A security incident involving MetaMask validators redirected block rewards after recipient addresses were tampered with. On-chain analyst Kaden said 18 of 19 validators that earned rewards sent payments to an address funded by Tornado Cash instead of the correct fee recipient. The attacker captured approximately 0.36 ETH but does not currently appear able to extract staked principal. About 17,000 validators have voluntarily exited, representing roughly 523,000 ETH. Three suspected compromised validators remain active, along with 821 other potentially affected validators whose continued operation has not been explained. The attacker’s full ability to alter fee addresses remains unknown, and broad compromise of signing permissions could theoretically create a risk of malicious slashing (penalizing validators by destroying staked funds).