MetaMask security breach triggers surge in Ethereum validator exits

MetaMask is initiating the exit of thousands of Ethereum validators following a security breach that diverted transaction-fee rewards. Onchain researcher Kaden reported that approximately 17,000 validators, holding about 523,000 ETH, are being withdrawn after rewards from 18 validators were redirected to an address linked to Tornado Cash. While the attacker reportedly captured only 0.36 ETH, concerns persist regarding potential compromise of validator signing keys and the risk of slashing. MetaMask confirmed an infrastructure compromise but stated that its staking service is non-custodial and that user withdrawal keys remain secure. The incident has caused the Ethereum withdrawal backlog to reach a nine-month high.