Lido confirmed the compromised wallet, used since 2021, was completely drained overnight, indicating the key leak occurred at an earlier, unknown time

Quotes that support claims

The compromised wallet, which had been in use since 2021, was drained overnight. It’s believed that the private key may have leaked at some point in the past. There’s no sign that Chorus One’s infrastructure or Lido’s software was breached.