Loading story…
MetaMask disclosed an ongoing security incident affecting part of its staking infrastructure and began precautionarily exiting the affected Ethereum validators it operates through Lido. The company said it had found no immediate threat to MetaMask wallets, its staking service remains non-custodial, and it does not control customers’ staking withdrawal keys; it is remediating the incident with external partners and security advisers. MetaMask did not disclose technical details of the compromise. Lido expects the validators’ exits to complete by October 7, although Ethereum’s exit queue and withdrawal-sweep process could delay withdrawal and restaking for roughly 45 days.
Lido said stETH holders need take no action, but validator downtime or exits can produce foregone staking rewards and potential penalties that affect stETH economics. It cited its diversified operator set and reserve exceeding 6,750 stETH as measures to limit disruption. Separately, Sentora’s RLUSD and PYUSD Morpho lending vaults experienced sharp outflows and reduced immediately available liquidity around the disclosure; reporting noted the timing but did not establish that the MetaMask incident caused the withdrawals.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
An Ethereum transaction returned 9.09 million RLUSD from Morpho through a lending adapter to Sentora’s RLUSD vault. The transfer returned funds to the vault and was distinct from a depositor redeeming vault shares.
Lido issued a security notice stating that stETH holders needed to take no action, but that affected validator exits or downtime could result in foregone rewards and potential penalties. Lido said it was investigating and cited its diverse operator set and a reserve exceeding 6,750 stETH as disruption-containment measures.
MetaMask disclosed an ongoing security incident affecting part of its infrastructure and began proactively exiting affected Ethereum validators in its non-custodial staking operations, including validators operated through Lido. It said it was working with external partners and security advisers, found no immediate threat to MetaMask wallets, and does not control clients’ staking withdrawal keys.
On September 30, Sentora’s RLUSD vault fell from about 426.4 million RLUSD to 350.4 million RLUSD, while its PYUSD vault fell from about 408.9 million PYUSD to 349.3 million PYUSD. Morpho data showed substantial declines by 7 p.m. ET, before MetaMask’s public incident post; the timing did not establish causation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcethedefiant.io
Open sourcethedefiant.io
Open sourcemetamask.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Consensys halted MetaMask product releases after discovering that a contractor linked to North Korea had obtained access to MetaMask code for roughly a month in March and April through a third-party staffing provider. Reporting said the individual worked on MetaMask-related code, including core components used to connect users to third-party fiat payment providers, and the case was described as an accidental hire under a false identity tied to the broader North Korean remote IT worker scheme targeting crypto and technology firms. Consensys said it terminated the contractor's access, opened an internal investigation, and notified law enforcement. The company stated that its review found no evidence of stolen assets, exposed user data, malicious code deployment, or impact to user safety, but the incident still forced a temporary release freeze and renewed scrutiny of hiring controls and supply-chain exposure in cryptocurrency development environments.
Jul 21, 2026
Resolv Labs and StablR suffered separate stablecoin security incidents that triggered sharp depegs after attackers abused token minting controls. Reporting on the Resolv incident said an attacker minted millions of tokens, undermining confidence in the protocol and pushing the stablecoin off its peg, while a later technical review described the event as a hack tied to failures around minting security. In StablR’s case, attackers exploited the issuer’s minting contract after what on-chain investigators said was likely a compromised key in a `1-of-3` minting multisig, causing both **EURR** and **USDR** to trade more than 20% below their intended values. Loss estimates in the StablR breach varied widely, with Blockaid putting theft near **$2.8 million** and other researchers, including RedStone Oracles co-founder Marcin Kazmierczak and PharosWatch, estimating closer to **$10 million**. The stolen funds were reportedly routed through Circle’s Cross-Chain Transfer Protocol on Noble, and StablR confirmed the exploit while saying it was working to contain the incident; no final recovery plan or definitive loss total had been released at the time of reporting. Together, the incidents highlight how compromise of minting authority can rapidly inflate supply, drain backing, and destabilize fiat-pegged crypto assets.
Jun 29, 2026
Meta paused work with AI hiring startup Mercor after Mercor disclosed a breach tied to the malicious `LiteLLM` packages `1.82.7` and `1.82.8`, which were published to PyPI after attackers stole the project’s publishing token through a compromised CI/CD chain involving Trivy tooling. Security reporting said the tainted packages harvested credentials and deployed a multi-stage backdoor capable of stealing API keys, cloud credentials, SSH keys, Kubernetes tokens, CI/CD secrets, database passwords, and other sensitive data, leading responders to treat affected environments as fully compromised. Mercor said the incident exposed source code and candidate information, while reports citing the attackers said as much as **4TB** of data was taken, including candidate profiles, personally identifiable information, employer data, and API keys, with one claim alleging access via `Tailscale` VPN. The fallout spread quickly across Mercor’s customers and partners: Meta reportedly froze contracts indefinitely while investigating whether AI training data or related secrets were at risk, OpenAI reviewed its own exposure while keeping contracts in place, and the breach triggered lawsuits and broader scrutiny of software supply-chain risk across the AI ecosystem.
Jun 29, 2026