Incident case file

MetaMask Staking — Infrastructure compromise redirects block tips, ~17,000 validators exit

Incident date Sep 30, 2026Last updated Oct 8, 2026

4 views

ActiveEthereum L1Infrastructure compromise (validator fee-recipient redirection)Cluster: MMSTAKE-INFRA-2026-09

Estimated loss

$970

Affected users

Group joining is coming soon.

Investigation

50%

Facts and investigation

Ledger

Attacker

0x98B9231de84334c1d48BA0b72CF13f92484924A3 (Ethereum EOA that received the diverted block tips, published by researcher Kaden). Operator unknown; the intrusion vector has not been disclosed.

Funds moved to

No outgoing transaction from 0x98B9231de84334c1d48BA0b72CF13f92484924A3. It holds about 0.4592 ETH as of the Oct 4 export (0.0977871452318 ETH funding + 0.361388997344722091 ETH of diverted tips).

Linked

Funding: 0.0977871452318 ETH withdrawn from the Tornado Cash 0.1 ETH pool (router 0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b, relayer 0x4750bcfcc340aa4b31be7e71fa072716d28c29c5) on Sep 30 at 10:27:23 UTC (block 26089692). Each of the 18 diverted payments transits an intermediate contract, 0xfeeeeee44046c3f61a8cc081e0918ef0de0a7ffc, which self-destructs into the wallet; the parent block-payment transactions were sent by 0x4838b106fce9647bdf1e7877bf73ce8b0bad5f97 (13 times) and 0xdadb0d80178819f2319190d340ce9a924f783711 (5 times). Validator exits: 16,965 validators / 565,056 ETH exited or queued per Bitquery (about 7,200 validators / 230,000 ETH for Lido), no slashing; exits end around Oct 7.

Chronology

1 beat

Sep 30, 2026 at 10:27:23 UTC a fresh wallet was funded through Tornado Cash. Between 12:12:23 UTC (block 26090216) and 16:46:11 UTC (block 26091579) 18 block-reward payments of 0.008168 to 0.054245 ETH were redirected to it through an intermediate contract, 0.361388997 ETH in total (about $970 at that day's price). The first validator exit began about 85 minutes before the first diverted block. On Sep 30 at 23:38:56 GMT MetaMask disclosed a security incident affecting part of its staking infrastructure and began exiting its validators as a precaution; 16,965 validators holding 565,056 ETH exited or queued (Bitquery), including about 7,200 for Lido. No slashing occurred. MetaMask has not confirmed the amount or the vector; the on-chain figure matches the 0.36 ETH reported by Kaden and Bitquery. Exits are expected to finish around Oct 7. The beneficiary wallet has not moved any funds.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)