Kaden flags ~821 potentially affected MetaMask validators still active
By Crypto Wire
October 1, 2026
The MetaMask Staking exit story just got a remaining-active layer: TokenPost (Oct 1, 4:20 a.m. EDT) reports researcher Kaden tying diverted block rewards from 18 of 19 affected MetaMask validators to an address ending in 24A3 that he linked to Tornado Cash funding—about 0.36 ETH—and separately flagging three suspected affected validators that had not exited plus roughly 821 potentially affected validators that remained active. That updates this morning’s fee-diversion chapter (10418) and the Sep 30 opening exit wire (10416) without inventing a confirmed MetaMask tally or a wallet SRP drain.
What the new stack actually changes. TokenPost’s wrap still frames the diverted amount as researcher telemetry MetaMask has not confirmed, and it stresses the attacker may not have been able to withdraw staked principal—fee-recipient hijacks sit on the execution-layer payment path, not withdrawal credentials. CoinDesk’s earlier Oct 1 chapter already carried the ~17,000-validator / ~523,000 ETH exit estimate without MetaMask confirmation; today’s TokenPost add-on does not rewrite that unconfirmed ceiling. The fresh beat is the residual set: if three suspected affected validators and ~821 “potentially affected” keys were still live when Kaden published, the precautionary exit wave is not a clean all-clear even as Lido still targets final MetaMask-operated exits by end of October 7. Treat “potentially affected” as labeled suspicion until MetaMask or Lido publishes matching operator math.
Signing authority is still the open protocol hole. TokenPost notes the mechanism used to obtain signing authority has not been established, which leaves open further manipulation if the access allowed validator-setting changes. That is a next-beat gate, not proof of ongoing diversion after the reported ~16:46 correction window in secondary timelines from Metaverse Post’s earlier wrap. For collectors and stETH holders, the operational read stays the same as Lido’s forum: no client action required on withdrawal keys, exits are operator-side, and downtime penalties remain a Lido/MetaMask accounting question rather than a retail reclaim checklist. MetaMask’s standing line across wraps remains “no immediate threat to MetaMask wallets,” with exits framed as non-custodial staking remediation—operators sign duties; clients keep withdrawal keys. Living tracker: MetaMask Lido Exits (10420).
How this sits beside adjacent noise. Lubin-linked wallet transfers and Ethena vault reshuffles remain unconnected color in the CoinDesk wrap—do not fold them into a MetaMask contagion thesis. The …24A3 Tornado-linked recipient path is attributed researcher linkage, not a MetaMask-published incident IOC list. Keep the chapter on residual validator status, fee-recipient correction, and the Oct 7 exit-complete checkpoint.
What not to invent. Do not invent that the …24A3 recipient equals confirmed MetaMask attribution, that 821 remaining validators are MetaMask-confirmed compromised, or that the three non-exited suspects are still diverting fees right now. Do not invent slashing, stETH holder action requirements, or NFT approval drains from this chapter. Do not invent that Lookonchain’s Lubin-linked wallet move funded remediation. Daily Crypto Brief draft 10376 stays untouched.
Next protocol beat: whether MetaMask or Lido confirm, shrink, or reject Kaden’s residual ~821 / three-non-exit counts; whether fee recipients stay corrected after the secondary ~16:46 window; and whether any signing-authority post-mortem lands before the Oct 7 exit-complete checkpoint.
Bottom line: TokenPost’s Kaden wrap adds a …24A3 Tornado-linked diversion path plus residual counts—three suspected non-exits and ~821 potentially affected validators still active—updating 10418 ahead of Lido’s Oct 7 exit checkpoint.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
