The most recent security breach at MetaMask disclosed a validator operation that is far more extensive than the reward diversion alone would suggest. According to Kaden, an on-chain researcher, around 17,000 MetaMask-operated validators with approximately 523,000 ETH were transferred toward the exit process.

Additionally, his study revealed that 18 out of 19 validators that generated blocks had their rewards diverted to an unexpected address. The scale of the validator response is especially noteworthy because the estimated amount involved was only roughly 0.36 ETH.

On Chain Data Reveals the Scale of the Response

The most significant new figure comes from the estimated size of the validator group affected by the response. Kaden's analysis puts the number at roughly 17,000 validators, representing about 523,000 ETH.

MetaMask has not confirmed either figure, so they remain external estimates rather than an official measurement of the incident. Still, the numbers provide a view of how extensive the precautionary response may be compared with the amount of cryptocurrency directly identified as having been diverted.

The estimated 523,000 ETH represents the stake associated with the validators being moved toward exit. That makes the incident notable for the difference between the amount of rewards apparently redirected and the much larger amount of ETH connected to the affected validator infrastructure.

after some onchain sleuthing, i think this is what happened:

19 metamask validators had won block rewards, and 18 of the rewards were not paid to the correct fee recipient but instead to this tornado funded account: 0x98B9231de84334c1d48BA0b72CF13f92484924A3

~17k validators… https://t.co/qAlfkVNUW1

— kaden.eth (@0xKaden) October 1, 2026

18 of 19 Validators Show the Same Reward Pattern

Kaden's on-chain investigation identified a specific pattern among validators that had produced block rewards.

Out of 19 MetaMask-operated validators that received payments for producing blocks, 18 sent those rewards to an unexpected address. The researcher estimated that the diverted rewards totalled approximately 0.36 ETH.

The receiving address had links to funds that had previously passed through Tornado Cash. That connection does not by itself establish who controlled the address, but it provides an important on-chain clue in reconstructing the movement of the rewards.

The pattern also shows why the incident cannot be understood simply by looking at the value of the transferred ETH. The amount was relatively small, while the repeated redirection across validators indicates that the attacker had access capable of influencing validator reward payments.

The Fee Recipient Became the Critical Point

Ethereum validators have a separate destination for payments associated with block production. When a validator proposes a block, transaction-related fees can be directed to this fee recipient address.

This creates an important distinction in the incident. An attacker who can alter the fee recipient can redirect rewards without necessarily gaining control over the underlying staked ETH. The reported on-chain activity therefore points toward manipulation of reward routing rather than a demonstrated withdrawal of validator principal.

That distinction also explains why the 0.36 ETH estimate should not be treated as the amount of ETH represented by the affected validators. The two figures describe completely different things. One concerns redirected rewards, while the other represents the stake connected to the validators under the reported exit operation.

The available evidence does not establish how the attacker obtained the ability to influence those reward destinations. MetaMask has not publicly explained the initial access method or confirmed whether validator signing credentials were exposed.

We’re continuing to actively investigate and respond to the security incident affecting part of our infrastructure.

Our focus remains on working closely with affected partners and taking appropriate steps to protect users. As part of this, we worked with our partners to take the… https://t.co/tbC70C6Bdi

— MetaMask 🦊 (@MetaMask) October 1, 2026

Hundreds of Validators Were Still Under Review

The on-chain picture also showed that the response was not necessarily complete when the initial analysis was published.

Kaden identified another 821 potentially affected validators that had not yet exited. Three of those validators were among the ones whose rewards had reportedly been diverted. That left an important unanswered question about whether those validators were still considered operationally safe or whether additional exits were still being processed.

The distinction matters because the blockchain can show which validators are producing blocks and where their rewards are being sent, but it cannot by itself reveal how an attacker entered MetaMask's infrastructure.

For now, the public evidence establishes the reward diversion and the reported validator movements, while the technical route used to obtain that access remains undisclosed.

For the broader incident timeline, see MetaMask Security Incident Triggers Lido Validator Exits on EtherWorld. MetaMask's official statement remains limited to the infrastructure incident and its response, while Lido's disclosure confirms the validator exit process.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. MetaMask Agent Wallet Launches AI Agents On-Chain
2. MetaMask Card Brings Crypto Spending to the US
3. MetaMask Adds 200+ Tokenized US Stocks & ETFs
4. MetaMask Alert, Protect Your Wallet from Cyber Threats
5. MetaMask’s “Stablecoin Earn” Goes Live with Aave

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.