MetaMask Probe Finds 0.385 ETH Staking Rewards Diverted
An infrastructure security incident led a threat actor to divert a small amount of staking rewards, with MetaMask wallets and private keys left unaffected.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you trust crypto wallet providers to keep your funds secure?
MetaMask disclosed on September 30 that it was investigating an ongoing infrastructure security incident in which a threat actor accessed systems used to store recipient addresses and diverted some execution-layer staking rewards. The company said the issue was identified and addressed the same day, and that approximately 0.385 ETH in rewards was diverted.
Why it matters
The incident shows how attacks on infrastructure supporting crypto staking can reach user rewards even when wallets themselves are not compromised. Because the diverted rewards are separate from customers' staked ETH, the impact was limited, but it highlights the operational risks tied to staking services.
The disclosure cites a specific figure of approximately 0.385 ETH in execution-layer staking rewards diverted from systems storing recipient addresses. The extraction does not describe the technical method used or whether further diversion attempts were identified.
The players
MetaMask
MetaMask is a self-custodial Ethereum wallet developed by Consensys that offers staking services to users.
The details
A threat actor gained access to systems used to store recipient addresses and diverted some execution-layer staking rewards. MetaMask said it exited affected validators within its non-custodial staking operations as a precaution, causing temporary withdrawal delays for some customers.
Timeline
September 30: MetaMask revealed it was investigating the infrastructure security incident.
Thursday: MetaMask disclosed that the threat actor had diverted staking rewards.
The Tech Race
The MetaMask incident is far smaller than the $6.34 billion stolen by North Korean hackers from Binance, but it fits a pattern of attackers targeting crypto infrastructure rather than individual wallets. Security teams across the industry are now weighing how staking and custody systems hold up under similar intrusions.
Users who stake ETH through MetaMask may have seen temporary withdrawal delays while validators were exited as a precaution. MetaMask says it is working with affected customers and partners to refund the lost rewards.
The takeaway
Staking users should watch for infrastructure-level risks even when their own wallet keys remain secure. Checking how a provider handles precautionary validator exits and reward refunds can help set expectations during an incident.
Further reading
Explore more Cybersecurity coverage on Wisevoter for related breaches and defenses.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust crypto wallet providers to keep your funds secure?
