MetaMask reported on September 30, 2026 a breach affecting its Ethereum validator infrastructure. An attacker diverted approximately 0.36 ETH in rewards from 18 of the 19 affected validators. The company confirmed no customer accounts or assets were compromised. Around 17,000 validators holding roughly 523,000 ETH in total are being taken offline, with exits expected to complete by October 7, 2026. Users do not need to take any action since the staking setup is non-custodial, meaning MetaMask does not control their withdrawal keys.
Source: Read the original article

