MetaMask says recent attack didn't affect wallet infrastructure
MetaMask reports a security incident where a threat actor diverted staking rewards but did not compromise user funds.
Run Consensys?
Get an email when a reviewed story names Consensys, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
MetaMask has disclosed a security incident where a threat actor gained access to systems managing recipient addresses and diverted approximately 0.385 ETH in staking rewards. The company emphasized that this incident did not affect MetaMask wallets, wallet infrastructure, customers' staked principal, or withdrawal keys, and users' Secret Recovery Phrases and private keys remain secure. While some customers experienced temporary withdrawal delays and potential missed staking rewards, MetaMask is working to refund affected users and has secured the compromised systems.
The lesson from this incident
Full lessonA threat actor gained unauthorized access to systems responsible for managing recipient addresses in MetaMask's staking infrastructure, allowing them to divert approximately 0.385 ETH in staking rewards. While core wallet infrastructure, private keys, and staked principal were unaffected, the breach highlights how even peripheral systems handling fund routing can be exploited for financial gain. The incident caused temporary withdrawal delays and missed rewards for some users, undermining trust even without a catastrophic loss. This matters because attackers increasingly target adjacent or supporting systems — not just core infrastructure — to intercept value flows with minimal footprint.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.
Indicators of Compromise
- malware — malware