MetaMask's 5 November 2026 user update says that on 28 September 2026 it identified a security incident involving unauthorised access to part of its infrastructure, contained the access the same day, and as a precaution exited affected Ethereum validators operated by MetaMask Staking.

MetaMask says an attacker briefly altered addresses used to receive execution-layer staking rewards for certain validators after unauthorised access to infrastructure where those addresses were centrally stored, and that approximately 0.385 ETH in rewards was diverted — separate from customers' staked ETH.

MetaMask says it has found no evidence that customers' staked principal or withdrawal keys were compromised, that MetaMask wallets and wallet infrastructure were not compromised, and that Secret Recovery Phrases and private keys were not compromised; wallet users need take no action, while affected staking customers may see temporary withdrawal delays or missed rewards and are being worked with directly. (source: MetaMask)

BleepingComputer's 6 November 2026 report restates the same MetaMask update and notes MetaMask's earlier limited September disclosure. (source: BleepingComputer)