MetaMask security scare pushes Ethereum validator exits to a nine-month high

MetaMask is pulling thousands of Ethereum validators offline following a security breach that rerouted rewards, resulting in a network-wide congestion issue for stakers attempting to leave.

According to onchain security researcher Kaden, approximately 17,000 validators operated by MetaMask—representing roughly 523,000 ETH—were proactively withdrawn after an investigation revealed that transaction-fee rewards from 18 out of 19 block-proposing validators were misdirected to an address funded via Tornado Cash, an Ethereum privacy protocol designed to mix and anonymize cryptocurrency transactions.

Kaden noted that the attacker appears to have stolen just about 0.36 ETH. However, the greater worry centers on how the intruder secured enough access to modify fee recipients, and whether that breach compromised validator signing keys, which risks triggering slashable actions.

MetaMask has not verified these numbers or revealed the root cause of the breach. Instead, the firm stated that a segment of its infrastructure was breached, prompting it to pull affected validators as a preventive measure while collaborating with clients, partners, and security experts. The company added that standard MetaMask wallets face no immediate danger.

Furthermore, MetaMask emphasized that its staking service operates on a non-custodial basis, meaning it does not manage clients’ withdrawal keys. While this division stops an attacker possessing only validator-level access from taking the underlying stake, it does not rule out penalties if signing keys were exposed and exploited.

Kaden pointed out that 821 potentially impacted validators remain active, including three among those whose fee rewards were reportedly redirected. It is still unknown why these remain online or if the perpetrator still has access to alter further fee recipients.

MetaMask has not yet clarified the total count of impacted validators, whether signing keys were breached, or if any slashing penalties have taken place.

Ethereum’s withdrawal backlog spikes to 9-month high

At the same time, this security breach and subsequent withdrawals are already impacting Ethereum’s broader staking framework.

Validator Queue data showed that roughly 773,447 ETH was queued to depart the validator set on Wednesday, pointing to a 13-day and 10-hour delay before an exiting validator clears the line. An additional withdrawal sweep delay was projected at 7.6 days.

According to historical records from Validator Queue, this represents the highest exit backlog since December 2025, surpassing the approximately 476,000 ETH pending during a prior spike in May.

This bottleneck is the result of a native Ethereum safeguard rather than a failure in transaction processing.

Ethereum restricts the speed at which stake can join or leave the validator network to stop sudden shifts from undermining its proof-of-stake consensus mechanism. Validator Queue data indicated a churn rate of 256 ETH per epoch, with each epoch taking about 6.4 minutes. Consequently, a massive wave of exits must be handled incrementally rather than all at once.

The extra 7.6-day sweep phase kicks off once validators finish the exit queue and are ready for withdrawal. Ethereum then iterates through eligible validators and routes balances to their designated withdrawal destinations.

The disruption may persist even longer for stake tied to MetaMask. Lido—where MetaMask runs validators—estimates that the complete exit, withdrawal, and eventual re-entry cycle could require up to 45 days, partly because validators coming back to Ethereum must also face a lengthy entry queue that currently stands at 27 days.