MetaMask says wallet users need take no action after its September staking infrastructure incident

What users should do

MetaMask wallet users do not need to take any action as a result of this incident. MetaMask says Secret Recovery Phrases stay on users' own devices in its non-custodial wallet model, and that it has identified no indication that MetaMask wallets or wallet infrastructure were compromised.

Customers whose staking arrangements were affected should follow any guidance MetaMask or their staking provider sends them directly. MetaMask repeats that it will never ask users to disclose a Secret Recovery Phrase or private keys, and that users should stay vigilant against phishing and rely only on official MetaMask channels.

What MetaMask says happened

On 28 September 2026 MetaMask identified a security incident involving unauthorized access to part of its infrastructure. It says it contained the incident, secured affected systems and worked with external security specialists. The 5 November update is the latest public note after earlier updates on 30 September and 1 October.

As a precaution, MetaMask initiated the exit of affected Ethereum validators operated by MetaMask Staking. The 5 November update says all affected validators have now exited as expected without incident. Validator exits and withdrawals are separate on Ethereum, so funds can still take additional time to become withdrawable or to be staked again.

Staked principal, rewards and fee recipients

MetaMask says it has not identified evidence that the incident enabled unauthorized access to or withdrawal of customers' staked principal. In MetaMask Staking it does not control the withdrawal keys used to access customers' staked ETH, and it says that separation helped protect staked principal. The incident did not compromise Secret Recovery Phrases or private keys that MetaMask users rely on to control their wallets, according to the update.

During the incident, an attacker briefly altered the addresses used to receive execution-layer staking rewards for certain validators after unauthorized access to infrastructure where those addresses were centrally stored. MetaMask says the issue was identified and addressed the same day, and that approximately 0.385 ETH in rewards was diverted. Those rewards are separate from customers' staked ETH.

Some customers have seen temporary withdrawal delays from the precautionary exits, and the process may have resulted in missed staking rewards while validators were exiting or awaiting reactivation. MetaMask says it is working directly with affected customers and partners on outstanding impact, and that the unauthorized access has been contained and affected systems secured.

Our take

This is a staking-infrastructure incident, not a report that ordinary MetaMask wallet balances were drained. The practical line for most readers is MetaMask's own: no wallet action is required, and nobody from MetaMask will ask for your Secret Recovery Phrase. Staking customers should watch for direct guidance on withdrawal timing and any reward make-good, and ignore lookalike support accounts.