Overview
- Chaos Labs detected suspicious activity in its operational wallets and moved into a full lockdown, rotating all operational keys.
- The company said its oracle network was not breached and continues to run in an isolated environment separate from routine on-chain wallets.
- Authorities and cybersecurity partners told Chaos Labs the tactics matched nation-state operations, a threat category that investigators say stole at least $578 million in April.
- Projects are switching providers, with Tydro adopting Chainlink oracles, Kelp DAO shifting its rsETH feed to Chainlink, and Solv Protocol moving parts of its cross-chain setup from LayerZero to Chainlink.
- The scare follows an April 2025 mispricing tied to a Chaos-linked oracle that triggered about $26.9 million in Aave liquidations, after which Aave and Chaos pledged reimbursements.