MetaMask Staking Incident Redirects Validator Tips Without Affecting User Wallets

MetaMask confirmed an infrastructure incident on September 30 involving its staking service, which led to the removal of several Ethereum validators. On-chain data indicates that an attacker redirected tips from 18 blocks, totaling 0.36 ETH, while the staked principal remained secure. The incident occurred at the validator operation level, where the attacker compromised the signing keys and commission addresses managed by the operator. MetaMask clarified that it does not hold user withdrawal keys, ensuring that the underlying assets in user wallets were not at risk.