MetaMask staking infrastructure compromised? Lido, Ethena, and others all state they are unaffected | Live updates

Part of the infrastructure for MetaMask's non-custodial staking business has suffered a security incident. As a precaution, the validators it operates on Lido have begun to exit. stETH holders do not need to take any action; Ethena, ether.fi, and Aave all say their own products currently have no exposure.

As of press time, none of the parties had disclosed the specific technical path of the attack.

The core fact known so far is that the entity at the center of the incident is the staking infrastructure of MetaMask Staking (formerly Consensys Staking).

Starting point of the incident: MetaMask announcement (Beijing time Oct 1, 7:38 AM)

MetaMask said that some infrastructure has been affected by a security incident and that it is coordinating with clients, partners, and security advisers to proactively exit the affected validators in non-custodial staking. The staking involved is non-custodial, and the company does not manage withdrawal keys on behalf of clients. So far, no direct threat to the MetaMask wallet has been found.

Lido responded quickly (7:44 AM)

In its response, Lido described the background of the incident as a precautionary measure following an "infrastructure intrusion investigation"; the target is clearly the Ethereum validators operated by MetaMask Staking in Lido; stETH holders do not need to act; ETH will gradually return through the exit, withdrawal, and re-entry cycle, up to about 45 days.

Lido also reminded that this is non-custodial staking, and MetaMask does not hold client withdrawal keys. A full investigation is still ongoing.

In the same time window, Aave founder Stani posted that the team is monitoring developments together with Lido, Aave markets are unaffected, and business is operating normally.

Ethena founder responds (8:09 AM)

Ethena founder Guy Young posted on social media that he is aware of the situation related to a "security incident involving an Ethereum node operator." USDe's backing assets currently do not include any direct exposure to stETH or any other liquid staking token. No impact on Ethena is expected.

ether.fi responds (9:59 AM)

ether.fi officially posted on social media that it is aware of a previous security incident related to an Ethereum node operator. WEETH has no risk exposure and therefore will not be affected in any way. All funds are safe.

On-Chain Activity (Before Metamask Announcement)

On-chain data analyst @ai_9684xtpa posted monitoring data showing that in the early hours of today Beijing time, an ancient whale who subscribed to 560,000 ETH at the ICO price in 2015 transferred 133,298 ETH to a new address 0x69e…27e93, worth approximately $356 million.

Data shows that the whale's ETH cost was only about $0.31 per coin. This transfer marks the first time in 4 years that it has conducted a single ETH transfer worth over $100 million.

Subsequently, the data analysis account Lookonchain stated that the wallet is suspected to be associated with Ethereum co-founder Joseph Lubin, who is also the founder and CEO of Consensys (the parent company of Metamask).