Analyst: Suspected attack on 19 MetaMask validators, attacker only stole about 0.36 ETH in rewards.

BlockBeats news, October 1st, on-chain analyst Kaden stated that 19 MetaMask validators are suspected to have received block rewards, with 18 of these rewards not being paid to the correct fee recipient addresses, but instead transferred to an address funded by Tornado Cash. Following the incident, approximately 17,000 validators voluntarily exited, involving about 523,000 ETH. It is currently unclear whether the attacker has the authority to modify all fee recipient addresses.

Currently, 3 suspected affected validators have not yet exited, and another approximately 821 potentially affected validators have still not exited, with the specific reasons remaining unclear. Analysis suggests that the attacker actually stole only about 0.36 ETH in rewards and is very likely unable to withdraw the ETH staked by the validators. However, if the attacker has somehow obtained validator signing authority, they could theoretically use that authority to deliberately trigger slashing of the validators.

Previously reported, MetaMask released a security update disclosing that some of its infrastructure was affected by a security incident. No signs of a direct threat to the MetaMask wallet have been found so far.