MetaMask

Documented events with consequences still open. Each entry carries a source and a date.

1. Oct 1, 2026 Hack / funds theft Moderate ● open

   Security incident affecting «part of our infrastructure»: MetaMask precautionarily exits validators from non-custodial staking, cause and vector undisclosed

   MetaMask said it is «currently responding to an ongoing security incident affecting part of our infrastructure». The words are from the company's official update (metamask.io/news/user-update, published 30 September 2026 and last modified 1 October at 05:21 UTC), relayed overnight by the verified @MetaMask X account: «We are actively addressing and remediating the issue internally, in coordination with external partners and security advisors. At this time, we have identified no immediate threat to MetaMask wallets. As a precautionary measure, we are proactively exiting affected validators within our non-custodial staking operations». What is known, and what is not: MetaMask has NOT said which infrastructure component was compromised, has NOT disclosed the vector, has NOT said when the intrusion began, and there is no CVE, no vendor advisory and no named supplier. The only concrete action announced is the validator withdrawal: affected validators have begun the exit process and the last ones are expected to have completed the exit — not the full withdrawal — by the end of 7 October 2026. The perimeter, because it is what matters to anyone using the wallet: MetaMask is self-custody, the keys sit on the user's device, and the company states it does not manage withdrawal keys for stake on behalf of clients. What appears to be touched is the company's infrastructure and the staking operation, not the wallet as such. The staking side was confirmed from the other end: Lido acknowledged that MetaMask Staking began «precautionary steps to protect client assets» by exiting validators from the protocol, and developer Will Shannon wrote that ETH exited from MetaMask Staking-operated validators «is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue». For scale: according to Cointelegraph, MetaMask manages over $3 billion in staked ETH. No loss of funds has been declared by any party, which is why `importo_usd` is left empty: the only quantifiable cost cited by the sources is forgone rewards and downtime penalties on the exited validators. The incident was also relayed by @CertiKAlert, which describes a «security incident affecting part of Metamask infrastructure» without adding details of its own. One thing stays open, and it is not a detail: as long as the cause is not public, anyone running the same piece of infrastructure does not know they need to patch. It is the same gap seen in the Bitget case of 24 September, where the investigations spoke of a «Product A» and a «Product B» without ever naming them. **Update of 2 October 2026.** The official page was last modified on **2 October at 01:01:34 UTC** and the language has hardened in a reassuring direction: where it previously read «we have identified no immediate threat to MetaMask wallets», MetaMask now writes that «**there is no indication that MetaMask wallets or customer funds have been affected**». On everything else the statement is **identical to yesterday's**: no cause, no vector, no indication of which systems were touched, no word on any data access, no validator count. The declared perimeter is unchanged: an ongoing incident affecting part of the infrastructure, a precautionary validator exit, remediation in coordination with external partners. The figures circulating in the press in these hours — «17,000 validators» and «$1.4 billion» — **come from neither MetaMask nor Lido** and are not reported here: for the same reason `importo_usd` is left empty, a number the parties have not declared does not go on the card.

   ↗ source

verified on Oct 2, 2026

Weighted average across 3 public review platforms (562,687 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.