MetaMask validator exits push Ethereum withdrawal backlog to nine-month high

MetaMask is exiting Ethereum validators after a breach redirected transaction-fee rewards. Onchain security researcher Kaden said about 17,000 MetaMask-operated validators holding roughly 523,000 ETH were proactively exited. Kaden said an analysis found that fee rewards from 18 of 19 validators that proposed blocks had been diverted to an address funded through Tornado Cash. Kaden said the attacker appeared to have captured only about 0.36 ETH. MetaMask has not confirmed Kaden's figures or disclosed the cause of the incident. MetaMask said part of its infrastructure had been compromised and that it was exiting affected validators as a precaution while working with clients, partners and security advisers. MetaMask said it had identified no immediate threat to MetaMask wallets. MetaMask said its staking operation is non-custodial and that it does not control clients' withdrawal keys. An attacker with only validator-level access could not withdraw the underlying stake, but compromised signing keys could expose validators to penalties if misused. Kaden said 821 potentially affected validators had not yet exited, including three whose fee rewards were allegedly diverted. It remains unclear why those validators are active or whether the attacker can change additional fee recipients. MetaMask has not disclosed how many validators were affected, whether signing keys were exposed or whether any slashing occurred. Validator Queue data showed about 773,447 ETH waiting to leave Ethereum's validator set on Wednesday, implying a 13-day, 10-hour exit wait. Validator Queue estimated a further withdrawal sweep delay of 7.6 days. The backlog was the largest since December 2025 and exceeded the roughly 476,000 ETH waiting during a previous surge in May, according to Validator Queue data. Ethereum limits how quickly stake can enter or leave its validator set to prevent abrupt changes from destabilizing its proof-of-stake consensus. Validator Queue showed an exit processing rate of 256 ETH per epoch, with each epoch lasting about 6.4 minutes. The estimated 7.6-day withdrawal sweep begins after exiting validators become withdrawable. Ethereum then transfers balances to eligible validators' designated withdrawal addresses. Lido, where MetaMask operates validators, estimates that the full exit, withdrawal and eventual re-entry process could take up to 45 days. Validators returning to Ethereum face an entry queue that is currently 27 days long.