MetaMask, the provider of the non-custodial cryptocurrency wallet, clarified that the recently disclosed security incident did not affect the wallet's core infrastructure or stored user assets, amidst a series of security challenges facing the cryptocurrency sector recently.
Details of the breach and financial impact
The company revealed in a recent update that a threat actor managed to access systems used to store recipient addresses, which enabled them to divert a portion of execution-layer staking rewards. MetaMask indicated that the diverted amount was approximately 0.385 ETH, confirming that these rewards are completely separate from the ETH assets that customers have staked.
The company confirmed that the issue was identified and addressed on the same day, and the affected systems have been fully secured.
Data integrity and private keys
The company reassured its users that no evidence was found to suggest that the principal staking assets or withdrawal keys were compromised. It also emphasized that the attack did not affect users' Secret Recovery Phrases or private keys, meaning that control over the wallets remains secure.
What changes practically for users?
Despite securing the systems, the precautionary measures taken by the company—which included exiting some affected validators—led to some technical consequences:
- Some customers may face temporary delays in withdrawals.
- Some users may notice the loss of some staking rewards during the validator exit process or while waiting for them to be reactivated.
MetaMask is currently working directly with affected customers and partners to address any remaining impacts and compensate for lost rewards.
Security recommendations
MetaMask confirmed that regular wallet users do not need to take any action as a result of this incident. As for customers whose staking arrangements were affected, they should follow the instructions provided directly by MetaMask or their staking service provider.