MetaMask says hackers diverted about 0.385 ETH in staking rewards, but did not get into regular wallets or customers' staked ETH. The company says it found and addressed the issue the same day.
What happened
MetaMask is a crypto wallet made by Consensys. It is non-custodial, which means users control their own keys instead of a company holding them. It also offers staking, where customers help run the Ethereum network through validators. Validators are computers that verify transactions. On September 30, MetaMask said it was investigating an infrastructure incident and exited affected validators. In a Thursday update, it said an attacker got into systems that store recipient addresses and diverted some staking rewards.
MetaMask says it found no evidence that staked principal or withdrawal keys were compromised. It also says Secret Recovery Phrases and private keys were not exposed. It is working to refund the lost rewards.
Who it affects
People who use MetaMask as an ordinary wallet need to do nothing. Staking customers may have seen withdrawal delays and missed rewards while validators exited or waited to restart. Those customers should follow guidance sent directly by MetaMask or their staking provider.
What is not known
The update does not say how the attacker got in, how many customers were affected or when refunds will be finished. MetaMask says it is working directly with affected customers and partners.
The takeawayRegular MetaMask users need to do nothing, but anyone who stakes through it should follow the guidance MetaMask or their provider sends directly.