MetaMask, the software cryptocurrency wallet maker, said on 1 October it is responding to what it described as an "ongoing security incident" impacting part of its infrastructure, remediating internally "in coordination with external partners and security advisors" — and disclosed no further detail about the nature or scope of the issue. It states it has identified no immediate threat to MetaMask wallets. As a precaution it is proactively exiting affected validators within its non-custodial staking operations, in coordination with clients and partners, noting it does not manage withdrawal keys on behalf of clients. Lido, the liquid staking protocol, confirmed MetaMask has begun out-of-order exits of its operated Ethereum validators to reduce risk of network penalties, with foregone rewards and possible downtime penalties likely, and expects the final validators to be exited — though not fully withdrawn — by the end of 7 October 2026. The substance of the infrastructure compromise, who is behind it and whether customer data was reached are all unverified; the developing story rests on the company's own precautionary action, and validators exiting as a protective measure is not itself evidence of a successful attack on staked assets.

• Source article

Escalation — 4 October 2026: second-sourced and re-reported

BleepingComputer re-reported the incident on 3 October with the same core facts — the 1 October disclosure, the "no immediate threat to MetaMask wallets" statement, and the precautionary validator exits with Lido Finance confirming the final validators are expected to be exited, though not fully withdrawn, by 7 October. The added detail is a negative: MetaMask declined to specify which infrastructure was affected or whether any systems or data were accessed or compromised, and has not linked the incident to user funds. The incident therefore remains an unquantified infrastructure compromise with a visible operational response, not a confirmed compromise of staked assets. BleepingComputer