MetaMask disclosed that its infrastructure was accessed without authorization: only a small amount of staking rewards was transferred

On November 5, MetaMask released a security incident update stating that on September 28, part of its infrastructure was accessed without authorization. The attacker modified the reward receiving addresses of some Ethereum validators, transferring approximately 0.385 ETH in staking rewards.

MetaMask stated that the related issues were fixed on the same day, and all affected Ethereum validators have now completed their exit. This incident caused temporary delays in withdrawals for some customers and may have resulted in losses of staking rewards. MetaMask emphasized that there is currently no evidence that user wallets, private keys, or customer staking principal have been leaked or withdrawn without authorization.