Lido Says Funds Safe After Oracle Incident Triggers Emergency Response

Ethereum staking protocol Lido moved over the weekend to neutralize a threat after one of its oracle keys, managed by validator operator Chorus One, was compromised.

Although 1.46 ETH ($3,675) was drained from a hot wallet used for oracle voting, Lido confirmed that the protocol remains secure and fully operational.

The breach came to light on May 10 when a contributor noticed a low balance alert on the affected wallet.

Further checks revealed the key had been accessed by an unauthorized party, prompting immediate coordination between Lido contributors and Chorus One to contain the situation.

The compromised wallet, created in 2021, was used to sign oracle reports but was not protected under the same strict standards as other infrastructure, Chorus One later clarified.

On May 10, a hot wallet managed by Chorus One that was used to vote in the Lido Oracle was accessed by an unauthorized entity, leading to the transfer of 1.46 ETH. Our team has been working tirelessly, in collaboration with @LidoFinance, to investigate the incident. As a result,… https://t.co/IIAGdBe1pQ pic.twitter.com/ZWpSFJ43VX

— Chorus One (@ChorusOne) May 11, 2025

Lido’s Quorum Model Limits Impact of Oracle Key Breach

Although the incident affected one of nine oracle participants, Lido’s oracle system is designed with resilience in mind. Its 5-of-9 quorum mechanism ensures no single operator can jeopardize the integrity of the oracle network. All remaining oracle addresses and the software infrastructure passed integrity checks with no signs of further compromise.

In response, Lido initiated an emergency DAO vote to rotate the affected oracle key across three contracts: the Accounting Oracle, Validators Exit Bus Oracle, and CS Fee Oracle.

The vote, launched immediately after the breach was confirmed, will run for 72 hours with a subsequent 48-hour objection window. The replacement key has already been generated and securely stored using updated security protocols.

Minor Node Issues Briefly Disrupted Oracle Reports, Now Resolved

Lido’s infrastructure faced additional oracle reporting delays on May 10. These delays were caused by unrelated technical issues affecting four other oracle operators. Specifically, the problems stemmed from node-level bugs. However, they were resolved quickly and had no impact on user funds or staking operations.

Meanwhile, Chorus One, which runs validator services across multiple networks, addressed concerns about the compromised wallet. The company explained that the wallet had always held low balances and was never used to store client assets. Therefore, no customer funds were at risk.

Chorus One added that the incident does not reflect its current security standards. Today, the firm secures oracle keys using HashiCorp Vault and enforces strict role-based access controls.

Lido has promised a full post-mortem once its ongoing investigation concludes. In the meantime, a review of oracle infrastructure and security practices is underway to prevent recurrence.