MetaMask unstaked roughly $1.4 billion worth of Ethereum after discovering block rewards from several of its validators were redirected to a wallet funded through Tornado Cash. The company disclosed the security incident on Oct. 1 and began exiting 17,000 affected validators from its non-custodial staking service, representing 523,000 staked ETH.
On-chain analysis by security researchers 0xKaden (Spearbit and Cantina) showed block rewards from 18 MetaMask validators were routed to an account funded by Tornado Cash rather than the correct fee recipient, with an estimated 0.36 ETH diverted. MetaMask confirmed an infrastructure security incident but stated it identified no immediate threat to MetaMask wallets themselves, emphasizing the exposure was limited to the staking infrastructure.
The distinction matters: MetaMask does not manage withdrawal keys for client stakes due to its non-custodial design, meaning the compromise lay within the validator reward-routing layer rather than wallet custody. The millions of MetaMask users holding and transacting crypto without staking faced no direct exposure.
The mass exit pushed Ethereum's network-wide validator exit queue from approximately 200,000 ETH to over 700,000 ETH in a single day, peaking at 851,000 ETH. As of Oct. 5, the queue remained at 767,000 ETH, translating to a 13-day wait time for validators to exit.
Lido Finance, which integrates with MetaMask's staking infrastructure, confirmed that relevant validators initiated their exit process and expects the final batch to clear by Oct. 7. Lido warned that the significant withdrawal on short notice would likely incur foregone rewards and potential downtime penalties for validators going offline during the transition.
On-chain analyst Emmett Gallic flagged a 133,300 ETH transfer valued at roughly $360 million from wallets labeled Lubin/ConSensys, occurring just hours before MetaMask's public statement. No connection to the security breach has been established.
The exit surge contrasted with staking entry dynamics. The entry queue for new stakers fell to nearly 1.44 million ETH, a 31 percent decline since Sept. 1, facing an activation delay of roughly 25 days.
