MetaMask, one of the world’s most widely used self-custodial crypto wallets, has begun proactively exiting affected staking validators following a security incident. On-chain researcher Kaden said about 17,000 validators representing roughly 523,000 ETH have been exited, while around 821 potentially affected validators remain active.

He identified 18 block rewards diverted from their intended fee recipients to a Tornado Cash-funded address, netting the attacker about 0.36 ETH. MetaMask said its staking service is non-custodial and that it does not control users’ withdrawal keys, while Kaden noted that compromised validator signing keys could still pose a slashing risk.