Kaden: MetaMask validators diverted ~0.36 ETH in fees as ~17k exits proceed

By Crypto Wire
October 1, 2026

Desk of the Day — Rug Room

The MetaMask Staking infra scare just got a forensic number stack: CoinDesk (Oct 1, 3:06 a.m. EDT) reports Ethereum security researcher Kaden saying 18 of 19 MetaMask-operated validators that had earned block-production payments sent those fees to an unexpected address, diverting about 0.36 ETH. Kaden also estimates the precautionary exits at roughly 17,000 validators holding about 523,000 ETH—figures MetaMask has not confirmed. That updates last night’s opening chapter (10416) without rewriting Lido’s Oct 7 exit target or inventing a wallet drain.

What the fee path actually changes. Ethereum sets a validator’s block-fee recipient separately from withdrawal credentials, so diverting execution-layer payments does not by itself move the staked principal. CoinDesk stresses neither MetaMask nor Lido has reported slashing. MetaMask’s Sep 30 line still holds in the wraps: “no immediate threat to MetaMask wallets,” with exits framed as non-custodial staking remediation—operators sign duties; clients keep withdrawal keys. For collectors, that split matters: a hijacked fee recipient is an operator-side receipt failure, not automatic proof that stETH balances, NFT approvals, or MetaMask SRP wallets were drained. Treat Kaden’s diversion tally as researcher telemetry until MetaMask publishes matching incident math.

Secondary on-chain timelines fill in the hourglass without becoming gospel. Metaverse Post (Oct 1) attributes a more granular clock: a fresh EOA funded via a 0.1 ETH Tornado Cash withdrawal around 10:27, MetaMask/Consensys exits around 11:00, roughly 0.36 ETH in block rewards collected between 12:12–16:46 from 18 MetaMask-run proposers (11 Consensys Lido, five client, two EthFoxVault-linked), Consensys removing 400 unused Lido keys at 12:42, and rewards reportedly returning to correct recipients after 16:46. Those details are attributed secondary reports—not MetaMask’s official post. Lido’s forum still targets final exits by end of October 7 with up to ~45 days for exit/withdrawal/re-entry and “No action is required from stETH holders.”

---

---

Adjacent moves that are not the same story. Lookonchain’s Joseph Lubin-linked wallet transfer of 133,298 ETH (~$356.2M) to a new address remains unconnected in CoinDesk’s write-up. Ethena’s reported Morpho vault pulls (~$75M RLUSD / ~$60M PYUSD) were described as precautionary with funds later redeployed—color, not proof of MetaMask contagion. Rumors that a single liquid-staking provider is “holding hostage” a material ETH share are still rumor; former MetaMask security voice Taylor Monahan publicly framed the response as detect-remediate-rotate, not a hostage scenario. Daily Crypto Brief draft 10376 stays untouched.

What not to invent. Do not invent that the 0.36 ETH diversion equals stolen stake or that 523,000 ETH is MetaMask-confirmed. Do not invent slashing, wallet SRP compromise, or NFT approval drains from this incident. Do not invent that Lubin’s transfer funded the remediation. Do not invent Aave market freezes—secondary notes say a freeze contingency did not proceed.

What to watch on-chain next: whether MetaMask confirms or rejects Kaden’s ~17,000-validator / ~523,000 ETH exit estimate, whether fee-recipient addresses stay corrected after 16:46, and whether Lido posts downtime-penalty or reserve-draw tallies before the Oct 7 exit-complete checkpoint.

Bottom line: Researcher Kaden says MetaMask validators diverted about 0.36 ETH in block fees and estimates ~17,000 validators (~523,000 ETH) in precautionary exits—still unconfirmed by MetaMask—updating 10416.

Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).