MetaMask Wallets Safe After Staking Incident, Lubin Says
Joseph Lubin says MetaMask wallets and keys were not hit. The incident touched staking validators, which are being exited. What Indian users should do now.
MetaMask wallets, keys and Secret Recovery Phrases were not affected by the security incident the wallet disclosed on 30 September 2026, Consensys founder Joseph Lubin said in a statement that spread on Saturday, 3 October. The breach hit part of the infrastructure that runs MetaMask's Ethereum staking validators, and those validators are being shut down as a precaution, with exits expected to finish by 7 October. Ether is at ₹259,145 on our Ethereum price in INR page.
Key takeaways
- On 30 September MetaMask said it was "responding to a security incident affecting part of our infrastructure" and had found "no immediate threat to MetaMask wallets".
- An unauthorised address collected about 0.36 ETH (roughly ₹93,000) of block rewards from 18 blocks produced by MetaMask-run validators.
- Lubin says recovery phrases, keys and wallet balances "CANNOT be" part of such an incident because users hold their own keys.
- Validator keys have been rotated, and affected validators are leaving Ethereum's staking system, with the last exits expected by 7 October.
- If you only use MetaMask as a wallet, you do not need to do anything. Beware of fake "security update" messages.
What happened
MetaMask, built by the US company Consensys, offers a staking service through which users can earn rewards on ETH. It runs Ethereum validators, the machines that propose and confirm blocks, including some in the pool of the staking protocol Lido. On 30 September MetaMask said it was "proactively exiting affected validators within our non-custodial staking operations, in coordination with clients, partners and security advisors".
The attacker gained access to a setting called the fee recipient. Every validator has one: it is the address that collects transaction tips when the validator produces a block. On 30 September an unauthorised address received about 0.36 ETH from 18 blocks. That is a small sum, but it showed someone could change the configuration, so MetaMask began pulling the validators out. Lido said MetaMask validators in its pool had started exiting, that the exits should complete by 7 October, and that holders of its stETH token did not need to take any action.
What was affected and what was not
| Part | Affected? | Why |
|---|---|---|
| MetaMask wallet app, Secret Recovery Phrase, private keys | No, says Consensys | Your keys are created and stored on your own device; Consensys never holds them |
| Staked ETH deposits | No, says Lubin | Withdrawal keys are separate from the keys that run validators |
| Fee recipient on some MetaMask validators | Yes | About 0.36 ETH of block rewards was diverted on 30 September |
| MetaMask staking validators | Being exited | A precaution; keys rotated, exits due to finish by 7 October |
Lubin put it bluntly: "Your Secret Recovery Phrase, your keys, and the assets in your wallet were not part of this incident because they CANNOT be. You custody and control your own keys." He added that a security problem in validator infrastructure could not lead to staked ETH being moved to another address, because Ethereum keeps the key that signs blocks separate from the key that controls withdrawals, and Consensys does not hold customers' withdrawal keys.
Why this matters
This is not a wallet hack, and no user balances have been reported stolen. It is still a reminder that staking through any provider adds a layer of operational risk on top of price risk. When validators are exited, they stop earning, and getting back into Ethereum's staking system means joining a queue that can take weeks, so staking rewards through MetaMask may pause for a while. September 2026 was already the worst month of the year for crypto thefts, as we reported in $766 million lost to hacks in September, so scammers have plenty of news to exploit.
What Indian MetaMask users should do
- Wallet only? No action is needed. Keep using MetaMask as normal and keep the app or browser extension updated from the official store.
- Never type your Secret Recovery Phrase into any website, form or chat, whatever the message says. No genuine support team will ask for it. Our guide to storing a seed phrase safely explains why.
- Ignore "urgent security update" emails and DMs. Incidents like this are routinely followed by phishing that copies the brand. See how to avoid crypto scams in India.
- Staking through MetaMask? Check the staking screen in the app and MetaMask's official channels for updates on rewards and timing.
- Holding a large amount? Consider moving long-term savings to a hardware wallet; compare options in hot vs cold wallets.
Using MetaMask is legal in India; our MetaMask legality guide covers the rules. Staking rewards and any gains on selling ETH are taxed, as explained in our staking tax guide.
What to watch next
- Completion of the validator exits by 7 October, and when MetaMask restarts staking.
- A fuller incident report from Consensys on how the access was gained.
FAQ
Was MetaMask hacked?
Part of the infrastructure behind MetaMask's staking validators was breached on or before 30 September 2026. MetaMask and Consensys say wallets, recovery phrases and private keys were not affected.
Is my money in MetaMask safe?
Consensys says there is no evidence that MetaMask wallets or user funds were affected, and that self-custodied keys could not be part of the incident. Never share your recovery phrase with anyone claiming to help.
Do I need to move my funds out of MetaMask?
No action is required for ordinary wallet users. If you stake ETH through MetaMask, check the app for updates, as validators are being exited until about 7 October.
This article is AI-assisted, educational and general in nature. It is not financial advice and never a guarantee of profit. Every trade is at your own risk on your own exchange. See our risk disclosure and editorial policy.
