MetaMask Security Alert: Emergency Measures for ETH Pledge

MetaMask, confirms that parts of its infrastructure are being affected by ongoing security incidents

MetaMask has officially confirmed that the company is experiencing a continuing security incident that affects parts of its infrastructure. As of now, MetaMask said it has not found any direct emergency threats to MetaMask Wallet. However, out of precautionary considerations, the company has begun removing Ethereum Validators that it assessed as risky from the system.

MetaMask did not provide detailed details on the specific nature of the event. The company announced that it is working with external security consultants and business partners to resolve the issue. The measures currently taken are mainly aimed at the verification nodes in MetaMask's Non-custodial Staking operation.

Why does MetaMask remove the Ethereum verification node?

MetaMask launches the removal of authentication nodes that may be affected by security incidents from the Ethereum network in an effort to guard against potential risks. During this process, a key detail was: MetaMask emphasized that it did not manage withdrawal keys in pledge operations on behalf of customers.

Due to this architectural design, the removal of the verification node does not mean that the client's pledged assets will be directly transferred to MetaMask's control. MetaMask specifically reiterated the "non-custodial" nature of its pledge operations.

However, the exit of the verification node may incur certain operating costs. Notably, a wallet associated with Ethereum co-founder Joseph Lubin transferred 133,298 ETH (worth approximately $356.2 million) to the new wallet five hours ago. Although the time point of this huge transfer coincides with MetaMask's security statement, the available evidence does not show that there is a direct connection between the ETH transfer and MetaMask's security incidents. Therefore, although the simultaneous occurrence of two events is remarkable, there is currently insufficient data to prove that there is a connection between the two.

Lido issued a key warning: Removal of authentication nodes due to security incidents

Lido also confirmed that due to MetaMask's security incidents, its protocol has begun to remove Ethereum authentication nodes operated by MetaMask Staking. It is expected that the affected verification nodes will complete the exit process by October 7, 2026.

Lido pointed out that during this period, pledge rewards may be lost; if the verification node is disabled in the near future, it may also cause Downtime penalties. In addition, the process of ETH returning to the agreement will not be completed immediately. Lido developer Will Shannon said the entire exit, extraction and re-entry process can take up to 45 days.

Therefore, although MetaMask claims that "there are no urgent threats in the wallet," the pledge security measures it takes still need to be independently evaluated, and the two cannot be simply equated.

What is the severity of the MetaMask security incident?

Since the technical details of the incident have not yet been made public, the specific reasons for the vulnerability are not yet clear, which has led to different interpretations of the scope of the incident in the industry.

Andy Cavanaugh of The Rollup believes that the situation may be more serious than expected, and risks such as ETH liquidity tightening may arise in the liquidity pledge field. Security researcher Taylor Monahan disagreed, arguing that the steps taken by MetaMask were more in line with routine security precautions.

The only confirmed fact is that MetaMask did face a security incident and the affected authentication node has been removed for preventive purposes. The company said it will continue to keep users informed of the latest developments as new information is disclosed.

MetaMask is about to operate independently from Consensus

This incident occurred while MetaMask was preparing for a major change in its corporate structure. Previously, parent company Consensus has announced plans to restructure MetaMask into an independent company.

The reorganization process is expected to be completed by the end of 2026. At that time, MetaMask will break away from the Consensus System, which it has had a affiliation with for more than ten years, and transform into an independent entity focusing on the consumer finance sector.

Currently, the security investigation of MetaMask is still in progress.

Note: The content of this article is based on general market information and does not constitute any investment advice. Readers are advised to conduct independent research.