MetaMask Withdraws 17,000 Ethereum Staking Validators Following Security Incident

MetaMask has proactively withdrawn approximately 17,000 Ethereum staking validators, representing about 523,000 ETH, following a security vulnerability in its infrastructure detected on September 30, 2026. Security analyst Kaden reported that a malicious actor successfully diverted block validation rewards, though only 0.36 ETH was stolen. The attacker was unable to access the staked principal, as MetaMask does not manage withdrawal keys. Investigations are ongoing to determine if the perpetrator could further manipulate commission recipients.