MetaMask, the non-custodial wallet from Consensys, says a recent security incident did not affect its wallets or wallet infrastructure. It has now explained what the attacker did.
Timeline
On September 30, MetaMask disclosed that it was investigating an "ongoing infrastructure security incident" and, as a precaution, exited affected validators in its non-custodial staking operations. It shared few details at the time and did not say which infrastructure was involved.
In an update dated November 5, it said a threat actor gained access to systems used to store recipient addresses and diverted some execution-layer staking rewards.
Impact
- About 0.385 ETH in rewards was diverted. MetaMask says these rewards are separate from customers' staked ETH.
- The issue was identified and addressed the same day.
- No evidence was found that staked principal or withdrawal keys were compromised.
- Secret Recovery Phrases and private keys were not compromised.
- Some staking customers saw temporary withdrawal delays from the precautionary validator exits, and some may have missed rewards.
Guidance
MetaMask wallet users do not need to take any action. Affected staking customers should follow guidance from MetaMask or their staking provider. MetaMask says it is working with affected customers to refund lost rewards.
Context
The incident adds to a run of crypto infrastructure attacks. Ledger recently asked Asian resellers to halt wallet sales during a hardware implant investigation, and Binance attributed a multibillion-dollar theft to North Korean hackers who compromised its wallet infrastructure through a fake job interview.
Takeaway
Reward-routing data, such as stored recipient addresses, is a valuable target even when keys are safe. Operators should protect and monitor that configuration with the same rigor as signing keys.