A $963 theft pulled $1.4bn out of Ethereum staking

MetaMask disclosed a security incident in its staking infrastructure on Wednesday and exited the affected validators as a precaution. Ethereum security researcher Kaden, who went through the chain data, put the diverted amount at about 0.36 ETH. He also put the precautionary exit at roughly 17,000 validators holding some 523,000 ETH.

The two numbers, side by side

• 0.36 ETH left for an unexpected address, about $963 at $2,676 an ether
• 523,000 ETH came out of staking as a precaution, about $1.40bn
• The response runs to 1.45 million times the size of the loss
• 17,000 validators at 32 ETH each is 544,000 ETH, which brackets the reported figure and makes the two estimates hang together
• 18 of the 19 MetaMask validators that produced a block sent the payment to the wrong address

The last line explains why the number is so small. An Ethereum validator keeps two addresses: one for the stake itself, which decides where coins go on withdrawal, and one for the transaction-fee payments it earns when it produces a block. Ethereum sets them separately. Whoever got in changed the second and could not touch the first, so the take was limited to whatever blocks those validators happened to produce. That is the same shape we measured when a Solana orderflow auction moved block-production income, except there it was by design.

“At this time, we have identified no immediate threat to MetaMask wallets.”

— MetaMask, Заявление компании

MetaMask, in its statement on Wednesday

What the precaution costs

The staked coins are safe. The exit still has a price, and it can be counted. Lido's own data puts the current stETH yield at 2.245% a year. Take 523,000 ETH out of service for the round trip CoinDesk describes, up to roughly 45 days because of the queue to re-enter staking, and the forgone rewards come to about 1,448 ETH. At today's price that is $3.87m, or roughly four thousand times the amount that was taken.

Lido said MetaMask-operated validators had begun leaving its system early on Wednesday and expects the last of them to stop staking by 7 October, with the coins themselves not necessarily withdrawn by then. Holders of stETH need do nothing, the service said, and neither Lido nor MetaMask has reported any slashing, the penalty Ethereum applies when a validator signs conflicting records.

Two nearby movements got attention the same day. Lookonchain flagged a wallet it links to Ethereum co-founder Joseph Lubin moving 133,298 ETH, about $356m, to a new address, with no established connection to the incident. Ethena pulled roughly $75m from a Morpho vault holding Ripple's RLUSD and $60m from one holding PayPal's PYUSD, and has since put the funds back after getting clarity.

The part that is still missing

MetaMask has not confirmed Kaden's figures and has not published an account of how its systems were reached. Everything beyond the company's own statement comes from a researcher reading the chain. That is a decent instrument. A post-mortem is a different document.

Set this next to the week's other incident. Bitget's loss grew to $388m and the flaw sat in a third-party product. Here the loss is $963 and the flaw is unexplained, which is the part that costs $3.87m to insure against. An operator who cannot yet say how a credential was reached has to assume every credential of that class was reached. Exiting 17,000 validators is what acting on that assumption costs.

Informational material, not investment advice. Figures are converted at $2,676 an ether and move with the market.