An Ethereum security researcher estimates that approximately 0.36 ETH of the rewards were transferred away, while exits taken as a precautionary measure covered verifiers holding about 523,000 ETH.

MetaMask began to withdraw affected Ethereum validators following a security incident. The incident resulted in the transfer of payments for approximately 0.36 ETH worth of block production, however, the company stated that no direct threat to user wallets has been detected at this time.

A researcher estimates that around 17,000 validators holding approximately 523,000 ETH are being removed, but MetaMask has not yet confirmed these figures, nor has it explained how their system was compromised.

Lido indicates that during the process of exiting and re-entering, affected verifiers may miss out on rewards, and this process can take up to approximately 45 days; stETH holders do not need to take any action.

MetaMask is shutting down its Ethereum staking system due to a security incident. Meanwhile, Lido warns of potential reward losses, and a security researcher stated that payments from block production have been transferred to another wallet.

An encrypted wallet provider that also offers staking services disclosed on Wednesday that the incident affected some of its infrastructure. The company also stated that as a preventative measure, it had taken affected validators—those computers that help verify Ethereum transactions—out of service.

"At present, we have not detected any direct threats to the MetaMask wallet," the company stated.

Ethereum security researcher Kaden stated on X that among the 19 validators operated by MetaMask who were previously paid for producing blocks, 18 of them sent these payments to an unintended address. He estimates that approximately 0.36 ETH was transferred away.

Analysis by Kaden shows that approximately 17,000 validators, who hold around 523,000 ETH, exited as a preventative measure. As of Thursday afternoon in Asia, MetaMask has not confirmed these figures, nor has it provided an explanation for how the system was compromised.

Staking allows holders to contribute their own tokens to help secure the Ethereum network, thereby earning ETH. Operators such as MetaMask are responsible for running the computers that carry out these tasks, while customers continue to have full control over where their staked tokens are withdrawn.

When validators produce blocks, they also have an address used to receive transaction fees. Changing this payment address allows for the transfer of income without altering the original destination of the pledged funds. Ethereum sets these payment destinations separately.

If someone gains control of these credentials, they could potentially have verifiers approve conflicting records, thereby triggering a penalty known as slashing. In such cases, Ethereum would destroy a portion of the staked tokens and remove them from the service. Neither MetaMask nor Lido has reported any such incidents occurring.

Income loss during the verifier's exit period

Even if the staked tokens themselves remain secure, a preventive closure will still incur costs.

Lido is a service provider that aggregates users' ETH for staking. The company stated earlier on Wednesday that verifiers operated by MetaMask had begun to withdraw from their system, and it is expected that the last batch will stop staking by October 7th. However, by that time, these ETH may not necessarily have been withdrawn yet.

Due to queues when entering the Ethereum staking system, it may take up to about 45 days to withdraw tokens and reinvest them into staking. During this period, affected validators will miss out on rewards; if they are offline before completing the exit process, they may also incur fines.

Lido indicates that: "The holder of stETH does not need to take any action." stETH tokens represent the pledged assets and accumulated rewards collected by users.

Related Reading: MetaMask Adding “pooled staking” to Reduce Ethereum Verification Costs

At these times of disclosure, large-value wallet transfers have also drawn attention. Blockchain tracking organization Lookonchain reported that a wallet associated with Ethereum co-founder Joseph Lubin transferred 133,298 ETH to a new address, worth approximately 356 million US dollars. It is not yet clear whether this transfer is related to the countermeasures taken by MetaMask.

The company behind the US dollar-pegged token USDe, Ethena, also withdrew its funds from the crypto lending platform Morpho after these security disclosures. The report indicates that this included approximately $75 million from the treasury of a RLUSD stablecoin that holds Ripple, as well as $60 million from the treasury of another PYUSD that holds PayPal.

A source close to Ethena stated that these withdrawals were a precautionary measure. On-chain data shows that after the situation became clear, Ethena redeployed these funds subsequently.