Crypto wallet provider MetaMask on the 5th published a follow-up on its official website regarding a security incident disclosed in September. Attackers rewrote the reward-recipient addresses of some Ethereum (ETH) validators, and about 0.385 ETH in staking rewards was drained.
The company became aware of the incident on September 28. Unauthorized access to infrastructure that centrally managed reward-recipient addresses resulted in changes to the settings of some validators. The rewrite was identified and remediated the same day it occurred, according to the company. MetaMask disclosed the incident on September 30 and had been proceeding with validator exits as a precautionary measure, but at the time it did not clarify the cause or the scope of impact. All affected validators have completed their exits.
In the follow-up, the company also noted that withdrawals were temporarily delayed for some customers and that losses to staking rewards may have occurred. It said, however, that it has found no evidence that users' wallets or private keys, or the staking principal deposited by customers, were leaked or subjected to unauthorized withdrawals.
