the principal.
On-chain evidence fits that picture. An independent researcher found that 18 of the 19 MetaMask validators that produced blocks recently sent their payments to an unexpected address, diverting about 0.36 ETH. That is a small sum, but it shows someone had control over where rewards flowed.
Putting a price on the exit
The cost to stakers is time. A round trip of up to 45 days means the affected ETH earns nothing for roughly one-eighth of a year. On any given amount of stake, that is about 12% of a year's rewards lost, plus whatever downtime penalties accrue along the way. MetaMask manages more than $3 billion of staked ETH across its business.
DeFi's reflexes
The rest of the ecosystem moved quickly. Ethena pulled about $135 million from Morpho lending vaults during the disclosures, including about $75 million from an RLUSD vault and $60 million from a PYUSD vault, before redeploying the funds. Aave founder Stani Kulechov said Aave's markets were unaffected.
Ether itself barely reacted, trading near $2,685 on Thursday morning.
What to watch
The exit deadline is the first marker. A disclosure from MetaMask or Lido on how many validators were affected and how the compromise occurred would show whether this was a contained configuration breach or something broader. For stETH holders, the key number to watch is the token's price relative to ETH.