Joseph Lubin|Oct 02, 2026 23:20
Coming up for air now after a very dense excellent week in Seoul at KBW, while staying on top of our response to a security event affecting part of our infrastructure.
I can now respond to queries and speculation regarding what is impacted and what is not affected.
Based on our investigation to date, there is no indication that MetaMask wallets or customer funds in wallets have been affected. Your Secret Recovery Phrase, your keys, and the assets in your wallet were not part of this incident because they CANNOT be. You custody and control your own keys. That is how self custody works. You are fully in control of your own money in MetaMask.
Like many providers in our industry, we constantly face attempted attacks from a range of threat actors and periodically encounter security issues. Our approach follows established best practice: we do not publicly discuss the details of an open incident, but we disclose promptly to partners and relevant stakeholders once an issue is sufficiently understood. In this case, we shared the relevant details with partners, agreed and implemented a response strategy together, and then disclosed publicly.
As a precaution, we and our partners rotated validator keys. That step is operationally inconvenient which is regrettable as validators must exit the staking queue and then re-enter the queue to restake, which takes time.
The validator staking architecture of Ethereum separates the key that proposes and attests from the key that can withdraw the stake. In accordance with the Ethereum principle of self-custody, we do not hold withdrawal keys for our clients. Because of that separation, an issue in the validator infrastructure CANNOT result in the improper movement of the underlying ETH. Rotating those keys was how we reduced residual operational risk.
Self-custody and user control are a central design principle guiding how we build -- in MetaMask, in staking and validation, and across Ethereum more broadly. Self custody plus rigorous decentralization represents a paradigm shift in security. Increasingly, the world is waking up to the benefits of this sounder architecture.
Share To
Timeline
HotFlash
APP
X
Telegram
CopyLink