MetaMask staking attack diverted 0.385 ETH in rewards

The MetaMask staking attack diverted about 0.385 ETH in Ethereum staking rewards after an attacker gained access to a system that stored payout addresses. In a November 5 update, MetaMask said its wallets and wallet infrastructure remained secure and that it was working with affected staking customers to refund the rewards.

Attacker targeted staking reward payouts

MetaMask first disclosed the incident on September 30. At the time, it said it was investigating an infrastructure security issue and had begun withdrawing affected validators from its non-custodial staking operations. Ethereum validators check transactions and propose new blocks. However, the initial notice gave little detail about which systems the attacker had reached or whether customers had lost funds.

The November update traced the diverted payments to systems that stored recipient addresses for execution-layer staking rewards. These addresses determine where those rewards go. By gaining access to the systems, the attacker could redirect a payout while the customer’s original ETH remained staked.

MetaMask said it identified and addressed the issue on the same day and has since secured the affected systems. Its investigation found no evidence that the attacker gained access to customers’ staked ETH or withdrawal keys. The company also confirmed that users retained control of their wallet private keys and Secret Recovery Phrases.

Validator exits delayed some withdrawals

For some customers, the effects of the MetaMask staking attack extended beyond the diverted payouts. MetaMask withdrew validators as a precaution, and some customers experienced temporary delays when they tried to withdraw their ETH. Customers may also have missed rewards while their validators were exiting or waiting to resume operations.

Those potential missed earnings are separate from the 0.385 ETH that the attacker redirected. The latter figure covers rewards that went to the wrong recipient. By contrast, a validator that goes offline may miss the opportunity to earn a reward in the first place. MetaMask said it was working directly with customers and staking partners to address the remaining impact.

MetaMask clarifies who needs to act

MetaMask said wallet users do not need to take action in response to the incident. For customers whose staking arrangements were affected, the company advised following guidance directly from MetaMask or their staking provider. It was still coordinating refunds for the diverted rewards when it published the update.