NewsCompaniesFlawsGuides
Get the app

MetaMask’s staking service was breached; wallets, recovery phrases and keys were not

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
metamask.com: MetaMask user update on recent security incident
Screenshot: metamask.com

MetaMask found an attacker in its staking infrastructure on 28 September. The attacker briefly redirected some validators’ rewards, about 0.385 ETH, which MetaMask says it is refunding. It has shut down every affected validator. Some staking customers had withdrawal delays or missed rewards.

An attacker got into MetaMask’s staking infrastructure and diverted about 0.385 ETH in rewards. Wallets, recovery phrases and keys weren’t reached; watch for fake security messages.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If you use the MetaMask wallet, you don’t need to do anything about this. MetaMask says the attacker never reached wallets, recovery phrases or private keys. What was hit is its staking service, which runs Ethereum validators for customers who stake ETH.

In its 5 November update[1], MetaMask says it found someone in part of its infrastructure on 28 September. For some validators, the attacker briefly changed the address that receives one kind of staking reward, diverting about 0.385 ETH. MetaMask says that was fixed the same day, and it has since shut down every affected validator as a precaution.

MetaMask staking incidentMetaMask Staking validators
HARD level
Watch
Wallets
Not affected; recovery phrases and private keys safe, MetaMask says
Staked ETH
No evidence it was accessed or withdrawn
Lost
About 0.385 ETH in rewards, which MetaMask says it is refunding
Side effects
Some withdrawal delays and missed rewards for staking customers
What’s known.MetaMask’s update of 5 November and BleepingComputer’s report.

Timeline

  1. HARD publishes its article, at Watch.

Who is affected

Only customers who staked ETH through MetaMask’s staking service. Some have had withdrawals held up, and some missed rewards while their validators were being shut down or waiting to restart. MetaMask says it is working with them to refund the lost rewards, BleepingComputer reports[2].

MetaMask is a self-custody wallet: your recovery phrase is stored on your own device, not with the company, and MetaMask says it doesn’t hold the withdrawal keys for customers’ staked ETH. That’s why a break-in at the company didn’t reach wallets.

The bigger risk from news like this is the fake “MetaMask security” message that follows it.

What to do

  1. Wallet users: nothing to change.MetaMask says no action is needed because of this incident. Don’t move funds or “migrate” a wallet because of a message about it.
  2. Never type your recovery phrase anywhere.MetaMask will never ask for your Secret Recovery Phrase or private keys. Any site, email, app or caller that does is a scam, however official it looks.
  3. Staking customers: expect a delay, not a loss.A validator being shut down is not the same as a withdrawal, so funds can take longer to become available or be staked again. Follow guidance from MetaMask or your staking provider, through their official app.

References

  1. ^ MetaMask (). “Security incident update”. The company’s timeline from 28 September, what the attacker changed, and what wallet and staking customers should do.
  2. ^ BleepingComputer (). “MetaMask says recent attack didn’t affect wallet infrastructure”. Reports the update, including MetaMask’s plan to refund the lost rewards.
  3. BleepingComputer (). “MetaMask discloses security incident affecting its infrastructure”. The first disclosure, with few details at the time.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.