MetaMask Exits Affected Lido Validators After Incident

A staking operator is removing validators from Lido after an infrastructure security incident, and holders of the liquid staking token are being told they do not need to act. The MetaMask Lido validator exit security incident October 2026 is set out in Lido's forum notice on 30 September and reported by CoinDesk and Decrypt. MetaMask said it found no immediate threat to MetaMask wallets.

What happened

MetaMask, formerly Consensys Staking, is exiting affected Ethereum validators on Lido. A validator is a machine, run by an operator, that takes part in confirming Ethereum blocks and can earn rewards for doing so. An exit takes a validator out of the active set. It is not the same step as a full withdrawal, which is when the stake actually leaves.

Lido said the last validators should be exited, but not fully withdrawn, by the end of 7 October 2026. The reason given is an infrastructure security incident. Infrastructure, here, means the systems around the staking operation rather than the wallet a person opens. The forum notice is Lido's security disclosure.

MetaMask said it found no immediate threat to MetaMask wallets. That sentence is about wallets. It is not a claim that the staking operation was untouched.

The exits are the step being taken on the staking side. Both facts are in the accounts used here, and neither cancels the other.

Staking in this setup is non-custodial, and MetaMask does not hold withdrawal keys. Non-custodial means the operator does not take ownership of the assets the way a custodian would. Withdrawal keys are what authorize taking the stake out. An operator can run a validator and still be unable, by that design, to withdraw the stake on its own.

Lido said exit, withdrawal, and re-entry could take up to about 45 days. Exit is leaving the active set. Withdrawal is the stake coming out.

Re-entry is a validator coming back. "Up to about 45 days" is an outer bound, not a promise that every validator takes that long.

Stakers of stETH do not need to act. stETH is Lido's receipt-like token, the asset a person holds while ether is staked through the protocol. The notice is not asking those holders to redeem or to send a transaction because of this incident. Exits can still mean missed rewards and possible downtime penalties at the validator level.

A validator that is exiting is not earning as an active validator earns. Downtime penalties are charges the protocol can apply when a validator is not performing as it should. Lido cited those as possible consequences. It did not, in the facts used here, put a separate price on the missed rewards or the penalties.

Lido cited an ad hoc reserve of more than 6,750 stETH. Ad hoc means set aside for this matter rather than described here as an ordinary standing budget. Decrypt repeats that figure. More than 6,750 is a floor, not an exact inventory.

Why it matters

The wallet sentence and the validator sentence point different ways, and a short headline will drop one of them. MetaMask is a name people associate with a wallet. The response described here is an exit of affected Ethereum validators that MetaMask, formerly Consensys Staking, runs with Lido.

No immediate threat to wallets is what MetaMask said it found. The validators are still being exited.

Non-custodial staking and the absence of withdrawal keys bound what this incident can be said to reach. If the operator does not hold the withdrawal keys, the operator does not have custodial power to take the stake. That is the structure these accounts describe.

It is not a claim that nothing around a validator can go wrong. The exit is the sign that the incident was treated as serious enough to pull validators.

The end of 7 October 2026 is when the last affected validators should be exited but not fully withdrawn. Full withdrawal sits later, inside the stretch of up to about 45 days that also includes re-entry. Those are Lido's bounds.

The stETH instruction is for holders who might assume a security headline requires a personal transaction. Lido's answer is that they do not need to act. Missed rewards and possible downtime penalties can show up through the validators. They are not, in this notice, a bill each holder is told to pay by hand.

The ad hoc reserve of more than 6,750 stETH is what Lido cited. Decrypt's repetition means the figure is also in a news report, not only in the forum thread. This account does not adopt researcher estimates MetaMask has not confirmed, and it does not state them.

Related: Hegota staking proposal and Glamsterdam Sepolia test.

What's next

The near date is the end of 7 October 2026. By then, Lido said, the last affected validators should be exited and not yet fully withdrawn. After that, exit, withdrawal, and re-entry can still take up to about 45 days. stETH holders remain, on the notice, people who do not need to take action unless Lido says otherwise.

The reserve of more than 6,750 stETH is the buffer Lido cited. How it will be drawn is not in these sources. The floor is the fact.

Decrypt is the outlet that repeats it, beside Lido's own notice. CoinDesk's report of the exits is here. Decrypt's report is here.

What is on the record is a precautionary exit, a statement of no immediate wallet threat, and a reminder that MetaMask does not hold withdrawal keys. The record also has a date for exits, a longer window for the full cycle, and a reserve Lido put above 6,750 stETH. It does not have a confirmed public tally, from MetaMask, of any sum beyond that.