Lido DAO triggered an emergency vote to remove a compromised oracle operated by Chorus One after attackers drained its ETH due to a leaked hot-wallet key—an operational error, not a protocol flaw.
Only Chorus One feed was affected; Lido’s validator sets, user funds, and other oracles remain secure.
The compromised oracle will be rotated out, and Chorus One is setting up a new server with fresh keys.
Chorus One blamed the incident on an exposed hot wallet, and a forensic review is underway to determine how the credentials leaked.