A $1,000 theft, a six-week queue: the liquidity term in staked ether

On 30 September, MetaMask disclosed a security incident affecting part of its infrastructure and said it had found no immediate threat to MetaMask wallets. The exploit itself was small. An attacker redirected the tips from 18 blocks produced by MetaMask Staking validators to a wallet funded through Tornado Cash, according to on-chain analyses by researcher Kaden and by Bitquery. The haul was about 0.36 ETH, under $1,000. Neither MetaMask nor Lido has confirmed the figure.

The precaution was far larger. MetaMask Staking, formerly Consensys Staking, began withdrawing the validators it runs for Lido, Ethereum's largest staking pool. Within a day, the network's exit queue went from zero to about 576,000 ETH, roughly $1.5bn, according to Lido's Dune dashboard.

Most of that queue appears to be MetaMask's. Bitquery counts 16,965 validators holding 565,056 ETH that had exited or joined the queue by early 1 October, a figure it describes as a floor. About 7,200 of those validators, roughly 230,000 ETH, were run for Lido. That is in line with the ~227,000 ETH peak in Lido's own exit queue. Neither company has confirmed these counts.

The theft is a rounding error. The queue is the story.

The exit sets off a long round trip. Each validator first waits in Ethereum's exit queue, then stops validating, and its ETH is swept back to Lido. Lido must then restake it, most likely through other node operators, although it has not said which. That new stake joins the back of Ethereum's entry queue. Both queues move at about 57,600 ETH a day. Lido estimates the cycle at "approximately up to 45 days" but does not publish the components. TBW's reconstruction below assumes the queues hold at 2 October levels.

The exit is not what makes the round trip long. The way back in is. Staking is at an all-time high of 35.8% of ETH supply, and nearly three times more ETH is waiting to enter than to leave. Everyone wants to stake, banks included: a Swiss private bank told TBW it actively stakes ETH and SOL. A precautionary exit puts MetaMask's ETH behind all of them. The line was built by demand, not stress. That is the paradox for holders: the more popular staking becomes, the more a precaution costs.

Why it matters for institutional players

Three groups should read this closely: heads of digital assets running or selecting staking operations, private bankers whose clients hold staked ETH or staking ETPs, and lenders taking ETH or staked ETH as collateral. Each faces the same queue in a different form.

Who pays. stETH holders lose yield, not capital. A validator keeps earning while it waits in the exit queue. Its ETH earns nothing only once it has stopped, through the fixed delay, the sweep and the entry queue: about 36 days with the short sweep reading, about 37 with the long one. Validators taken offline before their exit completes do worse than idle, because they incur the downtime penalties Lido has flagged. On TBW's estimate, 230,000 ETH idle for about 37 days at a 3% yield forgoes roughly 700 ETH, or about $1.9m. That is around 2,000 times the amount diverted, yet negligible per holder: under 0.08 stETH for every 1,000 held. Lido's emergency reserve of more than 6,750 stETH exists to contain disruptions, not to compensate holders for missed rewards.

Spillover: timing, not proof. Sentora's RLUSD and PYUSD lending vaults on Morpho saw sharp withdrawals on 30 September. In four hours, the RLUSD vault fell from about 426 million to 350 million, and the PYUSD vault from about 409 million to 349 million. Same-evening snapshots showed available liquidity down to about $8.5m and $2.4m. The Defiant tied the move to the incident by timing and noted that timing does not prove cause. By 2 October, Morpho showed the two vaults at about $430m and $395m. Precautionary exits also have a precedent. Kiln pulled all its Ethereum validators after a compromise in September 2025 and, by its own account to TBW, kept 95% of its clients.

Staking funds and ETPs. The queue is where wrapper design gets tested. In the US, BlackRock's ETHB stakes 70% to 95% of its ether and keeps a liquidity sleeve of 5% to 30% unstaked for redemptions, according to its prospectus. Inside the sleeve, the queue is irrelevant. Beyond it, the sponsor may delay settlement or switch to cash. The filing warns that unstaking "may take multiple weeks or months" and cites a past exit queue of 46.5 days.

European staking ETPs typically work differently. Authorised participants, usually large market makers, redeem directly with the issuer, while other investors trade on exchange. The queue becomes the market maker's problem and, under stress, would most likely show up as a wider spread. Either way, the investor pays for the queue. The wrapper only decides in what form.

Custodial staking. Here, the operator chose to exit and its clients bore the idle time. Choosing that operator is harder than it looks. A global bank's digital asset team told TBW in September that few of its staff have hands-on experience with validators, which makes it difficult to separate real capability from marketing. The economics are layered too: a staking infrastructure provider told TBW that when a validator is integrated directly into a custody platform, the custodian typically keeps about half. Due diligence should cover concentration by operator, who holds the exit trigger, and which clause assigns missed rewards and penalties.

Staked ETH as collateral. On Morpho's main wstETH/USDT market, about $140m to $150m in size, a borrower is liquidated once the loan reaches 86% of the collateral's value. That leaves the lender a 14% margin, which assumes wstETH can be sold quickly. A lender that must instead convert it to ETH through Ethereum waits about six weeks, exposed to the ether price throughout. As TBW argued on 25 September, collateral should be priced by how fast it can be unwound, not by volatility alone. On that test, the queue belongs in the haircut.

The Big Whale's take

The lesson is not that staking is unsafe. An operator's precaution moved hundreds of thousands of ETH, and the protocol processed it as designed. The lesson is that staked ETH has a liquidity profile set by Ethereum's queue, and record demand makes that queue longer. No provider contract overrides it. Allocators holding staked ETH should ask their provider three questions today. How concentrated is our stake by operator? Who decides to trigger an exit, and on what playbook? And when rewards are forgone or penalties are incurred, whose balance absorbs the loss?