Chorus One, a validator and oracle operator for Lido, identified the compromise as an isolated incident likely due to a leaked hot‑wallet private key, emphasizing no wider threat to its infrastructure or Lido's software

Quotes that support claims

Chorus One added that the exploit was likely attributable to a hot wallet private key leak, but is also setting up a new machine to ensure security moving forward.

Chorus One, which operates the oracle, said the attack appears to be an "isolated incident" without further threats to the protocol. "We have thoroughly audited our entire infrastructure and found no evidence of any broader compromise," Chorus One wrote on X.