MetaMask disclosed on September 30, 2026, that it is responding to an ongoing security incident affecting part of its infrastructure.