Part of the infrastructure of MetaMask's non-custodial staking business has suffered a security incident. As a precautionary measure, the validators it operates on Lido have begun to exit. stETH holders do not need to take any action; Ethena, ether.fi, and Aave all state that their own products currently have no exposure.
As of press time, the parties involved have still not disclosed the specific technical path of the attack.
The core fact currently known is that the entity involved is the staking infrastructure of MetaMask Staking (formerly Consensys Staking).
Starting point of the incident: Metamask announcement (Beijing time Oct 1, 7:38 AM)
MetaMask stated that part of its infrastructure has been affected by a security incident and that it is coordinating with clients, partners, and security advisors to proactively exit the affected validators in non-custodial staking. The relevant staking is non-custodial, and the company does not manage withdrawal keys on behalf of clients. No direct threat to the MetaMask wallet has been found so far.
Lido responded quickly (7:44 AM)
In its response, Lido described the background of the incident as a precautionary measure after an "infrastructure intrusion investigation"; the target is clearly the Ethereum validators operated by MetaMask Staking in Lido; stETH holders do not need to act; ETH will gradually return along the exit, withdrawal, and re-entry cycle, up to about 45 days.
Lido also reminded that this is non-custodial staking, and MetaMask does not hold client withdrawal keys. A full investigation is still ongoing.
In the same time window, Aave founder Stani posted that the team is monitoring developments together with Lido, the Aave market has not been affected, and business is operating normally.
Ethena founder responds (8:09 AM)
Ethena founder Guy Young posted on social media that he is aware of the situation related to a "security incident involving an Ethereum node operator." USDe's backing assets currently do not include any direct exposure to stETH or any other liquid staking token. No impact on Ethena is expected.
ether.fi responds (9:59 AM)
ether.fi officially posted on social media that it is aware of a previous security incident related to an Ethereum node operator. WEETH has no risk exposure and therefore will not be affected in any way. All funds are safe.
On-chain unusual activity (earlier than the Metamask announcement)
On-chain data analyst @ai_9684xtpa posted monitoring showing that in the early hours of today Beijing time, an ancient whale who had subscribed to 560,000 ETH at the ICO price in 2015 transferred 133,298 ETH to a new address 0x69e…27e93, worth about $356 million.
Data shows that the whale's ETH cost was only about $0.31 per coin. This transfer is its first ETH transfer of over $100 million in a single transaction in 4 years.
Afterward, data analysis account Lookonchain stated that the wallet is suspected to be associated with Ethereum co-founder Joseph Lubin, who is also the founder and CEO of Consensys (MetaMask's parent company).
