01
MetaMask disclosed a security incident on September 30, 2026, and started pulling its ETH validators out of Lido.
02
The company says wallet funds face no immediate threat, because it never held users' withdrawal keys.
03
Lido confirmed the exits on its governance forum, expecting the last validators out by October 7.
04
Getting that ETH fully back into staking could take up to about 45 days because of Ethereum's entry queue.
05
MetaMask hasn't said what was compromised, how it happened, or how many validators were affected.
06
The exits are happening out of normal order, which can mean lost rewards and possible downtime penalties.
07
This is different from 2026's big exchange hacks like Bitget, where private keys were used to move stolen funds directly.
08
If you stake through any wallet, know whether your provider holds your withdrawal key or just your signing key.