MetaMask exits Ethereum staking validators as it probes security incident
In brief
- MetaMask said it is responding to a security incident affecting part of its infrastructure.
- Affected staking validators are being exited as a precaution, MetaMask said in a Wednesday update.
- MetaMask hasn't disclosed the issue and said it found no immediate threat to wallets.
- Lido said the last affected validators should exit by the end of Oct. 7.
- Exited ETH could take up to roughly 45 days to return, according to a Lido developer.
What MetaMask has said
In an update on Wednesday, MetaMask said it was addressing the threat internally and working with external partners and security advisors. The company said the precautionary measures involve validators within its non-custodial staking operations (and, separately, that it hasn't found any immediate threat to MetaMask wallets).
That's about all it's said so far.
MetaMask didn't share what the security issue was. Cointelegraph reached out to the company but didn't receive an immediate response.
Lido's timeline for the exits
Lido separately said MetaMask Staking had begun taking precautionary steps to protect client assets tied to its operated Ethereum validators. According to Lido, those steps included exiting MetaMask Staking's ETH validators in the Lido protocol on Wednesday, and the last of the affected validators are expected to exit by the end of Oct. 7.
Getting that ETH back into the protocol won't be quick. Lido Finance developer Will Shannon said the exited ETH would return gradually as validators move through the exit, withdrawal and re-entry cycle:
"ETH exited from MetaMask Staking-operated validators is expected to return to the protocol gradually as the relevant validators complete the exit, withdrawal, and re-entry cycle, which is estimated to take approximately up to 45 days due to the extended entry queue,"
What's still unknown
Both MetaMask and Lido have described the exits as precautionary. Shannon pinned the roughly 45-day estimate on the extended entry queue, which means ETH from those validators could take up to about a month and a half to fully return to Lido once it's exited.
The bigger question is what triggered all of this, and MetaMask hasn't answered it. Cointelegraph described the report as a developing story, so there's more to come as the company shares updates on the incident and its staking operations.
Frequently asked questions
Were MetaMask wallets affected by the security incident?
MetaMask said it had not identified any immediate threat to MetaMask wallets. The company said its precautionary measures involve validators within its non-custodial staking operations. It has not disclosed what the security issue was.
How long will ETH from MetaMask's Lido validators take to return?
Lido Finance developer Will Shannon said the exited ETH is expected to return to the protocol gradually through the exit, withdrawal and re-entry cycle. He estimated the cycle could take up to approximately 45 days because of the extended entry queue. Lido said the last affected validators were expected to exit by the end of Oct. 7.
