MetaMask has disclosed new details about a security breach that allowed an attacker to redirect Ethereum staking rewards. Although the intrusion affected part of the company’s staking infrastructure, MetaMask says its cryptocurrency wallets, private keys, and customers’ deposited funds were not compromised.
The incident was discovered on September 28, 2026, but MetaMask initially provided limited information about the affected systems. Its first public announcement, issued two days later, confirmed an infrastructure security problem and explained that the company was taking precautionary measures to protect customers.
In an update published on November 5, MetaMask revealed that an unauthorized party had accessed infrastructure responsible for storing the addresses used to receive certain Ethereum staking rewards. The attacker briefly modified those addresses, causing approximately 0.385 ETH in execution-layer rewards to be sent elsewhere.
The stolen rewards were separate from the Ethereum originally deposited by customers. MetaMask said investigators found no evidence that the attackers obtained withdrawal keys or gained the ability to transfer customers’ staked assets.
The distinction matters because Ethereum staking uses separate mechanisms for managing deposited funds and distributing certain rewards. While changing a reward recipient address can redirect earnings, it does not automatically provide control over the underlying staked cryptocurrency.
Following the discovery, MetaMask began withdrawing affected validators from Ethereum’s staking process. Validators are network participants responsible for proposing blocks and verifying transactions, helping maintain the blockchain’s operation.
The precautionary exits were intended to reduce the risk of additional losses while the company investigated the intrusion. MetaMask confirmed that all affected validators have now exited and that the compromised systems have been secured.
However, the response created temporary difficulties for some staking customers. Validator exits can delay withdrawals because leaving the staking process and making deposited Ethereum available for withdrawal are separate operations.
Some customers may also have missed potential staking rewards while their validators were exiting or waiting to resume operations. MetaMask said it is working with affected customers and partners to address these consequences and reimburse diverted rewards.
The company emphasized that its non-custodial wallet infrastructure was not involved in the breach. Users’ Secret Recovery Phrases and private keys, which control access to their cryptocurrency wallets, were not exposed through the incident, according to its investigation.
MetaMask has not publicly identified the attacker or explained how the unauthorized access was initially obtained.
Regular MetaMask wallet users do not need to take any action because of this incident. Customers affected by the staking disruption should follow instructions provided directly by MetaMask or their staking service provider.