MetaMask disclosed on September 30, 2026, that it is responding to an ongoing security incident affecting part of its infrastructure.

Overview Debates Related claims Topics Sources

Starknet wallets handle zero-knowledge proof generation and shielded balance data during Shadow Account operations without requiring developers to access users' viewing keys.

As an Ethereum layer 2, Starknet bundles transactions and relies on the underlying Ethereum base layer for security validation

Developers warned that malicious builders could exploit the Sepolia testnet by repeatedly winning block auctions and withholding execution payloads because test ether is inexpensive.

The FlashLoopAdapter exploit on October 1, 2026 mirrors a September 15, 2026 exploit where an attacker drained approximately 2,900 rsETH from an Ethereum Safe wallet by targeting a weak authorization check in a custom module

An attacker bypassed FlashLoopAdapter's access controls by deploying a fake Safe contract programmed to return true when the adapter checked if the module was enabled

An attacker manipulated the FlashLoopAdapter's _swap() function by supplying a custom swap router and calldata to invoke execTransactionFromModule on a victim Safe wallet

Two Safe wallets affected by the FlashLoopAdapter exploit belonged to a single owner, and both wallets disabled the vulnerable FlashLoopAdapter module immediately following the October 1, 2026 attack

The FlashLoopAdapter exploit resulted in a net loss of approximately 114.09 ETH, valued at roughly $305,000 to $310,000, which the attacker retained after settling the transaction costs

Similar Safe module exploits occurred in May 2026, including a $3 million exploit of the SquidRouterModule and an incident involving Gnosis Pay's Zodiac delay module.

Aave founder Stani Kulechov and security firms confirmed that the core Aave v3 protocol and its lending contracts were unaffected by the FlashLoopAdapter exploit.

The FlashLoopAdapter exploit did not compromise Safe's core infrastructure, as the vulnerability resided entirely within the third-party adapter's caller-validation logic.

An attacker exploited a custom contract called FlashLoopAdapter on Ethereum on October 1, 2026, draining approximately $305,000 from two Safe wallets.

The FlashLoopAdapter exploit was caused by an authentication flaw in the open() and close() functions, which checked if the module was enabled on the caller instead of verifying if the caller was a legitimate Safe.

Ethereum developers and contributors raised concerns regarding EIP-8363's potential effects on network security, validator diversity, solo staking, the staking industry, and the design of EIP-8363's burn curve

MetaMask stated that it has identified no immediate threat to MetaMask wallets or customer funds as a result of its infrastructure security incident disclosed on September 30, 2026

The MetaMask incident represents the second major Lido operator infrastructure compromise in just over a year, following Kiln's exit of all its Ethereum validators in September 2025.

MetaMask and Lido emphasized that their staking arrangement is non-custodial and that MetaMask does not manage or hold withdrawal keys for client stake.

Independent on-chain analysis by researcher Kaden suggests that 19 MetaMask validators won block rewards, with 18 of those payments, totaling roughly 0.36 ETH, routed to an address funded via Tornado Cash.

MetaMask is proactively exiting its operated Ethereum validators within the Lido liquid staking protocol as a precautionary measure to protect client assets.

Multisig wallets should require manual owner approval for all module-executed transactions