MetaMask Validator Exit Pushes Ethereum Withdrawal Queue to Nine-Month High

MetaMask is pulling its Ethereum validators after a breach redirected transaction-fee rewards, sending the network's validator exit backlog to its highest level in nine months. Onchain security researcher Kaden said roughly 17,000 MetaMask-operated validators, representing about 523,000 ETH, were proactively exited. Kaden added that fee rewards from 18 of 19 validators that proposed blocks were routed to an address funded via Tornado Cash, with the attacker appearing to have netted about 0.36 ETH. MetaMask has not confirmed Kaden's figures or disclosed what caused the incident. The company said part of its infrastructure was compromised and that it is exiting affected validators as a precaution while working with clients, partners and security advisers. MetaMask said it has identified no immediate threat to MetaMask wallets. MetaMask also said its staking operation is noncustodial and that it does not control clients' withdrawal keys. An attacker limited to validator-level access could not withdraw the underlying stake, though compromised signing keys could expose validators to penalties if misused. Kaden said 821 potentially affected validators had not yet exited, including three whose fee rewards were allegedly diverted. It remains unclear why those validators are still active or whether the attacker can change additional fee recipients. MetaMask has not disclosed how many validators were impacted, whether signing keys were exposed, or whether any slashing occurred. Validator Queue data showed about 773,447 ETH waiting to leave Ethereum's validator set on Wednesday, implying an estimated 13-day, 10-hour exit wait. Validator Queue also estimated an additional 7.6-day delay for the withdrawal sweep. The backlog is the largest since December 2025 and surpasses the roughly 476,000 ETH waiting during a prior surge in May, according to Validator Queue. Ethereum caps how quickly stake can enter or exit the validator set to avoid abrupt shifts that could destabilize its proof-of-stake consensus. Validator Queue put the current exit processing rate at 256 ETH per epoch, with each epoch lasting about 6.4 minutes. The estimated 7.6-day withdrawal sweep begins after exited validators become withdrawable, when Ethereum transfers balances to eligible validators' designated withdrawal addresses. Lido, where MetaMask operates validators, estimates the full cycle of exit, withdrawal and eventual reentry could take up to 45 days. Validators seeking to return to Ethereum also face an entry queue currently about 27 days long.