A MetaMask security incident has hit part of the company’s infrastructure. However, the wallet provider says it has found no immediate threat to user wallets so far.
As a precaution, the company is also shutting down some Ethereum staking machines it runs for clients. The company has not said which of its systems the incident affected.
Are Wallets Affected by the MetaMask Security Incident?
For everyday users, the main message is calm for now. MetaMask says it is fixing the problem internally with help from outside partners and security advisors.
The company has not asked users to move funds or change any settings. Instead, it plans to share more details as its investigation continues.
Still, scammers often use news like this to send fake security alerts. Users should ignore any unsolicited message asking for their recovery phrase, since a single phishing signature can drain a wallet.
Why MetaMask Is Switching Off Its Staking Validators
The second part of the response concerns staking, not regular wallets. MetaMask runs validators, the computers that lock up Ether (ETH) to secure Ethereum and earn rewards.
Some of these run inside Lido, a service that lets users stake ETH and get a token called stETH in return. MetaMask took over this staking unit, formerly Consensys Staking, when it split from Consensys in September.
Because of the security incident, MetaMask is now shutting these validators down. According to Lido, the last ones should stop running by the end of Oct. 7. However, the ETH will flow back into Lido gradually and get staked again, a process that could take about 45 days. stETH holders keep their tokens throughout.
Lido also told stETH holders that they do not need to do anything. A reserve fund of more than 6,750 stETH can help absorb any disruption, the protocol says.
Meanwhile, the episode adds to recent security questions around the company. In July, Consensys said it found a hidden North Korean developer working on MetaMask code.
Further updates from MetaMask should show how far the incident reached. Until then, users may want to rely only on official MetaMask channels for news.