MetaMask Breach Diverts 0.385 ETH in Rewards
A threat actor reached recipient-address systems, but MetaMask says wallet keys and phrases were not exposed.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you trust crypto wallet providers to keep your funds secure?
MetaMask said a security incident in its infrastructure did not affect MetaMask wallets, but a threat actor diverted about 0.385 ETH in execution-layer staking rewards from its staking systems. The incident was first disclosed on September 30 and was identified and addressed the same day; the status is that it has been resolved, not that it is ongoing.
Why it matters
The incident shows how staking operations that sit between users and the Ethereum network can be exposed even when wallet keys are not. It highlights that recipient-address storage and validator operations are an attack surface distinct from the wallet software users see.
MetaMask's disclosure quantifies the loss at about 0.385 ETH in staking rewards, with no comparator provided. The company stated that the Secret Recovery Phrases and private keys of users were not compromised, which it presents as the key boundary of the incident.
The players
MetaMask
A self-custody Ethereum wallet developed by Consensys, offering browser-extension and mobile wallets plus non-custodial staking services.
Binance
A major cryptocurrency exchange whose 2025 hack by North Korean actors, which stole $6.34 billion, is cited as a prior comparison in the coverage.
The details
A threat actor gained access to systems that store the addresses where staking rewards are sent, then redirected some execution-layer rewards, the portion of Ethereum staking income that comes from transaction fees and priority tips rather than issuance. Staking means locking ETH to help secure the network in exchange for rewards, and validators are the software operators that carry out that work. As a precaution, MetaMask exited the affected validators, which caused temporary withdrawal delays for some customers, while the diverted rewards remained separate from the principal ETH that customers had staked.
Timeline
September 30: MetaMask revealed it was investigating an ongoing infrastructure security incident.
Thursday update: MetaMask disclosed that a threat actor had diverted staking rewards.
The Tech Race
Attacks on crypto infrastructure have escalated in scale, with North Korean hackers stealing $6.34 billion from Binance. The MetaMask diversion of 0.385 ETH is far smaller, but it points to the same class of target: the operational layers that route and store funds rather than the wallets themselves.
Users whose stake was affected saw temporary withdrawal delays while MetaMask exited the affected validators as a precaution. MetaMask said it is working with affected customers and partners to refund the lost rewards, and it has not provided a timeline for that refund.
The takeaway
The incident was contained the same day and the principal ETH was not touched, but the refund timeline has not been stated. Watch for MetaMask's confirmation that affected customers have been made whole.
Further reading
For more on how attacks against crypto infrastructure are evolving, see the Cybersecurity coverage.
Source note: This article includes information reported by Bleeping Computer.
Live Poll
Do you trust crypto wallet providers to keep your funds secure?
