MetaMask is taking affected Ethereum validators out of its non-custodial staking service following a security incident involving its infrastructure. Lido expects the final affected validators to leave the network by October 7, 2026, but the full exit, withdrawal and re-entry process could extend for roughly 45 days.

MetaMask said it has not detected an immediate threat to users’ wallets.

In a recent update, the company said it was investigating an ongoing incident affecting part of its infrastructure and working with outside partners and security advisers on remediation. As a precaution, it began exiting validators connected to the affected systems.

MetaMask Staking, formerly known as ConsenSys Staking, operates Ethereum validators through Lido. A disclosure published on Lido’s governance forum said the validator exits began after the operator investigated the infrastructure compromise.

Although MetaMask signs transactions for the validators it runs, it does not control customers’ withdrawal keys. This means the operator cannot independently transfer the underlying staked ETH belonging to those customers.

stETH Holders Face No Required Action

Lido said stETH holders do not need to take any action in response to the incident. However, affected validators may experience financial consequences while they leave the active validator set.

Validators that are no longer active can miss staking rewards. Taking them offline before the normal exit process is completed could also result in downtime penalties, although doing so may be part of efforts to limit potential network-penalty exposure.

The incident highlights a broader operational issue for crypto infrastructure. A compromise at a staking provider can disrupt validator operations without necessarily involving an attack on the underlying blockchain or staking protocol.

MetaMask and Lido have not disclosed the number of affected validators or the amount of ETH associated with them.

Earlier Lido Validator Exits Offer Context

Lido says its diversified node-operator network and security controls are designed to limit the impact of disruptions. Its measures include an ad hoc reserve fund containing more than 6,750 stETH.

The protocol has previously dealt with large validator exits. In September 2025, Kiln exited 5,726 validators across multiple networks after an attacker gained access to its infrastructure through a compromised GitHub token. Lido later estimated that the incident led to roughly 207 ETH in missed protocol rewards.

The same provider, operating as Consensys at the time, mistakenly exited 125 Lido validators in 2023 and compensated affected stakers for the resulting lost rewards.

Those cases demonstrate that large-scale validator exits can carry reward costs, but they do not establish that the latest MetaMask incident involved the same attack method or will have a similar outcome.

The Ethereum validator queue is another factor that could affect how quickly the affected ETH returns to active staking.

Why the Full Process Could Last 45 Days

Lido expects the final affected validators to have exited by October 7. However, exiting the validator set does not immediately make the associated ETH available for new staking.

The funds must move through the withdrawal process before they can be used to activate validators again. Because Ethereum currently has a lengthy entry queue, Lido estimates the entire exit-to-reentry cycle could take up to 45 days.

That estimate should not be interpreted as a fixed 45-day delay for every affected position. Validators can progress through the exit, withdrawal and re-entry stages at different rates.

While the stake is outside active validation, it may not earn staking rewards until the validator becomes active again.

MetaMask and Lido said their investigation remains ongoing and that further updates will be provided as more information becomes available. The scope of the compromise is still being determined, including which infrastructure components were affected and whether the incident extended beyond MetaMask’s staking operation.

For now, the disclosed response centers on precautionary validator exits. MetaMask has reported no immediate wallet threat, while no exploit of the Lido protocol itself has been disclosed.