MetaMask Confirms No User Funds Impacted in Validator Security Breach

MetaMask reported a security incident on September 30, 2026, affecting its Ethereum validator infrastructure. The company confirmed that no user wallets or funds were compromised, as the staking service is non-custodial and MetaMask does not hold user withdrawal keys. An attacker diverted approximately 0.36 ETH in rewards from 19 validators. In response, MetaMask is exiting around 17,000 validators, a process expected to conclude by October 7, 2026. Users are advised to remain cautious of phishing attempts while the investigation continues.