MetaMask is pulling roughly 523,000 ETH out of Ethereum staking, worth about $1.41bn, after an attacker rerouted the addresses that collect its validators’ block rewards. The amount actually diverted, by one researcher’s count, was 0.36 ETH. That is about $970.
No staked coins were taken and no wallets were touched. MetaMask said it has identified no immediate threat to MetaMask wallets, and Lido, whose protocol those validators run under, said no action is required from stETH holders.
Why it cannot be done selectively
The scale comes from not knowing which validators are clean. Ethereum researcher Kaden checked MetaMask’s recent block proposals and found 18 of 19 paying out to an address that should not have been there. Neither company has confirmed how the attacker got in, how many validators carry the altered setting, or how much ETH sits behind them, so the counts here are Kaden’s estimates rather than company figures.
With the payout address compromised at that hit rate and the entry point still unexplained, exiting the whole set is the only option that does not involve guessing. About 17,000 validators are coming out, close to 2% of the 878,928 active on the network. Exits are expected to finish by 7 October.
The wait is almost all re-entry
Lido developer Will Shannon put the round trip at up to 45 days because of the entry queue. The split is lopsided. Leaving takes days, withdrawals then sweep over roughly a week, and the queue to get back in is running at about 27 days with 1.58m ETH already lined up ahead.
So the penalty is not the exit. It is that Ethereum makes it slow to come back.
What a $970 theft costs
Staked ETH earns about 2.64% a year at present. Applied to 523,000 ETH sitting idle for 45 days, that is roughly 1,700 ETH of rewards not earned, around $4.6m at today’s price. Set against the $970 diverted, the precaution costs about 4,700 times the theft. That calculation is ours rather than either company’s.
The exit is visible at network level too. MetaMask alone accounts for close to three fifths of everything currently queued to leave Ethereum staking, and about 1.2% of the 43.7m ETH staked in total.
stETH holders are insulated from all of it. The token represents pooled stake and accrued rewards, so nobody needs to act, even though the validators behind it earn nothing while they queue.
