A security incident involving MetaMask validators may have resulted from altered fee recipient addresses, analyst Kaden said after an on-chain investigation. Of 19 validators that received block rewards, 18 did not send them to the correct fee recipient address, instead transferring them to address 0x98B9…24A3, which was funded by Tornado Cash. The attacker appears to have stolen about 0.36 ETH and may not currently be able to withdraw the staked ETH. About 17,000 validators have voluntarily exited, involving approximately 523,000 ETH. Kaden said it remains unclear whether the attacker could modify all fee recipient addresses.