MetaMask said it has found no sign that its wallets or wallet systems were hit in an incident it spotted on September 28. The company said an attacker got into infrastructure that stored reward addresses for its Ethereum validators. Validators are nodes that help check transactions. MetaMask said the attacker briefly changed those addresses for some validators, sending about 0.385 ETH in rewards elsewhere. It said it fixed this the same day. BleepingComputer said the update came Thursday.
MetaMask separates two things: reward addresses, which receive earnings, and withdrawal keys, which reach the staked ETH. It said it does not control the keys, and it has found no evidence the attacker reached staked ETH. All affected validators have now exited. Exits and withdrawals are separate steps, so funds can take extra time to become available, and some customers saw delays. Some rewards may also have been missed. MetaMask has not said how the attacker got in. Earlier updates said its teams were still verifying details.
So far, the losses MetaMask describes are the diverted rewards, withdrawal delays and possibly missed rewards. For teams that run or buy staking, the case shows that a setting stored in one editable place is a risk, even when the provider holds no withdrawal keys.