#metamask安全事件后撤出lido验证节点
🦖 This year, North Korea-related thefts have just broken the $1 billion mark ⚖️ The world’s largest self-custody wallet promptly pulled out its own Ethereum validator nodes
🙋 想聊的进群
On September 30, MetaMask announced it is handling a security incident affecting part of its infrastructure. As a precaution, it began exiting the Ethereum validator nodes it operates under the Lido protocol. Lido subsequently confirmed: the affected validator nodes are expected to be fully exited by October 7. As for what the incident actually was, MetaMask did not say a word—only emphasizing that it has not found any direct threat to the wallet itself for now.
First, let’s lay out the facts. This time, MetaMask is moving its non-custodial staking business—users hand their ETH to it to run validator nodes, while the private keys always remain in the users’ possession. This exit is not a sell-off; the ETH will be returned to the protocol through the normal process. But Lido developer Will Shannon said that because the Ethereum queue to enter is so long, completing the full sequence—exit, withdrawal, and then restaking—could take up to about 45 days. The money is there; it’s just stuck on the road.
Zoom out and you’ll see why this move is worth scrutinizing. Just a few days ago, a major exchange had $387.5 million moved. The attacker then stuffed about 2,700 ZEC (about $3.8 million) into Zcash’s privacy pool. On-chain sleuth ZachXBT has publicly named the parties involved. Elliptic, a blockchain analytics firm, assessed that North Korea is “highly likely” to be behind it, and said this is the largest suspected North Korea theft incident of 2026—pushing this year’s losses from such activity past the $1 billion threshold. Security incidents are no longer occasional; they’ve become the norm.
The market reaction was straightforward: Ethereum’s current price is about $2,686, up only 0.4% in 24 hours—nothing special. But Lido’s native token LDO fell 7.16% in a day ⚠️. With the same news, tokens dropped while ETH didn’t move much, suggesting the market believes what’s been hit is trust in the staking business—not Ethereum itself.
My take: MetaMask’s move is the right call, but it doesn’t look good. It’s better to pull all validator nodes than to explain what happened—but that silence is itself a signal. It isn’t afraid of assets being stolen; it’s afraid of being questioned about its qualifications. For ordinary users, 🔒 your coins in the wallet are most likely fine. But the question of “who you hand your coins to in order to earn yield” will need to be re-accounted for in 2026. The boundaries of self-custody are expanding—from “who holds the private key” to “who runs the node on your behalf.”
Will you keep putting your ETH into staking built into your wallet? Or would you rather hold it yourself and leave it untouched? Let’s talk in the comments.
Every day, I’ll take you to follow the crypto security hot spots—not just to see what happened in the news, but to help you understand the logic and opportunities behind it 👀🚀
Click the profile photo to watch the live stream
🦖 This year, North Korea-related thefts have just broken the $1 billion mark ⚖️ The world’s largest self-custody wallet promptly pulled out its own Ethereum validator nodes
🙋 想聊的进群
On September 30, MetaMask announced it is handling a security incident affecting part of its infrastructure. As a precaution, it began exiting the Ethereum validator nodes it operates under the Lido protocol. Lido subsequently confirmed: the affected validator nodes are expected to be fully exited by October 7. As for what the incident actually was, MetaMask did not say a word—only emphasizing that it has not found any direct threat to the wallet itself for now.
First, let’s lay out the facts. This time, MetaMask is moving its non-custodial staking business—users hand their ETH to it to run validator nodes, while the private keys always remain in the users’ possession. This exit is not a sell-off; the ETH will be returned to the protocol through the normal process. But Lido developer Will Shannon said that because the Ethereum queue to enter is so long, completing the full sequence—exit, withdrawal, and then restaking—could take up to about 45 days. The money is there; it’s just stuck on the road.
Zoom out and you’ll see why this move is worth scrutinizing. Just a few days ago, a major exchange had $387.5 million moved. The attacker then stuffed about 2,700 ZEC (about $3.8 million) into Zcash’s privacy pool. On-chain sleuth ZachXBT has publicly named the parties involved. Elliptic, a blockchain analytics firm, assessed that North Korea is “highly likely” to be behind it, and said this is the largest suspected North Korea theft incident of 2026—pushing this year’s losses from such activity past the $1 billion threshold. Security incidents are no longer occasional; they’ve become the norm.
The market reaction was straightforward: Ethereum’s current price is about $2,686, up only 0.4% in 24 hours—nothing special. But Lido’s native token LDO fell 7.16% in a day ⚠️. With the same news, tokens dropped while ETH didn’t move much, suggesting the market believes what’s been hit is trust in the staking business—not Ethereum itself.
My take: MetaMask’s move is the right call, but it doesn’t look good. It’s better to pull all validator nodes than to explain what happened—but that silence is itself a signal. It isn’t afraid of assets being stolen; it’s afraid of being questioned about its qualifications. For ordinary users, 🔒 your coins in the wallet are most likely fine. But the question of “who you hand your coins to in order to earn yield” will need to be re-accounted for in 2026. The boundaries of self-custody are expanding—from “who holds the private key” to “who runs the node on your behalf.”
Will you keep putting your ETH into staking built into your wallet? Or would you rather hold it yourself and leave it untouched? Let’s talk in the comments.
Every day, I’ll take you to follow the crypto security hot spots—not just to see what happened in the news, but to help you understand the logic and opportunities behind it 👀🚀
Click the profile photo to watch the live stream
