MetaMask is exiting affected Ethereum validators operated through its non-custodial staking business after an infrastructure security incident, with Lido expecting the final validators to exit by October 7, 2026. The complete exit, withdrawal, and re-entry cycle could take up to approximately 45 days, while MetaMask says it has found no immediate threat to its wallets.

In a user update posted a few hours ago, MetaMask said it was responding to an ongoing security incident affecting part of its infrastructure. The company said it was working on remediation with external partners and security advisors while taking precautionary steps to exit affected validators in its non-custodial staking operations

MetaMask Staking, formerly known as ConsenSys Staking, is on Lido as the operator began exiting its Ethereum validators from the protocol after investigating an infrastructure compromise, according to a Lido governance forum disclosure.

MetaMask signs for the validators it operates, but says it does not manage clients’ withdrawal keys, so the operator cannot move the underlying stake on their behalf.

Lido said no action is required from stETH holders. The exit can still carry a cost: affected validators may forgo rewards, and taking them offline before they complete the exit could bring downtime penalties if done to reduce network-penalty risks.

The incident adds to the operational risks facing crypto infrastructure, where a security problem at a service provider can trigger disruption even without a disclosed protocol exploit. The number of affected validators and the quantity of ETH involved have not been made public as of now.

Has Lido Handled Large Exits Before This MetaMask Incident?

Lido says its diverse node-operator set and security systems are intended to contain disruptions. Those safeguards include an ad hoc reserve fund holding more than 6,750 stETH.

There are precedents for precautionary exits. In September 2025, staking provider Kiln exited 5,726 validators across networks after a compromised GitHub token enabled an attacker to access its infrastructure; Lido later estimated that the exits cost about 207 ETH in missed protocol rewards.

In 2023, the same operator, then operating under the Consensys name, mistakenly exited 125 Lido validators and compensated stakers for lost rewards. That history shows that large exits can impose reward costs; it does not indicate that the current incident involved the same breach vector or will have the same resolution.

Ethereum’s validator queues also shape how quickly stake can return to active service, a consideration for the wider Ethereum ecosystem.

The 45-Day Cycle and Unresolved Scope

Lido expects the final affected validators to be exited, but not fully withdrawn, by the end of October 7. ETH is expected to return gradually as validators pass through exit, withdrawal and re-entry, a sequence Lido estimates could take up to 45 days because of the extended entry queue.

That timeline is not a prediction that all affected ETH will be unavailable for the full period. It describes the potential duration of the complete cycle, while individual validators may progress at different times. During the process, exited stake may not earn rewards until it is active again.

MetaMask and Lido say a full investigation is underway and that they will share further updates as available. The key unresolved questions are which part of MetaMask’s infrastructure was compromised and whether the issue extended beyond the staking operation. These are all the things we know so far.

Discover: The Best Token Presales

Source: Crypto News