MetaMask says an attacker briefly changed the recipient addresses used for Ethereum staking rewards during a security incident involving part of the company’s infrastructure, diverting approximately 0.385 ETH.
The company disclosed the amount in a November 5 update on an incident it identified on September 28, 2026.
The affected addresses were stored on systems accessed by the attacker. MetaMask said it identified and addressed the change on the same day. The diverted execution-layer rewards were separate from customers’ staked ETH, and the company said it found no evidence that customers’ staked principal or withdrawal keys had been compromised. It also reported no compromise of users’ Secret Recovery Phrases or private keys.
MetaMask said the unauthorized access has been contained and the affected systems secured. All affected Ethereum validators operated through MetaMask Staking have now exited as a precaution. The company said some customers experienced temporary withdrawal delays and may have missed staking rewards while validators were exiting or awaiting reactivation. It is working with affected customers and partners to address the remaining impact.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
