Crypto risk management and infrastructure provider Chaos Labs has disclosed that it identified and contained a cyberattack over the weekend that cybersecurity professionals and authorities have characterized as consistent with nation-state level activity. Chaos Labs founder Omer Goldberg confirmed in a Thursday X post that the company immediately triggered its highest-severity incident response upon detecting the attack, moving to a full lockdown to contain the damage. Critically, Goldberg stated that the Chaos Oracle Network — which provides data feeds to blockchain applications and sits at the core of the company's infrastructure — was never breached or compromised at any point during the incident. The attack's surface area was limited strictly to operational wallets used for routine onchain activities, which were isolated from the oracle infrastructure itself. "Chaos Oracles run in a fully isolated environment with nodes distributed globally, protected by layered security and cryptographic controls," Goldberg said, describing the architectural separation that prevented the attack from reaching its most sensitive systems.

The disclosure places Chaos Labs among a growing list of crypto infrastructure providers facing sophisticated, well-resourced adversaries in 2026. State-backed hacker groups — particularly those affiliated with North Korea, which has been linked to at least $578 million in crypto theft across several major incidents in April alone — represent a persistent and escalating threat to the sector. Chaos Labs has since rotated all cryptographic keys following the attempted breach and reports no further suspicious activity. The investigation is ongoing, with authorities and cyber professionals continuing to analyze the attack's origin and methods. For DeFi protocols and blockchain applications that rely on oracle data feeds for pricing and other critical functions, the incident is a reminder that the security of the infrastructure layer underpinning their operations deserves as much scrutiny as the smart contracts running on top of it.