Chorus One reported that the exploiter's activity pointed towards an automated system rather than a targeted manual attack

Quotes that support claims

The attacker drained 1.46 ETH worth about $3,800 from the compromised address, blockchain data shows. "Investigation on all fronts is still ongoing; we will share a full postmortem after we conclude the investigation," Chorus One added on Lido's governance forum. "Activity of the exploiter points towards an automated system, rather than a targeted attack."