Security Incident Affects MetaMask Validators, Over 520,000 ETH Exited
Written with artificial intelligence.
Analyst Kaden reports that a security incident involving MetaMask validators may be linked to altered block reward addresses. Approximately 52.3 million ETH has been withdrawn by around 17,000 validators, with 19 validators affected by the incident.
Overview of the Incident
On October 1, PANews reported that analyst Kaden conducted an investigation into a recent security incident involving MetaMask validators. The findings suggest that the issue may stem from modifications made to the addresses receiving block rewards.
Details of the Affected Validators
Kaden noted that 19 MetaMask validators received block rewards, but the rewards for 18 of them were not sent to the correct fee receiving addresses. Instead, the funds were redirected to an address (0x98B9…24A3) associated with Tornado Cash. The total rewards stolen amount to approximately 0.36 ETH. It appears that the attacker currently lacks the ability to withdraw staked ETH.
Validator Withdrawals
Data indicates that around 17,000 validators have proactively exited, which involves approximately 520,000 ETH. Kaden also mentioned that three additional validators suspected of being affected have not yet exited, and about 821 potentially impacted validators remain operational. The reasons behind these statuses are still unclear.
Potential Risks
Kaden raised concerns about the possibility that the attackers may have gained signature permissions that could allow for further actions. This could theoretically lead to malicious triggering of penalties, also known as slashing, on the affected validators.