Security News | ONEMINERS NEWS DESK
An attacker redirected the fee rewards on MetaMask's Ethereum validators. No deposits were taken, but about 523,000 ETH is now leaving staking as a precaution, and it will earn nothing for weeks.
By Michal Beno, CEO, OneMiners
1 October 2026 · 4 min read
What happened
An attacker got into MetaMask's Ethereum staking setup and redirected block-production fees to an unknown wallet. About 0.36 ETH was diverted. The staked coins themselves were not touched, but around 17,000 validators holding about 523,000 ETH are now exiting as a precaution.
When you stake ETH, a computer called a validator locks your coins and helps confirm blocks. In return it earns rewards, including tips from transactions. Those tips go to a payout address set by the operator. According to security researcher Kaden, 18 of 19 MetaMask-run validators he checked were sending those payouts to an unexpected address.
17K
validators exiting
523K ETH
staked coins leaving, about $1.4B
0.36 ETH
rewards diverted, estimate
~45 days
without rewards to exit and re-enter
CoinDesk, 1 October 2026. Dollar value uses ETH at about $2,677 (CoinGecko, 1 October 2026).
MetaMask validators checked by researcher Kaden
Where block-fee payouts were going
Why so many validators are leaving
MetaMask said it has found no immediate threat to MetaMask wallets, and users' staked coins remain safe. But it has not explained how its systems were reached. Until that is known, the safe move is to switch the affected validators off cleanly and start fresh. The last ones are expected to stop staking by 7 October 2026.
The cost: weeks of zero rewards
Ethereum does not let validators leave and rejoin instantly. Both moves go through a queue. Lido, the largest staking service, warned that the affected validators will miss rewards for roughly 45 days while they exit and re-enter. Holders of Lido's stETH token do not need to do anything. Validators switched off before their exit completes could also face small penalties.
1 October
Incident disclosed; precautionary exits begin
By 7 October
Last affected validators expected to stop staking
About 45 days
Exit, withdrawal and re-entry queues complete; rewards resume
The lesson for anyone holding crypto
Nobody lost their principal here, but the episode shows how much depends on the operator behind the button. When a third party runs your validator, they control where the rewards go. The same rule applies to exchanges and wallets: know who holds the keys, and keep long-term coins somewhere you control. The OneMiners crypto wallet safety guide covers the basics.
THE ONEMINERS VIEW
Bitcoin mining and Ethereum staking both pay you for securing a network, but they work differently. A Bitcoin miner is a physical machine with its own payout address, and rewards from a mining pool land in a wallet the owner chooses. There is no exit queue and no 45-day wait to switch pools. See how hosted mining works, or read about hardware wallets for Bitcoin miners.
START WITH ONEMINERS
Earn Bitcoin from your own machine, with payouts you control.
Browse Bitcoin minersOpen the mining calculatorSOURCES AND DATA
- Incident details, validator counts, Lido warning and timeline: CoinDesk, 1 October 2026
- Diverted-reward estimate and 18-of-19 check: security researcher Kaden, via CoinDesk
- ETH price: CoinGecko, read 1 October 2026
Michal Beno
CEO of OneMiners, the global Bitcoin mining hosting and hardware platform with 15 published hosting locations, 7-year fixed electricity contracts and a 7-year hardware warranty. He writes about the economics of industrial Bitcoin mining.
Informational only, not financial advice. Figures are a snapshot from public market data and news reports as of 1 October 2026 and can change quickly. Crypto prices can fall as well as rise. No return is offered or implied. Do your own research.
