MetaMask has started taking affected Ethereum validators offline after disclosing a security incident in part of its infrastructure. The company says client withdrawal keys are outside its control.