A MetaMask Breach Left Ethereum Stakers in a Two-Week Exit Line

About 523,000 ether left Lido's validator set over the past week, and the line to get out of Ethereum staking has not been this long all year. MetaMask pulled roughly 17,000 validators as a precaution after disclosing a security incident on 30 September. The amount the attacker actually diverted was tiny. Researchers put it at about 0.36 ETH of block-production payments, under $1,000. Exiting the network now takes close to a fortnight, against roughly three and a half days before the withdrawals began.

A fee recipient, swapped

Every Ethereum validator names an address that collects its block-production payments, the fee recipient. On 18 of the 19 affected MetaMask validators, CoinDesk reported, that address had been changed. The researcher who traced it publishes as 0xKaden, and CoinDesk renders the same handle as Kaden.

Block rewards were "not paid to the correct fee recipient but instead to this tornado [Cash] funded account," the researcher wrote in an account The Cryptonomist carried on 2 October.

MetaMask's staking is non-custodial, so the company never holds withdrawal keys for client stakes. The breach hit the payout address, not the principal. In a statement on 1 October the company said it had "identified no immediate threat to MetaMask wallets", and an update the same day said the investigation "found no indication that wallets or customer funds had been affected". How the infrastructure was compromised is still not explained anywhere read here.

The churn limit does the rest

Ethereum lets only about 57,600 ether a day in or out of the validator set. The cap is deliberate, built so that no single operator can reshape the validator set overnight. Push 523,000 ether against a 57,600 ceiling and a queue forms. The Cryptonomist values the withdrawn stake at $1.4 billion, a figure no second account read here carries.

Two counts of the same queue

The size of the backlog depends on which tally is used, and the two do not reconcile. CoinDesk puts the exit queue at 166,000 ether on 29 September and 851,000 ether on 2 October, more than fivefold in three days and the highest of the year, easing to 786,000 ether by Monday, over $2 billion. The Cryptonomist describes the queue going from around 200,000 ether to over 700,000 within a single day. Both land on a wait of nearly two weeks. We could not establish which starting figure supersedes which, and no account read here reconciles them.

The other queue is shortening

Traffic is moving the other way at the entry gate. Roughly 1.5 million ether is waiting to be staked, worth about $4 billion, at an estimated 25-day wait, down from some 2 million ether and a 35-day wait in early September, CoinDesk said on Monday. Lido, which took a $200 million staking allocation from SharpLink in August, expects the affected validators to stop staking around 7 October, with the ether re-entering staking across roughly 45 days. So most of what is leaving is due back, and it will join that entry queue when it gets there. Lido said stETH holders need do nothing, because pooled stakes and accrued rewards are untouched; it also warned that the affected validators would miss rewards across the exit and the return.

Two things about this will matter later. One is whether any downtime penalties were actually charged against the exiting validators. The other is whether the 523,000 ether goes back to Lido or is staked somewhere else. MetaMask, which Consensys spun out as a separate company this year, has not said. What the episode shows is how much of Ethereum's validator set sits with operators the staking protocols do not themselves run. The exits finish this week. The 45 days after that are the part nobody has priced.