MetaMask Staking Breach Moved 0.385 Ethereum (ETH) in Validator Rewards

0.385 ETH Moved Through a Changed Reward Address

A reward address held inside MetaMask's own infrastructure stopped paying where it should, and about 0.385 Ethereum (ETH) in staking rewards moved to an outside address as a result. MetaMask says an attacker gained unauthorized access to part of its infrastructure on September 28 and changed the reward recipient for some of its validators, the participants who confirm transactions and earn rewards on the Ethereum network's proof of stake design. The company spotted the altered address on the day of the incident and corrected it immediately, according to its official incident update, published on Thursday.

The mechanism sat in storage rather than in the protocol itself. The reward receiving address for some validators was kept in centrally managed infrastructure, so a party that reached that system could redirect payouts without touching a single user wallet. The 0.385 ETH that moved is execution-layer reward income, the continuous payout validators collect while active, and it stands apart from the staked principal behind each customer position. MetaMask's staking service runs validators on customers' behalf, which is why a change to one stored field could drain income across several positions at once. The same-day correction closed the window in which payouts could be sent to the wrong recipient.

MetaMask's update, issued on Thursday, confirms the exit procedure for every affected validator is now complete. Exiting a validator ends its validation duties and its reward stream, a containment step the company took once the redirection surfaced. An earlier on-chain estimate had put the redirected transfer near 0.36 Ethereum (ETH) to an unidentified address; MetaMask's 0.385 ETH figure is its own accounting for the same incident, not an additional loss on top of that estimate. The disclosure landed as the Ethereum (ETH) price fell 7.9% over the past 24 hours, per COINOTAG's live market monitoring.

Principal and Keys Untouched

MetaMask's investigation found no evidence that customer staking principal or withdrawal keys were compromised. The update is equally explicit about the wallet product itself: no signs point to a breach of the wallet or its infrastructure, and users' secret recovery phrases and private keys were not exposed in this incident. What the attacker reached was the reward plumbing, not the vault.

An exit, meanwhile, is a procedural step rather than a payout. It ends the validator's participation and its reward stream, but it does not by itself release customer funds, which follow a separate withdrawal process on Ethereum (ETH) afterwards. Once a validator's exit completes, its balance becomes withdrawable on the network's own schedule, so the delay sits between the exit finishing and the funds actually reaching customers. That gap produced the main customer-facing symptom: some clients hit temporary withdrawal delays while their validators went through the exit. MetaMask also concedes that some customers may have missed rewards while validators sat exited or waited to be reactivated. The update does not put a figure on that missed-reward amount, and it is distinct from the 0.385 ETH that was redirected out of the service. The distinction matters for scale: the 0.385 ETH is reward income that left, while the unquantified amount is income that was delayed, not taken.

The company has told regular wallet users that no action is required on their part. Customers whose staking agreements were touched by the incident are directed to guidance delivered directly by MetaMask or by their staking provider. MetaMask says it has blocked the unauthorized access, secured the affected systems, and is working through any remaining impact with customers and partners. Regular users of the wallet itself fall outside that group entirely, since the company reports no indication that wallets were touched at all.

The load-bearing fact sits in MetaMask's own account of where the reward addresses were kept: a payout pointer lived in central infrastructure that the attacker could reach, so this was a storage-design failure rather than a flaw in Ethereum's protocol or in the wallet's key handling. The realized theft of 0.385 ETH is small, and the exits contained the exposure. Two items stay open. The update does not quantify the rewards customers may have missed while validators sat exited, and it describes where the addresses were stored without explaining how the unauthorized access was gained. Until both answers arrive, 0.385 ETH measures what was taken, not the full cost of the incident.