MetaMask Says Affected Validators Have Exited; 0.385 ETH in Rewards Diverted
MetaMask’s November 5 update says affected validators have exited. About 0.385 ETH in rewards was diverted; it found no evidence of compromised staked principal or withdrawal keys.
MetaMask said on November 5, 2026 that all affected Ethereum validators had exited following the infrastructure incident identified on September 28. It described the exits as a precaution and said the unauthorized access had been contained.
Rewards, principal and withdrawal timing are different
According to MetaMask, an attacker briefly changed certain validators’ execution-layer reward recipient addresses, diverting about 0.385 ETH. It reported no evidence that staked principal or withdrawal keys were compromised, and no indication of a compromise of MetaMask wallets. Some customers faced withdrawal delays and potentially missed rewards. Validator exit does not mean funds are immediately withdrawable.
OrangeX.com Analysis
Our reading is that the update separates reward-routing exposure from control of staked principal. These are the provider’s findings, not an independent audit. Affected staking customers should follow direct official guidance; ordinary wallet users were told no incident-related action was needed. Never disclose recovery phrases or private keys in response to unsolicited messages.
Related Reports
BTCPay Urges Fresh Servers for Affected Old Instances, Beyond a Version Update
BTCPay’s November 2 advisory links attacks to 2.4.1 and earlier. It recommends a fresh server and new wallet for affected old instances, even if subsequently updated.
HKMA and HKUST Launch Post-Quantum Planning Toolkit for Banks
The HKMA and HKUST launched a PQC Toolkit on November 2. It supports bank transition planning after an initial readiness score of 2.3/10; full readiness by 2030 is a target.
Chainalysis Discloses Customer Data Access as Security Investigation Continues
Chainalysis says customer identity records were accessed, with no evidence to date of access to investigation content, clear-text passwords or session tokens.
