MetaMask recently confirmed a security incident involving its infrastructure that resulted in the diversion of staking rewards, as first reported by Bleeping Computer.
The non-custodial cryptocurrency wallet provider, developed by Consensys, disclosed that a threat actor gained unauthorized access to systems responsible for storing recipient addresses. This breach allowed the attacker to divert approximately 0.385 ETH in execution-layer staking rewards. MetaMask emphasized that the incident did not compromise customer staked principal, withdrawal keys, secret recovery phrases or private keys. The company identified and secured the affected systems on the same day the breach occurred. While the incident caused temporary withdrawal delays and missed rewards for some users due to precautionary validator exits, MetaMask is working directly with affected parties to provide refunds. This event highlights ongoing security challenges within the cryptocurrency sector, following recent supply chain attacks involving Ledger and a significant theft linked to North Korean hackers targeting Binance. MetaMask stated that its standard wallet users do not need to take any action, though those involved in specific staking arrangements should follow direct guidance from the company or their respective staking providers.
Source: Bleeping Computer
