Short answer
MetaMask disclosed an infrastructure incident on 30 September 2026 and exited affected staking validators as a precaution. In a 5 November update it said a threat actor gained access to systems storing reward recipient addresses and diverted about 0.385 ETH in rewards, which it is refunding.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | MetaMask Staking (Consensys) |
|---|---|
| Incident type | Crypto theft |
| Status | Confirmed by the organization |
| Sector | Crypto wallet and staking |
| Country | United States |
| Detected | 2026-09-30 |
| Disclosed | 2026-09-30 |
| People or records affected | Some staking customers. MetaMask has not given a number, and says wallet users are not affected |
What data was exposed
- Systems used to store reward recipient addresses were accessed, per MetaMask's 5 November update
- About 0.385 ETH in execution-layer staking rewards was diverted, which MetaMask says is separate from customers' staked ETH
- MetaMask says it found no evidence that staked principal, withdrawal keys, Secret Recovery Phrases or private keys were compromised
What happened
MetaMask Staking, the staking service formerly known as Consensys Staking, disclosed an “ongoing infrastructure security incident” on 30 September 2026. It said it saw no immediate threat to MetaMask wallets and was proactively exiting affected validators in its non-custodial staking operations. Lido, whose protocol uses some of those validators, warned of missed rewards and possible downtime penalties, with final exits expected by the end of 7 October.
The November update
On 5 November MetaMask published an update that BleepingComputer reported the next day. It says a threat actor gained access to systems used to store recipient addresses and diverted some execution-layer staking rewards. About 0.385 ETH was diverted. MetaMask says the issue was identified and addressed the same day, those rewards are separate from customers’ staked ETH, and it is working to refund affected customers.
What was not affected
MetaMask says it found no evidence that customers’ staked principal or withdrawal keys were compromised. It also says the attack did not compromise Secret Recovery Phrases or private keys, and the affected systems are secured. MetaMask’s staking is non-custodial and it does not manage clients’ withdrawal keys.
Impact on customers
Some customers had temporary withdrawal delays from the precautionary exits, and some may have missed staking rewards while validators exited or waited to be reactivated. MetaMask has not said how many validators or customers were involved.
What to watch for
The main scam risk is not the breach itself but the noise around it. Crypto incidents draw fake support accounts and “reimbursement” pages that ask you to connect a wallet or type your recovery phrase. Real MetaMask support will never ask for that phrase. Our guide to crypto wallet drainer and fake airdrop scams shows how those pages work, and our data breach checklist lists the steps to take after any provider incident. For a larger recent crypto case, see the Binance hack.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake MetaMask 'staking reimbursement' or 'security verification' messages that ask for your Secret Recovery Phrase.
- Phishing sites that mimic MetaMask or Lido support and ask you to connect a wallet to claim missed rewards.
- Direct messages offering to 'recover' diverted rewards for a fee.
What to do if you are affected
- 01MetaMask says wallet users need to take no action. Never enter your Secret Recovery Phrase anywhere, whatever the message says.
- 02If you staked through MetaMask, follow guidance sent by MetaMask or your staking provider and contact support through the official app.
- 03If you hold stETH through Lido, Lido said holders need to take no action.
- 04Ignore unsolicited messages about reimbursements, and open MetaMask support only from the app or its official site.
- 05Review your staking dashboard for missed rewards or delayed withdrawals and keep screenshots for any refund request.
Frequently asked questions
Were MetaMask wallets or my funds affected?
MetaMask says its wallets and wallet infrastructure were not affected and that it found no evidence of compromise of staked principal, withdrawal keys, Secret Recovery Phrases or private keys. Wallet users do not need to act.
How much was taken?
MetaMask says about 0.385 ETH in execution-layer staking rewards was diverted, and that it is working with affected customers to refund the lost rewards.
Why did MetaMask exit validators?
It exited affected validators in its non-custodial staking operations as a precaution when it disclosed the incident on 30 September. Some customers saw temporary withdrawal delays and may have missed rewards while validators exited or waited for reactivation.
How did the attacker get in?
MetaMask has not said. Its first notice did not identify the affected components, and its November update says only that a threat actor accessed systems used to store recipient addresses.
Sources
- MetaMask says recent attack didn't affect wallet infrastructure, BleepingComputer, 2026-11-06
- MetaMask discloses security incident affecting its infrastructure, BleepingComputer, 2026-10-01
- MetaMask exits Ethereum validators after infrastructure compromise, CyberInsider
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.