MetaMask appears to withdraw 17K validators tied to 523K ETH after breach

EVM security researcher kaden.eth said on X that on-chain analysis suggests some block rewards from MetaMask validators were diverted to addresses linked to an attacker, and MetaMask appears to have proactively withdrawn about 17,000 validators, or roughly 523,000 ETH. Of 19 validators that received rewards, 18 sent those rewards to addresses linked to Tornado Cash funds, with the stolen amount estimated at about 0.36 ETH. Kaden.eth said it was unlikely the attacker had also secured withdrawal rights to the staked ETH, but added that, depending on how signing access was obtained, the attacker could still trigger slashing, a penalty that cuts a portion of staked ETH for rule violations. Another 821 potentially affected validators have not yet been withdrawn, and three of them were identified as validators that were actually attacked. MetaMask had previously said a security incident affected part of its infrastructure and that it was proactively withdrawing impacted validators, while no immediate threat to wallets had been identified.