MetaMask Staking doesn't control the withdrawal keys. an operator compromise can't redirect the staked ETH. it can redirect the block fees. Sep 30, 12:12–16:46 UTC: 18 blocks from @MetaMask -run validators paid their fees to a wallet funded through Tornado Cash at 10:27. total: 0.36 ETH. whoever set that address had access somewhere inside the validator operation. that's enough to treat the signing environment as potentially compromised. bad signatures can get validators slashed. Ethereum can't rotate a validator signing key in place. you exit, withdraw and restake with fresh keys. so they're rotating the validator. btw, we've seen the containment playbook before. Sep 9, 2025: Kiln disclosed a security incident and exited its Lido validators. 28 days later, the cause: compromised GitHub token -> CI workflows -> cloud credentials. 104 days later, the bill: 207.312 ETH in missed rewards across 5,726 validators. MetaMask hasn't disclosed the root cause or the validator count. one thing is already different. Kiln found no evidence its Ethereum validators were touched. here, someone was already collecting the fees. etherscan.io/address/0x98B92…