Lido DAO in Race Against Time to Replace Vulnerable Oracle

At a glance

• Lido DAO held an emergency vote to rotate an oracle key after it was compromised.
• The affected key belonged to one of nine oracles, operated by Chorus One, and its ETH balance was drained on May 10, 2025.
• Lido says stakers were not affected and the protocol stayed fully operational.
• The oracle set needs five of nine members to agree, so one bad key could not push false reports.
• The incident is another reminder that hot-wallet keys are a weak point across DeFi.

A drained oracle key at Lido

On May 10, 2025, one of the addresses in Lido’s oracle set was compromised and its ETH balance drained. Chorus One ran it. Lido contributors spotted the problem after a low-balance alert, confirmed the compromise with the operator within hours, and opened an emergency DAO vote to swap the key for a new one, while stressing that stakers were not affected and the protocol kept running.

Why oracle keys matter

Oracles connect Lido’s smart contracts to data from outside the chain, such as validator balances and exit requests, so a compromised oracle key is serious. The design limits the damage. Reports need agreement from five of nine oracles, and contributors checked the other eight and found no sign of compromise.

Replacing the key

The fix was a key rotation. The DAO vote replaced the compromised Chorus One address in the HashConsensus contracts for three oracles: the Accounting Oracle, the Validators Exit Bus Oracle and the CS Fee Oracle. The vote ran a 72-hour main phase followed by a 48-hour objection phase.

What Chorus One found

Chorus One said it found no evidence of an ongoing compromise of its infrastructure. The key dated to 2021. The company said a past leak of that hot wallet key looked like the most likely cause and, as a precaution, moved the oracle to a brand-new machine that runs nothing else.

How the vote went

Vote #186 reached quorum and was enacted on May 16, 2025, completing the rotation. Lido contributors said they would improve monitoring and work on making key rotation faster, and Chorus One promised a full post-mortem.

The DeFi lesson

The incident shows how much DeFi security depends on key handling. A hot wallet key left in use for years becomes a target, and an automated attacker only has to find it once. Lido’s quorum design kept one bad key from turning into a protocol failure. Rotation keeps it that way.

Why the response worked

Lido caught the problem through a routine balance alert, confirmed it within hours and replaced the key through its normal governance process. That is how an incident like this should go. Other DeFi projects should check how old their operational keys are, how they are stored, and how fast they could swap one out if it leaked.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.