New Details in MetaMask Incident: Ethereum Investors Could Miss Up to 45 Days of Staking Rewards!
MetaMask’s decision to deactivate Ethereum validators following a security incident has raised concerns that reactivating affected staking assets could take around 45 days, during which rewards may be missed.
According to CoinDesk, Lido said validators operated by MetaMask had begun exiting its system and that the last validators were expected to stop staking by October 7. This date does not mean all the associated ETH will have been withdrawn that day; withdrawing the funds and staking them again are separate processes.
Because of Ethereum’s staking entry queue, this process could take up to around 45 days. Affected validators will not earn rewards while offline, and they could also face penalties if they are taken offline before completing their exits.
Researcher: Block production payments went to another address
Ethereum security researcher Kaden reported that payments to 18 of the 19 MetaMask validators that earned fees from block production were sent to an unexpected address. The researcher estimated the redirected amount at approximately 0.36 ETH.
According to Kaden’s estimate, the precautionary exits cover 17,000 validators holding approximately 523,000 ETH. MetaMask had not confirmed these figures at the time of publication.
On Ethereum, the address to which block production fees are sent is separate from the address used to withdraw staked principal. Therefore, the payment redirection reported by the researcher concerns validator income; it is not a finding that 523,000 ETH was stolen.
Lido issues statement to stETH holders
Lido said that stETH holders do not need to take any action. stETH represents users’ pooled ETH stake through Lido and the rewards accrued on it.
MetaMask said that, following an incident affecting part of its infrastructure, it had exited the relevant validators as a precaution and that, at the time of its statement, it had detected no immediate threat to MetaMask wallets. The main consequence for users of the exits, which began as a security measure, was the staking income the affected validators would not generate until they resumed operation.