Lubin said Consensys and partners rotated validator keys as a precaution, adding that the affected validator infrastructure "CANNOT result in the improper movement of the underlying ETH."
A breach that appears to have netted an attacker just 0.36 ETH has pushed more than half a million ETH through Ethereum's validator exit process.
- MetaMask, the crypto wallet maker whose staking arm operates Ethereum validators for clients, is pulling thousands of those validators out after an infrastructure compromise that appears to have produced a surprisingly small direct theft.
- Bitquery, a blockchain data provider that reconstructed the incident from Ethereum data, identified nearly 17,000 MetaMask-run validators holding over 565,000 ETH that had either exited or joined Ethereum's exit queue by 05:29 UTC on Oct. 1.
- Of those, roughly 7,190 were operated for Lido, the staking protocol.
Bitquery said that the 16,965 figure is a floor because more than 1,000 additional validators entered the queue during the same period but could not be attributed to MetaMask with enough confidence.
Bitquery traced 0.36 ETH in block tips from 18 blocks to an outside wallet after fee-recipient addresses were changed.
No MetaMask-operated validator had been slashed at the time of its analysis.
Bitquery found that MetaMask's first validator exit landed about 85 minutes before the first diverted block reward. Six MetaMask-run validators proposed blocks during that gap and all six still paid their expected recipients.
- Later, all 11 blocks proposed by MetaMask's main Lido validator set between 12:12 UTC and 16:11 UTC sent their tips to the attacker, per Bitquery.
- That suggests MetaMask had already started responding before the theft became visible on-chain.
- It doesn't tell us what the company saw internally, though, or what first triggered the exits.
MetaMask has disclosed only that an ongoing security incident affected part of its infrastructure. In a Sept. 30 update, the company said it had found no immediate threat to MetaMask wallets and was proactively exiting affected validators as a precaution.
The company still hasn't said how the attacker got in, which systems were compromised or whether validator signing keys themselves were exposed.
Ethereum's exit queue just got a lot longer
That uncertainty helps explain why the response is so much larger than the amount stolen.
Ethereum doesn't let an unlimited amount of stake leave at once. Validators that want out have to wait in an exit queue, with the network allowing only a limited amount of ETH through during each epoch so the validator set can't change too quickly.
Before MetaMask's mass exits became visible on Sept. 30, roughly 205,000 ETH was waiting to leave, equivalent to around 3 days and 13 hours of exit demand.
At the time of writing, ValidatorQueue, a tracking site, shows 773,447 ETH waiting to exit, with a roughly 13-day, 10-hour wait for a newly submitted exit.
That increase is unusually close to the 565,056 ETH Bitquery attributed to MetaMask-run validators. It doesn't prove though that every extra ETH came from MetaMask as other validators were entering and leaving the queue at the same time and the snapshots were taken at different moments.
Yet, the numbers strongly suggest MetaMask's response accounts for most of the sudden jump.
For someone trying to leave Ethereum staking now, that is the practical consequence.
ValidatorQueue currently estimates an additional 7.6-day withdrawal sweep delay after the exit queue. So under current conditions, a validator beginning the process now could be looking at roughly three weeks from requesting an exit to actually receiving its ETH, assuming the queues don't materially change in the meantime.