Chaos Labs: Oracles Secure After Nation-State Wallet Attack Attempt

Chaos Labs, a crypto risk management and infrastructure provider, says its Chaos Oracle Network—used to feed data to blockchain applications—emerged from a weekend hacking attempt without a breach. Founder Omer Goldberg disclosed that the incident was detected promptly and that the surface area was confined to operational wallets used for routine on-chain operations. He emphasized that the Chaos Oracle Network remained secure, operating in a fully isolated environment with globally distributed nodes protected by layered security and cryptographic controls.

In a Thursday X post, Goldberg said authorities and cyber professionals view the activity as consistent with nation-state attacks, though the investigation is ongoing and updates will be shared as allowed. He also noted that Chaos Labs rotated all keys in response and has not observed any further suspicious activity since the initial incident.

While the claim of a possible nation-state attribution remains contested within broader cyber security discourse, the event occurs against a backdrop of heightened concerns over the security of cross-chain infrastructure and oracle providers. North Korea-linked actors have been linked to several large-scale exploits in recent months, though Pyongyang has denied involvement in global cybercrime. The April incident landscape, including the high-profile Kelp DAO breach, has intensified scrutiny on the sector’s risk controls and incident response protocols.

Goldberg stressed that Chaos Labs’ incident response was decisive and proportionate, stating that the company has rotated keys and that there has been no recurrence of suspicious activity. He added that the organization remains committed to robust cyber defense, noteing that a substantial portion of operating budgets is devoted to alerting, detection, and defense in an increasingly hostile threat environment.

Key takeaways

• The Chaos Oracle Network was not breached; the surface area was limited to routine operational wallets, with keys rotated and no subsequent suspicious activity detected.
• The incident prompted a full lockdown and a “highest-severity” incident response, underscoring the sector’s emphasis on rapid containment and cyber resilience.
• Authorities have described the activity as potentially consistent with nation-state tactics, though investigations continue and attribution remains under review.
• Across the industry, firms are reassessing oracle security and moving toward more trusted infrastructure, highlighted by a wave of migrations to Chainlink.

Chaos Labs’ response and the evolving oracle security landscape

Chaos Labs framed the weekend event as a test of the resilience of its data feeds and risk-management stack. Goldberg’s account of the incident centers on containment and rapid isolation: the compromised surface was confined to operational wallets used for routine on-chain operations, and the Chaos Oracle Network itself remained untouched. The firm rotated all keys in response, and Goldberg said there has been no follow-on anomalous activity since the initial response.

The company also highlighted the defensive posture underpinning its operations. “Chaos Oracles run in a fully isolated environment with nodes distributed globally, protected by layered security and cryptographic controls,” Goldberg wrote. The emphasis on segmentation and cryptographic safeguards reflects a broader industry push to harden critical infrastructure as the DeFi ecosystem expands and becomes more interconnected with cross-chain services.

In the broader context, security incidents in 2024 have driven heightened vigilance across the space. The April Kelp DAO breach, which coincided with a string of other exploits, sent waves through DeFi and highlighted the fragility of cross-chain and oracle architectures. Such events have intensified the debate about where trust should reside in any data feed—from the providers that curate data to the networks that transport and verify it across chains.

Despite the fog of attribution, the incident has already contributed to a shift in how protocols evaluate oracles and cross-chain infrastructure. The attack environment has reinforced the view among developers and investors that a multi-sourced, heavily audited oracle framework can act as a critical line of defense against cascading risks in DeFi and beyond.

Chainlink migration wave and what it signals for the sector

The Chaos Labs event has added momentum to a broader migration trend toward Chainlink’s oracle platform. Several projects have signaled or initiated moves to Chainlink in response to security concerns around other providers’ infrastructures. Notably, Tydro, a borrowing platform, announced plans to migrate to Chainlink after the Chaos Labs incident, joining a growing cohort of projects seeking more trusted oracle security amid a period of industry-wide scrutiny.

In related moves, Kelp DAO has migrated its restaking token rsETH to the Chainlink Oracle platform, continuing to fault LayerZero’s cross-chain infrastructure in connection with the April exploits. LayerZero has disputed the attribution, but the migration underscores a preference for proven, auditable cross-chain connectivity in a volatile security environment. Separately, Solv Protocol has publicly flagged plans to migrate its cross-chain infrastructure from LayerZero to Chainlink, citing recent industry events as a driver for re-evaluating security and reliability in interoperability.

Taken together, the shifts point to a broader industry emphasis on oracle reliability and secure cross-chain messaging as the backbone of DeFi’s ongoing growth. Chainlink’s established track record in providing decentralized, tamper-resistant data feeds appears to be a factor driving these migrations, even as other players continue to innovate and compete in the space. The exact timelines for these migrations vary by project, but the trend is clear: builders are prioritizing security posture and resilience in the face of an increasingly sophisticated threat landscape.

For investors and developers alike, the episode reinforces a core takeaway: the infrastructure that underpins DeFi—especially data feeds and cross-chain messaging—has become a strategic battleground. While attribution remains a puzzle in many high-profile exploits, the practical impact is tangible: protocols are increasingly choosing platforms with transparent security practices, verifiable audits, and robust incident response protocols as a core element of their risk management strategy.

North Korean-linked actors have been repeatedly associated with major crypto hacks, and the sector continues to monitor whether these patterns will intensify or shift as security practices improve. The opposing narrative—denials from the North Korean side—highlights the ongoing geopolitical tension surrounding cybercrime and the crypto industry. As investigators continue to piece together recent incidents, the market will likely watch how oracle providers differentiate themselves on security and reliability in the months ahead.

With Chaos Labs’ investigation still in progress, the industry will be watching how quickly and transparently new details emerge, and whether additional firms will accelerate their migrations to Chainlink or other trusted infrastructures. The evolving story underscores a broader shift toward stronger, more auditable cross-chain connectivity in a space that increasingly depends on dependable data feeds to sustain growth and user trust.

Source: Omer Goldberg, Chaos Labs (via X post); ongoing industry reporting surrounding the Kelp DAO and other exploits. For additional context on related incidents and reactions across the sector, see ongoing industry reports and coverage from Crypto outlets.