On-chain review counts 16,965 MetaMask validator exits after incident

An attributable on-chain review counted 16,965 Ethereum validators operated by MetaMask Staking as exited or waiting to exit by 05:29 UTC on October 1, following the company’s response to a security incident disclosed the preceding day.

Bitquery calculated that the identified validators held 565,056 ETH. The continuing significance extends beyond that measurement window: Lido expects the final MetaMask-operated validators in its protocol to exit by the end of October 7, although their ether will not necessarily have been withdrawn by then.

The exits reduce exposure to validator signing infrastructure that MetaMask no longer considered safe to keep operating. They do not, by themselves, show that customers lost control of their staked principal or that MetaMask’s consumer wallet was compromised.

MetaMask confirms the action, but not its scale

MetaMask said on September 30 that an incident affected part of its infrastructure and that it was proactively exiting affected validators from its non-custodial staking operations. In an October 1 update, the company said its investigation had found no indication that MetaMask wallets or customer funds were affected.

The company also said it does not manage clients’ staking withdrawal keys. Ethereum treats validator signing keys, withdrawal credentials and block-fee destinations as distinct controls. An operator can therefore lose confidence in the infrastructure used to sign validator messages without an attacker gaining the credentials that determine where the underlying stake may be withdrawn.

MetaMask did not disclose an official validator count, affected-system inventory, initial access method, compromise window or completed loss assessment. Its October 1 language reflects the investigation at that time; it is not a final finding that every system and client escaped impact.

On-chain attribution supplies the missing count

Bitquery measured the 16,965-validator total using two methods. It identified 7,191 validators from Lido’s published operator keys. For other client groups, it matched validators through fee-recipient messages signed when MetaMask restored expected payment addresses.

That methodology produced a combined 565,056 ETH estimate at 05:29 UTC on October 1. It is an attributable on-chain calculation, not a balance confirmed by MetaMask. Bitquery also excluded more than 1,000 validators that entered the queue during the relevant period but lacked its attribution marker, meaning its scope was deliberately narrower than every contemporaneous exit.

The analysis found that 18 blocks between 12:12 and 16:46 UTC on September 30 directed approximately 0.36 ETH in block tips to an unexpected address. It reported no slashed validator in its October 1 observation. Those findings concern block-production income and validator behavior during a defined window; they do not establish access to withdrawal keys or the 565,056 ETH attributed to the exiting validators.

CoinDesk separately reported the same estimated 0.36 ETH diversion but cited an earlier researcher’s estimate of roughly 523,000 ETH across about 17,000 validators. The difference from Bitquery’s later 565,056 ETH result illustrates how observation time and attribution rules can change totals.

Exit does not mean immediate withdrawal

Lido said its MetaMask-operated validators could forgo rewards and potentially incur downtime penalties during the process. It expects the full exit, withdrawal and re-entry cycle to take as long as approximately 45 days because ether must clear protocol queues before it can be staked again under new keys.

The October 7 milestone therefore describes expected validator exits, not completed withdrawals or restored earning capacity. Lido said stETH holders do not need to take action, but it did not quantify the final missed rewards or penalties.

As Coinburn prepared this October 4 report, MetaMask had not published a postmortem or independently confirmed Bitquery’s validator and ether totals. Those disclosures remain necessary to establish the incident’s cause, complete scope, remediation and final economic impact.