MetaMask says a recent infrastructure security incident did not compromise its wallet software or core wallet infrastructure. The company said attackers accessed systems used to store recipient addresses and diverted approximately 0.385 ETH in staking rewards, but found no evidence that customers’ staked funds, withdrawal keys, private recovery phrases, or private keys were exposed.
MetaMask says staking rewards were diverted
MetaMask is a non-custodial cryptocurrency wallet developed by blockchain software company Consensys. It allows users to store and manage assets on the Ethereum network and compatible blockchains.
On September 30, MetaMask said it was investigating an “ongoing infrastructure security incident” and had ejected affected validators from its non-custodial staking operations. Validators are Ethereum network nodes responsible for proposing blocks, validating cryptocurrency transactions, and helping maintain the blockchain’s security.
The company initially provided few details and directed BleepingComputer to an official statement when asked which parts of its infrastructure had been affected. In an update issued Thursday, MetaMask said threat actors gained access to systems used to store recipient addresses and misappropriated some rewards from the execution layer of its staking operations.
“The issue was identified and addressed on the same day, and approximately 0.385 ETH of the rewards were diverted. These rewards are separate from the ETH staked by customers,” MetaMask said.
“We have found no evidence that customers’ staked principal or withdrawal keys were compromised, and the affected systems are secure.”
MetaMask said its users’ private recovery phrases and private keys were not compromised. The company is working with affected customers to refund lost rewards.
Some staking withdrawals may be delayed
MetaMask said the precautionary termination of validators has caused temporary withdrawal delays for some customers. The process may also have resulted in missed staking rewards while validators were terminated or awaiting reactivation.
“We are working directly with affected customers and partners to address any outstanding impacts,” MetaMask said.
“Users of MetaMask wallets do not need to take any action as a result of this incident. Customers whose staking arrangements have been affected should follow the guidance provided directly by MetaMask or its staking provider.”
Recent cryptocurrency security incidents
Last month, Ledger asked resellers and distributors in Asia to stop selling its wallets and remove the products from store shelves while it investigated multiple hardware implant incidents.
Most recently, cryptocurrency exchange Binance admitted that North Korean hackers tricked employees into installing malware during fake job interviews, compromised its wallet infrastructure, and stole $6.34 billion.
Source: www.bleepingcomputer.com