Ethereum Staking Rewards: Who Decides Where They Go?
An attacker redirected some MetaMask Staking rewards without touching a single withdrawal key. On Ethereum, the key guarding staked ETH does not decide where that stake’s income goes.
Key Takeaways
- Attacker redirected MetaMask validator rewards, not staked ETH.
- Operators, not withdrawal keys, set fee recipients.
- ePBS would guarantee builder payments, not their destination.
- Lido proposes monitoring how operators pick builder bids.
MetaMask laid out the details in its November 5 incident update, the latest entry on an incident the company first identified on September 28.
What MetaMask has disclosed so far
According to the update, an attacker gained unauthorized access to part of the infrastructure behind MetaMask Staking, where the addresses that collect validators’ execution-layer rewards were stored centrally. The attacker briefly changed those addresses for certain validators. MetaMask says it found and fixed the change the same day, after about 0.385 ETH in rewards had been diverted. It has not said how many validators were affected or how the attacker got in.
The withdrawal side held. MetaMask Staking does not hold the withdrawal keys for customers’ staked ETH, and the company says it found no evidence that staked principal, withdrawal keys or MetaMask wallets were compromised. Ordinary MetaMask wallet users do not need to take any action.
The 0.385 ETH is not the full bill. MetaMask exited every affected validator as a precaution, and all of those exits have now completed. Some customers faced temporary withdrawal delays, and the company acknowledges that rewards may have been missed while validators were exiting or waiting to be staked again. It has not put a figure on those losses or said whether the diverted rewards will be reimbursed, only that it is working directly with affected customers and partners.
The diversion itself appears only in the November 5 entry. MetaMask’s notices of September 30 and October 1 described the incident and the precautionary exits, and said there was no indication at that stage that wallets or customer funds had been affected.
Why the stake held but the income didn’t
Every validator answers to two addresses that are set in different places. Ethereum’s withdrawal guidance treats withdrawal credentials and the fee recipient as distinct settings, even though both can point to the same wallet.
Withdrawal credentials are registered on the beacon chain. Once they point to an execution-layer address, that address cannot be changed, and it is where the validator’s ETH goes when it exits. No operator server can redirect it.
The fee recipient is a software setting supplied by whoever runs the validator. In a non-custodial service, that is the operator, which also holds the keys the validator signs with. The setting tells the network where to send execution-layer income each time the validator proposes a block: transaction priority fees and payments from block builders. (The base fee is burned and never reaches the validator.) The operator can update the fee recipient at any time without the staker’s withdrawal key. This is the setting MetaMask says it stored centrally, and the one the attacker changed.
The same split explains why the loss stayed small. Consensus-layer rewards either remain in the validator’s balance or are swept automatically to the withdrawal address, so the altered setting never touched them. Execution-layer income arrives only when a validator proposes a block, which any single validator does infrequently, and MetaMask fixed the change within a day. Only proposals made inside that window paid the wrong address.
The same exposure runs through pooled staking
Nothing about this is unique to MetaMask. Wherever a third party runs the validator, the fee recipient sits in that third party’s configuration. Lido, whose validators are run by independent node operators, handles it by rule: its existing MEV policy requires every Lido validator to name the protocol’s Execution Layer Rewards Vault as fee recipient, and violations already have their own handling process.
The vault is a contract. Lido’s documentation says it collects execution-layer income, including MEV and priority fees, and that only the main Lido contract can withdraw from it, moving the ETH into the protocol’s accounting for stETH holders. A payment sent anywhere else never enters that accounting.
Holders of stETH stand one step further from these settings than MetaMask Staking customers. They own a transferable token, not withdrawal credentials for any validator, so their protection rests entirely on Lido’s contracts and operator rules. Coindoo’s guide to proof of stake covers how pooled staking compares with running or delegating a validator.
ePBS would guarantee the payment, not the address
On November 4, Lido published a proposal to update that MEV policy for enshrined proposer-builder separation, or ePBS, the design specified in EIP-7732. Validators that outto make sure the winning builder actually pays. Lido describes ePBS as reducing the need for that trust by having the protocol guarantee builder payments
The guarantee has limits. Under the design Lido describes, a single bid can combine a trustless value, owed as soon as the proposer includes the bid even if the builder never reveals its block, with an optional trusted payment settled outside the protocol and carrying the same counterparty risk as today’s market. Lido would let any registered builder win its slots with fully trustless bids, but only builders on its vetted Allowed List could add trusted payments.
0.10 ETHEnforced by the protocol
0.02 ETHBuilder’s own promise
0.12 ETHHeadline bid
More important for stakers, the guarantee covers how much is paid, not where it lands. Under the design, validators broadcast signed preferences naming their fee recipient for upcoming slots, and the trustless value goes to the fee recipient named in the bid. That address still originates with the operator. An altered fee recipient of the kind MetaMask described would receive guaranteed payments with the same certainty as the correct one.
Lido’s draft keeps the fee-recipient rule at its core. Both payment types must reach the EL Rewards Vault, and the policy would bind every node able to propose for Lido, including backup and failover machines. Lido says the proposal goes to a vote in November and would take effect only after the Glamsterdam upgrade reaches Ethereum mainnet.
What Lido’s checks would catch
Because ePBS opens more routes for delivering a block, the proposal widens Lido’s monitoring. A validator would be flagged for naming any address other than the vault, or for accepting a trusted payment from a builder outside the Allowed List. Flags would also cover trusted payments that fail to arrive in full within the settlement period, and locally built blocks proposed while eligible outside bids above the minimum threshold were available.
The bid-value check compares each selected bid with the highest eligible bid Lido’s monitoring saw, and flags anything below an initial 90–95% of it. The threshold is a prompt for questions, not a promised share of income. The draft allows operators to pass over the top bid for legitimate operational and reliability reasons, and the comparison only covers bids Lido’s own system observed.
A flag does not move money back. Fee-recipient violations stay under Lido’s current process, while other flags would follow the outreach and escalation path in Section E of its Standard Node Operator Protocol. Lido also plans to update its public Fees Monitoring Dashboard to show which track each Lido block came through.
How to check your own staking setup
Execution-layer payments are recorded on-chain, which is how the altered addresses at MetaMask became visible. A staker who knows their validator indices can open each block those validators proposed on a beacon chain explorer and check which address received the proposer’s payment. For Lido, the fees dashboard is the public view of the pool’s monitoring.
Exits deserve the same scrutiny. As MetaMask’s update notes, exiting a validator and withdrawing its ETH are separate processes: an exited validator still has to clear Ethereum’s withdrawal processing before the ETH is spendable. Since the Pectra upgrade, EIP-7002 has let the holder of a validator’s execution-layer withdrawal address trigger its exit directly, without going through the operator.
Four questions to put to any staking provider cover the gaps this incident exposed:
Who can change my fee recipient?
Look for named roles, sign-off before any change and a log of every edit, rather than one centrally stored setting.
How fast would you spot a wrong address?
Look for automated checks on every proposed block, with alerts instead of periodic manual review.
Which builder payments are guaranteed?
Under ePBS, expect a breakdown of protocol-enforced value versus trusted payments, and how unpaid amounts are pursued.
Can I exit without you?
Confirm your withdrawal credentials support self-triggered exits, and ask who covers rewards missed during a precautionary exit.
