MetaMask, the cryptocurrency wallet provider that also operates Ethereum staking services, has begun exiting affected validators following a security incident that diverted an estimated 0.36 ETH in block-production payments to an unexpected address. The company disclosed the incident Wednesday and said it found no immediate threat to user wallets.

"At this time, we have identified no immediate threat to MetaMask wallets," the company said in its disclosure, adding that the incident affected part of its infrastructure and that it pulled the affected validators out of service as a precaution.

Ethereum security researcher Kaden reported on X that 18 of 19 MetaMask-operated validators that had earned payments for producing blocks sent those payments to an address not controlled by the operator. He estimated roughly 0.36 ETH in rewards was diverted. Kaden's analysis put the precautionary exits at approximately 17,000 validators holding about 523,000 ETH. MetaMask has not confirmed those figures, and as of Asian afternoon hours Thursday it had not published an explanation of how its systems were compromised.

The technical mechanics matter for understanding the blast radius. A validator on Ethereum has a separate address for receiving transaction-fee payments when it produces a block. Changing that destination diverts income without changing where the original stake can be withdrawn. Ethereum sets those two destinations independently, which explains how block rewards could be redirected while the underlying staked ETH remained pointed at its intended withdrawal credentials.

The exposure, however, could have been worse. Someone controlling validator credentials can make a validator approve conflicting records, triggering slashing — the protocol-level punishment in which Ethereum destroys part of a validator's stake and removes it from service. Neither MetaMask nor Lido has reported that slashing occurred.

Operational costs of the shutdown

The precautionary exit carries a real economic cost even if no stake is lost. Lido, the pooled staking service through which MetaMask operates validators, said early Wednesday that MetaMask-operated validators had begun leaving its system. The last are expected to stop staking by Oct. 7, though their ETH will not necessarily have been withdrawn by then.

Withdrawing the coins and returning them to staking could take up to approximately 45 days because of the queue to enter Ethereum's staking system, according to Lido. The affected validators will miss rewards while out of service and could incur small penalties if taken fully offline before completing their exits.

"No action is required from stETH holders," Lido said. The stETH token represents users' pooled stake and accumulated rewards in the protocol.

Contagion checks across the market

The disclosure prompted defensive moves elsewhere. Ethena, the company behind the dollar-linked USDe token, withdrew funds from lending platform Morpho amid the news. Reported movements included roughly $75 million from a vault holding Ripple's RLUSD stablecoin and $60 million from another holding PayPal's PYUSD. A source close to Ethena described the withdrawals as precautionary. On-chain data shows Ethena has since redeployed the funds after receiving clarity on the situation.

Large wallet movements also drew scrutiny. Blockchain tracker Lookonchain reported that a wallet it linked to Ethereum cofounder Joseph Lubin, whose firm Consensys owns MetaMask, transferred 133,298 ETH — worth about $356 million — to a new address. It was not immediately clear whether the movement was connected to MetaMask's incident response.

The central unresolved question is how the attacker or malfunction altered the fee-payment destinations on MetaMask's validators. Until MetaMask publishes a post-mortem confirming Kaden's figures and explaining the compromise, counterparties will likely continue treating MetaMask-operated infrastructure with caution. The next concrete marker is Oct. 7, when the final affected validators are expected to stop staking — and when the roughly 45-day re-entry clock begins for returning the capital to productive service.