MetaMask security incident forces Ethereum staking exits, no funds at risk

A validator also has an address for receiving transaction-fee payments when it produces a block. Changing that destination can divert income without changing where the original stake goes when withdrawn. Ethereum sets those destinations separately.

Someone controlling those credentials could make a validator approve conflicting records, triggering a punishment called slashing, in which Ethereum destroys some of its stake and removes it from service. Neither MetaMask nor Lido has reported that this happened.

Lost income while validators leave

The precautionary shutdown carries a cost even if the staked coins remain secure.

Lido, a service that pools users’ ETH for staking, said early Wednesday that MetaMask-operated validators had begun leaving its system. The last are expected to stop staking by Oct. 7, although their ETH will not necessarily have been withdrawn by then.

Withdrawing the coins and putting them back into staking could take up to approximately 45 days because of the queue to enter Ethereum’s staking system. The affected validators would miss rewards while out of service and could incur penalties if taken offline before completing their exits.

“No action is required from stETH holders,” Lido said. Its stETH token represents users’ pooled stake and accumulated rewards.

Read More: MetaMask adds ‘pooled staking’ for cheaper Ethereum validation