MetaMask is withdrawing roughly 17,000 of its Ethereum validators, controlling approximately 523,000 ETH, after a security incident diverted block-proposal fee rewards to an address funded through the Tornado Cash mixing protocol.

Onchain researcher Kaden disclosed the scale of the exits on X, reporting that transaction-fee rewards from 18 of 19 MetaMask-operated validators that successfully proposed blocks had been rerouted to a Tornado Cash-funded recipient. The attacker captured only about 0.36 ETH in the process, according to Kaden. The financial damage is small; the access risk is not.

What MetaMask has confirmed

MetaMask acknowledged the breach in a statement on X, saying "part of its infrastructure had been compromised" and that it was exiting affected validators as a precaution while working with clients, partners and security advisers. The wallet provider said it "had identified no immediate threat to MetaMask wallets."

The company emphasized that its staking operation is non-custodial and that it does not hold clients' withdrawal keys. That separation would block an attacker from draining the underlying stake, but it does not neutralize the risk of slashing penalties if validator signing keys were also compromised.

How big is the unsolved exposure?

Kaden said 821 potentially affected validators had not yet left the active set, including three whose fee recipients had allegedly been altered. It remains unclear why those validators remain active and whether the attacker retained the ability to redirect additional fee recipients. MetaMask has not disclosed the total number of affected validators, whether signing keys were exposed, or whether any slashing event has occurred.

What the exit looks like on Ethereum

The validator departures have already clogged Ethereum's withdrawal infrastructure. Validator Queue data showed about 773,447 ETH waiting to exit on Wednesday, a 13-day and 10-hour queue. A further 7.6-day sweep delay follows once validators become withdrawable.

That is the deepest exit backlog since December 2025 and exceeds the roughly 476,000 ETH queued during a May surge, according to Validator Queue's historical records. The bottleneck is a protocol-level safeguard rather than a network failure: Ethereum caps stake movement at 256 ETH per epoch, with each epoch lasting roughly 6.4 minutes, to keep sudden churn from destabilizing proof-of-stake consensus.

Why MetaMask-linked stake could take 45 days to clear

For users staked through MetaMask's Lido-operated validators, the timeline stretches further. Lido estimated on X that the full exit, withdrawal, and re-entry cycle could run up to 45 days, partly because returning validators must also clear an entry queue that currently sits at 27 days.

MetaMask has yet to publish a post-mortem specifying how the attacker altered fee recipients, whether any signing key was exposed, or how many validators were ultimately drained of their block rewards before the exits began. Until that disclosure lands, the 821 still-active validators flagged by Kaden represent the largest outstanding question for stakers weighing whether to remain in the affected pool or rotate their position once withdrawals become available.