Today’s Field Note

Two things matter today. MetaMask disclosed an ongoing infrastructure security incident and began exiting its Lido validators as a precaution, with the exit, withdrawal, and re-entry cycle estimated at up to 45 days. The wallet says it has found no immediate threat to user funds, but the market did not wait for confirmation: Sentora’s Morpho RLUSD and PYUSD vaults saw sharp outflows against roughly $8.46M and $2.38M of available liquidity. Separately, Bitget confirmed last week’s $387.5M theft came from a zero-day in third-party security products, per SlowMist, a reminder that your exchange’s vendors are part of your attack surface. “No funds at risk” is the correct thing to say and the thing you plan around anyway.

Today’s Move

  • Treat the MetaMask incident as unresolved. Do not assume the “no threat to wallets” line is final until root cause is published.
  • If you hold funds on Bitget, reduce hot balances now; the zero-day was in a third-party product, so the blast radius is still being mapped.
  • If you are in Sentora’s Morpho RLUSD or PYUSD vaults, check available liquidity before the queue thins. Exiting late in a run is how you eat the slippage.
  • Hardware wallet users: verify every transaction on-device and treat any MetaMask prompt with suspicion until the infrastructure issue is closed out.
  • Watch Lido validator exit queues if you stake through MetaMask. The 45-day cycle means your ETH is illiquid for weeks, so plan accordingly.

Resources

  • https://thehackernews.com/2026/10/metamask-security-incident-prompts-exit.html
  • https://thedefiant.io/news/defi/sentora-s-morpho-vaults-see-sharp-outflows-amid-metamask-staking-incident
  • https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.