Metamask discloses security incident affecting its infrastructure

By Sergiu Gatlan

• October 1, 2026
• 03:33 AM
• 0

On Thursday, cryptocurrency wallet provider MetaMask has disclosed an ongoing infrastructure security incident affecting some of its infrastructure.

The company is working to address the issue internally, with help from external partners and security advisors, and says there is "no immediate threat to MetaMask wallets."

"As a precautionary measure, we are proactively exiting affected validators within our non-custodial staking operations, in coordination with clients and partners," MetaMask noted. "As a reminder, our staking operations are non-custodial in nature and we do not manage withdrawal keys for stake on behalf of our clients."

Validators are nodes on the Ethereum network that run software responsible for proposing blocks, verifying crypto transactions, and maintaining the security of the Ethereum blockchain.

A MetaMask spokesperson redirected BleepingComputer to the company's public statement when asked what part of its infrastructure was affected and whether any systems or data were accessed or compromised.

While MetaMask hasn't shared further details about the incident, the decentralized liquid staking platform Lido Finance said earlier today that MetaMask Staking (ex Consensys Staking) has taken precautionary measures to protect client assets related to Ethereum validators.

"These steps include exiting its Ethereum (ETH) validators in the Lido protocol, and will likely incur foregone rewards as well as possible downtime penalties should validators be taken offline in the near future to reduce risks related to potential network penalties," Lido Finance said.

"Relevant validators have begun the exit process, with the final validators expected to be exited (but not fully withdrawn) by the end of October 7th, 2026."

The MetaMask non-custodial crypto wallet, developed by blockchain software company Consensys, lets users store and manage assets on the Ethereum network and other compatible blockchains.

.article-callout { background-color: #f0f6ff; width: 95%; max-width: 800px; margin: 15px auto; border-radius: 8px; border: 1px solid #d6ddee; display: flex; align-items: stretch; overflow: hidden; } .article-media { flex: 1; max-width: 220px; display: flex; } .article-media a { display: flex; width: 100%; height: 100%; } .article-media img { width: 100%; height: 100%; border-radius: 8px 0 0 8px; display: block; } .article-callout .article-media img { margin-top: 0 !important; height: 100% !important; } .article-body { flex: 2; padding: 10px; display: flex; flex-direction: column; justify-content: center; } .article-body h2 { font-size: 17px !important; font-weight: 700; color: #333; line-height: 1.4; font-family: Georgia, "Times New Roman", Times, serif; margin: 0 0 14px 0; } .article-body p { font-weight: bold; font-size: 14px; margin: 0 0 clamp(6px, 2vw, 14px) 0; } .article-link { background-color: #fff; border: 1px solid #3b59aa; color: black; text-align: center; text-decoration: none; border-radius: 8px; display: inline-block; font-size: 16px; font-weight: bold; padding: 10px 20px; width: fit-content; } @media (max-width: 600px) { .article-callout { flex-direction: column; align-items: center; } .article-media { max-width: 100%; } .article-media img { border-radius: 8px 8px 0 0; } .article-body { padding: 15px; width: 100%; } .article-link { width: 100%; margin: 0 auto; box-sizing: border-box; } }

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

Related Articles:

Bitget hacked via zero-day in third-party security products

Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist

Hackers steal $351.6 million in Bitget crypto exchange hack

Vietnamese man charged in $16 million 'pig butchering' crypto scam

North Korean WaterPlum hackers infected 30,000 devices worldwide