MetaMask Says Staking Incident Did Not Compromise Wallets or Keys
Summary
MetaMask says an attacker accessed systems used to store staking recipient addresses and diverted about 0.385 ETH in rewards. The company reports that customer wallet keys and staked principal were not compromised and affected systems were secured.
Key points
- MetaMask said a threat actor accessed systems used to store staking recipient addresses.
- About 0.385 ETH in staking rewards was diverted; MetaMask said these rewards were separate from customers’ staked ETH.
- MetaMask reported no evidence that customers’ staked principal or withdrawal keys were compromised.
- The company said users’ Secret Recovery Phrases and private keys were not compromised.
- MetaMask said it identified and addressed the issue the same day, secured affected systems, and was working to refund affected customers.
- Precautionary validator exits caused temporary withdrawal delays for some customers and may have led to missed staking rewards.
Article Details
- Victim Organization
- MetaMask
- Incident Type
- Unauthorized access to systems storing recipient addresses and diversion of staking rewards
- Incident Date
- 2026-09-30
- Disclosure Date
- 2026-09-30
- Operational Impact
- Approximately 0.385 ETH in staking rewards was diverted. MetaMask said the issue was addressed the same day and affected systems were secured. Some customers experienced temporary withdrawal delays and may have missed staking rewards during validator exits or reactivation. MetaMask reported no evidence that customers’ staked principal or withdrawal keys were compromised and said Secret Recovery Phrases and private keys were not compromised.
- Claim Status
- confirmed