Kaden Links MetaMask Incident to Redirected Rewards From 18 Ethereum Validators

Analyst Kaden linked a MetaMask-related security incident to redirected block rewards from 18 of 19 affected Ethereum validators, while about 17,000 validators holding roughly 523,000 ETH voluntarily exited.

The rewards were sent to an address ending in 24A3 that Kaden linked to Tornado Cash funding, rather than the validators’ designated fee-recipient addresses. The attacker appears to have obtained only about 0.36 ETH and may not have been able to withdraw the validators’ staked Ether (ETH).

Kaden also identified three suspected affected validators that had not exited and about 821 potentially affected validators that remained active. The mechanism used to obtain signing authority has not been established, leaving open the possibility of further manipulation if the access allowed changes to validator settings.